This policy describes what StoryPlay stores, who processes it, and how long it is kept. It covers both the free plan and the paid Pro plan.
StoryPlay is the data controller for the information described here: it decides what is collected, why, and how long it is kept. The companies listed under Processors act on our instructions and cannot use your data for their own purposes.
Signing in is handled by Firebase Authentication. Your identity provider holds your email address and confirms who you are; StoryPlay receives a verified user ID and the email address shown in the app. No password is ever stored by StoryPlay.
We also keep a small account record containing your user ID, email address, plan, and subscription status. This exists so we know which retention period and limits apply to you, and so a paying customer is not downgraded when they return.
Your script is sent to the provider that generates the voiceover. The script itself is also sent to a language model provider on every render, to strip markdown and conversational filler out of it before narration. That applies whether you pasted the script or used the story generator — the generator additionally sends a prompt describing the story you asked for, along with a short system instruction.
Your script and the audio generated from it are written to temporary files on the render server so the video can be built. Those temporary files are deleted when the render finishes or fails.
Retention depends on your plan:
There is no permanent archive. If you want to keep a video, download it. If your Pro subscription ends or a payment fails, your existing videos move back to the one-hour free retention.
Payments are handled by Stripe. Card details are entered on Stripe's own checkout pages and never reach our servers — we never see or store your card number. Stripe sends us limited subscription data: a customer reference, the plan, the subscription status, and the current period end date.
We do not store full payment card data. Stripe acts as an independent controller for the payment data it processes and its own privacy policy applies to that data.
These services process data on our instructions to run the service:
Each receives only what its step requires. None of the narration or language model providers are given your email address. StoryPlay does not sell your data, and there is no advertising or third-party analytics tracking on this site.
One cookie is set, called sessionToken. It holds your sign-in token, is marked HttpOnly so scripts cannot read it, is marked Secure so it only travels over HTTPS, and is limited to one hour to match the lifetime of the token it carries. It is refreshed while you are signed in and deleted when you sign out.
If you are in the EEA, the UK, or another jurisdiction with similar rules, you have the right to:
To exercise any of these, contact us through the project's repository. We respond within 30 days. You also have the right to complain to your regulator; in the UK that is the Information Commissioner's Office, and in the EU it is your local authority.
You can request deletion at any time. When we action it we remove your account record and any videos still held, and we instruct Firebase Authentication to delete the authentication record so access ends with it.
Because videos expire on their own after one hour (free) or seven days (Pro), most data disappears without action. Data held by our processors is removed through them — for example, your payment relationship is handled by cancelling the subscription with Stripe.
Passwords are never stored by us. Session tokens are held in HttpOnly cookies and validated server-side on every request. Generated video URLs are signed and expire. Access to rendered videos is limited to the account that created them.
Our processors may process data outside your country of residence. Where data is transferred internationally, the transfer relies on an adequacy decision or standard contractual clauses.
StoryPlay is not directed at children under 13, or under the age of digital consent in your country. We do not knowingly collect data from children.
We will update this page when our practices change and will revise the date at the top. Material changes affecting your rights will be announced in the app.
Questions about this page, or any privacy request, can go through the project's repository.