Privacy, explained.

Your stories, and your choices

Mystoria helps adults and children create and read personalized stories and take part in short activities. This policy covers the Mystoria app and my-storia.com.

An adult should manage the account, purchases, and decisions about sending information to cloud services. Children can participate in stories and activities with their support. A child's details can be personal information even when an adult enters them.

Information we use

• Account: your account identifier, sign-in information, and the email or name your sign-in provider shares. Your chosen nickname and optional small profile photo are saved privately with your account so they can be restored on another device. You can use Apple's Hide My Email where available.
• Stories and activities: text, preferences, selected photos, cutouts, recordings, generated pictures, and reading or activity history that you choose to save. Story setup can include a reader's nickname, age, interests, and communication or support needs. These details may reveal sensitive information; include only what the story needs.
• Cloud requests: the brief, story text, image instructions, and reference images needed for the cloud action you request. Names or other details you include can be part of that request; we do not promise automatic removal of personal information.
• Subscriptions: product and transaction identifiers, purchase status, renewal or expiration information, and generation usage. Apple processes payment details; Mystoria does not receive your complete payment-card number.
• Technical information: network and service logs, app and OS version, and diagnostic or usage information processed by our service providers. From devices with App usage sharing on, this includes crash and hang reports limited to the kind, terminating signal, app version, OS version and device model; no stack traces or story content.
• Support: your correspondence and any attachments you decide to send. Feedback sent from the app's Help & feedback screen is stored on Supabase with your account identifier, the app version and build, OS version, device model and language, and, if the app crashed recently, a short crash summary without story content, so we can act on it and reply when you allow a reply.

Local storage, sync and community templates

Your account nickname and optional avatar sync independently of library sync. The avatar is resized and newly encoded without the original photo metadata. Your public creator name and biography are managed separately. Restoring your private profile does not change this device's app usage sharing choice or its sync choices.

Mystoria keeps your saved library on your device. You can turn on Cloud sync in Settings to upload story records to Supabase and their included media to Cloudflare R2, then retrieve them on another device signed in to the same account. Sync runs while the app is open. Restore purchases verifies subscription access and is separate from library sync.

The separate Include reading history and My world option also syncs reading positions, activity responses, notes and reusable photos or cutouts. This option is off until you enable it on each device. A separate Include Discover collections and saved starters choice syncs private template collections and saved built-in stories; it is also enabled per device. Community story bookmarks, reports and blocked creators already follow your account independently of these switches. Unfinished setup answers, unreviewed picture candidates, publishing drafts and device preferences remain on the device.

Publishing a community template is a separate action. You choose its public words and optional pictures, review the copy, and submit it to Discover. Basic text rules check submissions; there is no routine pre-publication human review or automatic image-content review. Other people can save a private copy. Creating, syncing or buying Plus does not publish a story.

You can report a template, block a creator, or withdraw your published template. Withdrawal removes it from Discover but does not recall copies already saved or exported. PDF, text and editable-file sharing uses the destination you select; exporting a file does not by itself publish a community template.

Before a new cloud AI request, Mystoria asks you to allow OpenAI processing for this account on this device. Buying Plus, restoring purchases or enabling cloud sync does not grant this permission. Manage your choice in Settings → Cloud AI & privacy. Turning it off stops new OpenAI requests; it cannot undo content already sent. You can still recover an available result from a previously sent request without starting another OpenAI generation.

Manual editing and supported on-device text generation do not send story content to OpenAI. Downloading the optional model connects to its download host. Cloud writing, editing and picture requests send the story details, page text, instructions and approved generated reference images needed for that action through Mystoria's server to OpenAI. Names or sensitive details you include may be sent too. Personal photos and cutouts added locally are not sent to OpenAI by that composition step; they are uploaded when included in enabled sync or an explicitly published template.

Local recordings are used for playback. Apple-provided speech and Personal Voice features are subject to device permissions and Apple's handling of those services. Manage camera, microphone and photo access in your device's Settings.

Services that help Mystoria work

We use information to provide these features, maintain security, resolve errors, answer requests, and operate the service. We do not sell personal information or use it for targeted advertising. Providers may process information outside your country.

App usage sharing

Share app usage is on by default for accounts set up from September 22, 2026. It is separate from research participation and from the permission to send a story to the cloud writer. During profile setup the switch is shown pre-selected; you can turn it off there, or at any time in Settings → Your data & privacy → Help improve Mystoria. The choice applies to this account on this device.

While it is on, Mystoria sends account-linked events for app opens, account creation (sign-in method only), completed setup, ready-story saves, completed readings, Plus-screen visits, Plus purchase steps (Subscribe tapped, the App Store outcome such as cancelled, pending approval, failed or completed, restore attempts, and Mystoria's confirmation of access), observed Plus access, community-template saves, welcome credits being used up, story creations that failed (the writer and a failure category such as connection or cancelled, never the story), reading reminders being turned on, and app crash or hang reports (kind, signal, app version, OS version and device model only). The same events, together with which app section is open, also go to Google Analytics for Firebase, described above, which does not receive your Mystoria account identifier. Events include an identifier, time, development or production environment, and limited categories such as story source, plan name (monthly or yearly) or page counts. They do not include names, story or activity text, photos, recordings, diagnoses, search terms, free-text responses, prices, receipts or provider error messages.

These measurements help us understand use of the product. Separately, cloud generation and subscription records are required to provide paid features and calculate allowances and estimated API costs; the usage-sharing switch does not turn off that operational accounting. Authorized administrators can view usage and cost reports. We do not use these events for advertising or cross-app tracking.

Turning sharing off clears unsent usage events from this device and stops future collection by this feature. Turning it back on does not send activity from the time it was off. When an account is deleted, the app marks sharing off for that account on this device and removes its unsent events. It does not erase previously received events. Unsent events expire after about seven days. Older detailed server events are removed on the account's next event upload once they are more than 365 days old; inactive accounts may retain older records until that cleanup or account deletion. The first-observed participation date remains until account deletion. Deleting the Mystoria account removes its usage events and participation record.

Children and sensitive information

Mystoria is intended for shared use with adult support. Enter only information that is needed for the story. A nickname and a general description are often enough; avoid full names, addresses, school identifiers, medical records, or other sensitive details when they are unnecessary.

Only include another person's information or photograph when you have the authority or permission to do so. Review both text and pictures before sharing a story with a child. Contact us if a child has submitted information without appropriate permission or you need help removing it.

Participation in a research study is separate from using the app or buying Plus. Research invitations on this website are optional and require their own study information and consent process.

Storage and retention

When you schedule account deletion, our server records a deadline at least 168 hours (7 × 24 hours) after it accepts the request. Your account remains available until deletion starts. The app shows the deadline in your device's time zone. Deletion begins automatically on or after that deadline; you can cancel until deletion starts. Signing in or using Mystoria does not cancel the request. Scheduling alone does not remove your stories, private profile or community publications.

For a pending request from a Sign in with Apple account, we ask for a fresh Apple confirmation and retain a revocation token in encrypted form. We keep that token only for the pending deletion request, including its finalization, to revoke Mystoria's Apple sign-in authorization when deletion is carried out. The stored token is removed when the request is canceled or completed.

Local content remains on your device until you remove it. Exported copies, copies shared with others, and device backups can remain outside Mystoria's control. Account deletion on one device does not immediately erase offline copies on another device.

For cloud generation, validated results may be temporarily stored to recover interrupted requests. Recovery is available for up to 24 hours; expired results are removed by scheduled cleanup. Usage records retain request identifiers, hashes, operation types, and timestamps to prevent duplicate charges and enforce allowances. They do not contain the original prompt or photo bytes.

Account and billing records are retained while needed to operate your account, reconcile purchases, prevent abuse, and meet applicable obligations. Apple, RevenueCat, OpenAI, and hosting providers also retain information under their own policies; deleting your Mystoria account does not automatically erase their independently retained records.

Deleting an individual synced story or withdrawing a template removes or marks its record as supported by the app; general cleanup of unused media files is not currently enabled. Account deletion has a separate media-removal step. Once deletion starts, it removes files stored for your private library and public templates, plus older avatar, story or research-signature files that can be verified as belonging to your account. The server confirms this media step before completing account deletion. Interrupted cleanup is retried; an upload whose outcome cannot be confirmed can hold deletion for support investigation.

Completed account deletion removes the account-linked records, including the private profile and inline avatar, synced library and Discover selections, community publications, usage events, feedback messages and Mystoria's account-linked generation and billing records. Historical research data or older files without a reliable account-ownership link are not automatically attributed to your account or claimed erased by this process. Contact us about those records. Offline device copies, exports, backups and independent copies saved by others can remain.

A completed account-deletion receipt keeps a random request identifier, a proof hash, status, timestamps and a count of removed media files without the deleted account identifier or file contents, so an interrupted device can confirm the result. Result lookup lasts up to 30 days. Physical receipt removal depends on the configured cleanup schedule.

A separate storage-safety record retains the account identifier, a random deletion-job identifier, completion state and a file count to prevent delayed uploads from recreating erased files. It does not retain story text, photos or recordings. This minimal record currently has no automatic expiry. While deletion is unfinished, storage progress can also include object keys needed to confirm and resume the removal.

We use access controls and encrypted network connections, but cannot guarantee that any storage or transmission is completely secure.

Access, deletion, and contact

Use the app to edit or delete stories and export the stories you want to keep. To schedule account deletion, open Settings → Account → Delete account and choose Schedule account deletion. If you use Sign in with Apple, confirm your Apple identity when scheduling. You have at least seven days before deletion can begin. Until deletion starts, you can keep using your account and choose Cancel deletion in the same place. Signing in alone does not cancel it. Once deletion begins, it cannot be canceled.

Mystoria keeps this account's saved data on the current device until the server confirms that the online account has been deleted. If the result cannot be confirmed, check the request status again; if local removal is interrupted after confirmation, use Finish removing local data. Account deletion removes your published templates from Discover, but cannot recall independent copies another family already saved or exported. The media-removal scope and remaining retention are explained above.

Deleting the app or your account does not cancel an Apple subscription. Manage subscriptions through your Apple subscription settings.

You can contact us to request access, correction, deletion, or other privacy rights available in your location. We may need to verify that a request concerns your account. Do not send a password or a child's private story to establish your identity.

Website preferences and updates

The website stores your light/dark theme preference in your browser.

Early-access list. If you join the list on the home page, we store your name, email address, role, optional organization, optional location, how many children or clients you support, how you would use Mystoria, your answer about the paid plan, whether you would like early access, would consider a letter of support, or would like to hear about the UW Bothell research study, the consent boxes you ticked, the time of submission and the country of the network you submitted from. We first send one message asking you to confirm your address; unconfirmed entries are kept so the link keeps working but are reported separately. We use the list to tell you when Mystoria launches, to invite you to early access if you asked for that, to send study information if you asked to hear about the research (participation always needs its own consent process), and, in aggregate, to describe interest in Mystoria, for example the number of sign-ups by role. We quote an individual answer with a name only when that box was ticked. Every message includes a link that deletes your entry immediately; you can also write to hello@my-storia.com. Entries collected before September 23, 2026 through the earlier Google Apps Script form were moved to this list with their original date and marked as unconfirmed until their owner confirms. To limit abuse, a hashed form of your network address is kept for two days.

We will update this page when our data practices change and identify the updated date. Where required, we will provide additional notice or obtain consent before a material change.