Skip to content

    Privacy Policy

    Last updated: September 28, 2026

    This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

    We use Your Personal data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

    Interpretation and Definitions

    Interpretation

    The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

    Definitions

    For the purposes of this Privacy Policy:

    • Account means a unique account created for You to access our Service or parts of our Service.
    • Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
    • Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Storywillow. [Legal Note: This section must be updated before launch to include the full legal name and address of the Egyptian operating company and the US-based LLC responsible for payments, clarifying their respective roles.]
    • Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your Browse history on that website among its many uses.
    • Country refers to: Egypt
    • Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
    • Personal Data is any information that relates to an identified or identifiable individual.
    • Service refers to the Website.
    • Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used. Examples include payment processors and analytics providers.
    • Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
    • Website refers to Storywillow, accessible from http://www.storywillow.com
    • You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

    Collecting and Using Your Personal Data

    Types of Data Collected

    Personal Data

    While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

    • Email address
    • First name and last name
    • Usage Data

    Subscriptions and credit purchases are made inside the Storywillow mobile app and are processed by the app store You downloaded it from — Apple's App Store or Google Play. Your payment details are handled entirely by Apple or Google under their own terms and privacy policies; We never receive, collect, or store Your payment card information.

    We use RevenueCat, a subscription management service, to receive confirmation of Your purchase status from Apple and Google and to keep Your subscription entitlement in sync across Your devices. RevenueCat receives a purchase identifier and Your Storywillow account identifier for this purpose — not Your payment details.

    Usage Data

    Usage Data is collected automatically when using the Service.

    Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type and version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data. When You use the Storywillow mobile app, this may also include Your device type and operating system version, the app version You are running, and crash or diagnostic reports.

    Analytics, Cookies and Similar Technologies

    The Storywillow website does not use advertising or tracking cookies, and does not show a cookie banner because it does not need one. Specifically:

    • Website analytics (PostHog). We use PostHog, a product analytics service, in “cookieless” mode to understand how the website is used — for example, which pages are visited and how often visitors tap a store badge. In this mode PostHog stores nothing on Your device: no cookies, and no local or session storage. To count unique visitors, PostHog derives an anonymous identifier from Your IP address, browser user agent and a secret that changes every day; it cannot be used to recognise You across days. We do not use session recording on the website, and we never link website analytics to Your Storywillow account. Analytics requests are sent through the storywillow.com domain to PostHog's servers.
    • Sign-in cookies (necessary). If You sign in on the website, a session cookie keeps You signed in. It is set only when You sign in and is required for that purpose.
    • Spam protection (necessary). Our contact form uses Google reCAPTCHA to tell people from automated spam. Google may set cookies and collect device and usage information for that purpose under its own privacy policy and terms.
    • Preferences stored on Your device. If You dismiss the “Get the app” banner on a phone, Your browser remembers that choice for seven days in local storage. Nothing else is stored, and it is never sent to us.

    Our emails may count opens or clicks so that We know they are delivered and useful. You can block remote images in Your email app to prevent this.

    Use of Your Personal Data

    The Company may use Personal Data for the following purposes:

    • To provide and maintain our Service, including to monitor the usage of our Service.
    • To manage Your Account: to manage Your registration as a user of the Service.
    • For the performance of a contract: for the services You have purchased or of any other contract with Us through the Service.
    • To contact You: To contact You by email or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including security updates.
    • To provide You with news, special offers and general information about other goods, services and events which we offer unless You have opted not to receive such information. You may opt out at any time by using the "unsubscribe" link in our emails or by managing your preferences in your account settings.
    • To manage Your requests: To attend and manage Your requests to Us.
    • For business transfers: In connection with any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
    • For other purposes: For data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service, products, services, marketing and your experience.

    Legal Basis for Processing Personal Data under GDPR and DPPL

    We may process Personal Data under the following conditions:

    • Performance of a Contract: To provide you with our Service or to manage your account, as processing your data is necessary for the performance of the contract you have with us.
    • Consent: You have given Your explicit consent for processing Personal Data for one or more specific purposes, such as for receiving marketing communications or using non-essential cookies.
    • Legitimate Interests: When processing is necessary for our legitimate interests, such as for internal analytics, service improvement, and fraud prevention, and it is not overridden by Your data protection interests or fundamental rights.
    • Legal Obligations: When we need to process your Personal Data to comply with a legal obligation.

    Sharing Your Personal Information

    We may share Your personal information in the following situations:

    • With Service Providers: We may share Your personal information with Service Providers to make Your stories, to monitor and analyze the use of our Service, to process payments, and to contact You. This includes:
      • AI providers that make the stories: OpenAI (writes each story, runs an automated safety check on it, and draws picture-book illustrations and covers) and xAI (reads stories aloud for the Bedtime Narrator) — see “How Stories Are Made” below
      • Analytics Providers (PostHog, used cookielessly on the website)
      • App store payment processing (Apple App Store, Google Play)
      • Subscription management (RevenueCat)
      • Email Communication Providers
    • For business transfers: We may share or transfer Your personal information in connection with any merger, sale of Company assets, financing, or acquisition.
    • With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy.
    • With Your consent: We may disclose Your personal information for any other purpose with Your consent.

    Nothing You create is public by default. Your account details — Your email address and name — are never made publicly visible in any circumstance.

    A story You have created is private to Your account unless You choose to share it. Two separate, individually reversible choices can change that:

    • Sharing a story by link. This creates a public page that anyone holding the link can open without an account, and which search engines may index. That page shows the story itself, including any character name or details You chose to include when creating it.
    • Adding a story to the community gallery. The gallery lists the story's title, theme and a short excerpt only — never the full character details.

    Both are off unless You turn them on, both can be turned off again at any time, and turning either off removes the story from public view. Anyone — including someone without an account — can report a publicly shared story or collection for review, and We may remove content from public view in response. Removing content from public view does not delete it from Your own library.

    Retention of Your Personal Data

    The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy.

    We will retain your account data as long as your account remains active. If you delete your account, your personal data will be permanently deleted within 90 days, except for information we are required to retain to comply with our legal obligations.

    Usage data for analytics is retained in an aggregated or anonymized form for a period of 24 months.

    AI-Generated Content

    The stories and related content generated through the Service are created by an artificial intelligence system. The Company retains the intellectual property rights to all content generated on the Service. You may delete content you have generated from your account at any time, at which point it will be permanently removed from our systems. We will only use or showcase content you have generated for promotional purposes with your explicit and separate consent.

    Transfer of Your Personal Data

    Your information, including Personal Data, is processed at the Company's operating offices and on servers which may be located outside of Your country, including in the United States and other jurisdictions. Data protection laws in these countries may differ from those in Your jurisdiction.

    Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

    The Company will take all steps reasonably necessary to ensure that Your data is treated securely. When we transfer Personal Data outside of jurisdictions like the European Economic Area (EEA), we will ensure an adequate level of protection is afforded to it by relying on mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) or other legally-provided transfer mechanisms.

    Disclosure of Your Personal Data

    Business Transactions

    If the Company is involved in a merger, acquisition or asset sale, We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

    Law enforcement

    Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

    Security of Your Personal Data

    The security of Your Personal Data is important to Us. We implement a variety of security measures to maintain the safety of your personal information, such as using SSL/TLS encryption for data in transit and access controls for our internal systems. However, remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

    Your Data Protection Rights

    You may update, amend, or delete Your information at any time by signing in to Your Account and visiting the account settings section. You may also contact Us to request access to, correct, or delete any personal information that You have provided to Us.

    Your Data Protection Rights under GDPR (For EEA/UK Residents)

    If you are a resident of the European Economic Area (EEA) or the United Kingdom, you have the following data protection rights:

    • The right to access, update or delete the information we have on you.
    • The right of rectification.
    • The right to object to our processing of your Personal Data.
    • The right of restriction. You have the right to request that we restrict the processing of your personal information.
    • The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.
    • The right to withdraw consent at any time where the Company relied on your consent to process your personal information.

    Your California Privacy Rights (CCPA/CPRA)

    This section applies only to California residents. It describes your rights and explains how to exercise them.

    • Right to Know and Access: You have the right to request that We disclose the categories and specific pieces of personal information We have collected about you.
    • Right to Delete: You have the right to request the deletion of your personal information, subject to certain exceptions.
    • Right to Correct: You have the right to request that We correct inaccurate personal information that We maintain about you.
    • Right to Opt-Out of Sale/Sharing: You have the right to direct Us not to "sell" or "share" your personal information. We do not sell or share personal information for cross-context behavioral advertising. Our website analytics run without cookies and are used only to improve Storywillow. If You enable the Global Privacy Control (GPC) signal in Your browser, We will treat it as a request to opt out.
    • Right to Non-Discrimination: You have the right not to be discriminated against for exercising your privacy rights.

    To exercise these rights, please contact Us. To learn more about the categories of personal information we have collected and shared in the preceding 12 months, please see the "Types of Data Collected" and "Sharing Your Personal Information" sections of this policy.

    How Stories Are Made (Third-Party AI)

    Storywillow uses third-party AI services to make stories. The app asks for Your permission before anything You enter is sent to them, and You can withdraw it in the app's Settings (Storywillow then cannot make new stories until You agree again).

    • OpenAI receives what You enter for a story — the characters and names You choose, any details, the lesson, style and length — and returns the story text. It also checks every finished story with an automated safety filter and, for picture books and covers, draws the illustrations. Under OpenAI's API terms, this data is not used to train its models, and OpenAI may keep it for up to 30 days to detect abuse before deleting it.
    • xAI receives the text of a story when You ask the Bedtime Narrator to read it aloud, prepares it for reading, and returns the audio, under its own terms.

    We send only what is needed to make the story, never sell it, and never use it for advertising. Names are entirely up to You: a character can be called anything — Your child's name, a nickname, or a name You make up.

    Children's Privacy

    The Service is intended for use by adults: accounts are created and held by a parent or guardian, and We do not knowingly allow anyone under the age of 13 (or 16 in certain European jurisdictions) to create an account of their own. If We become aware that a child has created an account directly, without a parent or guardian, We will take steps to close it and delete the associated data.

    Creating a personalized story for a child is the core purpose of the Service, so a parent or guardian may voluntarily provide Us with information about their child — such as a first name, age, and optional details like a favorite toy, pet, sibling, or personality traits — so the Service can generate a story for that child. This information is provided directly by the parent or guardian, about their own child, as a deliberate feature they choose to use. It is used only to personalize that child's story, is never sold, and is never used to build an advertising profile of the child.

    A parent or guardian can review, edit, or delete any information they've provided about their child at any time from within the app, and can delete the associated account — and all child information tied to it — as described above. Making a story public, adding it to the community gallery, or sharing a collection of stories is always the parent's choice and off by default; a story can be made private again at any time, and a collection can be unshared or deleted from the app. A shared story's page shows the story itself — including whatever character names the parent chose to use in it — but never the child profile behind it (such as age or interests); the gallery shows only a story's title, theme and a short excerpt. Because names are the parent's choice, a parent who would rather not publish their child's real name can use a nickname or an invented name.

    If You are a parent or guardian and believe Your child has provided Us with personal information outside of the flow described above, please contact Us so We can review and remove it.

    Links to Other Websites

    Our Service may contain links to other websites that are not operated by Us. We strongly advise You to review the Privacy Policy of every site You visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

    Changes to this Privacy Policy

    We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page. We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.

    Contact Us

    If you have any questions about this Privacy Policy, You can contact us: