Privacy Policy

Last updated: September 28, 2026

Intostory (“we”, “us”) makes an app for iPhone and Android that turns your prompts into narrated, illustrated stories, and this website. This policy explains what personal information we collect, why, who helps us process it, how long we keep it, and the choices you have. If anything is unclear, email support@intostory.app.

The short version

• We use what you type to make your stories, and send it to AI providers that do the writing, narration and illustration.
• We check prompts and stories for safety, and keep records of blocked requests.
• We don’t sell your personal information and we don’t show ads.
• Payments are handled by Apple or Google; we never see your card.
• You can delete your account and data at any time in the app.

What we collect

Information you give us

• Account: your email address. You sign in with a one-time 6-digit code we email you; there is no password.
• What you create: prompts, story settings (length, language, voice, style, music), titles, saved characters (name, description, reference picture chosen from your stories), series (title, premise, schedule and time zone), rewrite instructions and notes for redrawing a picture.
• Support and safety: messages you send us, reports you make, and people you block.

Information created when you use Intostory

• Generated content: story scripts, narration audio, word timings and illustrations.
• Credits and purchases: your plan, story-minute balance and history, and subscription events (product, dates, store transaction IDs) from Apple or Google via RevenueCat. Never card numbers.
• Safety records: the result of automated checks on prompts and stories, and blocks counted against an account.
• Device and technical data: push notification token, app version, platform, device model and OS, device attestation results (Firebase App Check with Apple App Attest or Google Play Integrity), a one-way code derived from your device (Apple DeviceCheck on iPhone, a hash of the Android ID on Android) used only to limit the free story to one per device, and IP address for rate limiting and security.
• Usage and diagnostics: in-app events (for example “story created”, “paywall viewed”) linked to a pseudonymous account ID, and crash and error reports. We don’t put your prompts or email in these.

On this website

The website does not use advertising or tracking cookies. Our host records standard request logs (IP address, browser, pages requested). When you report a shared story, we receive the reason and any details you type, plus your IP address to prevent abuse.

How we use it

• To provide Intostory: sign you in, make, store, play and share your stories, and run scheduled episodes.
• To keep it safe: check prompts and generated stories and pictures, handle reports, and act on abuse.
• To process purchases, keep your plan and story-minutes correct, and refund failed stories.
• To send what you asked for: sign-in codes, “your story is ready” notifications and support replies.
• To fix problems and improve the app, using crash reports and aggregated usage.
• To prevent fraud, such as the same device claiming the free story again, and to meet legal obligations.

Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you (making and delivering your stories, purchases), our legitimate interests (safety, security, fraud prevention, improving the service), your consent where we ask for it (push notifications, analytics where required), and legal obligations.

AI processing

Intostory stories, narration and illustrations are generated by artificial intelligence. To make a story, your prompt and settings are sent to an AI text provider that writes the script, the script is sent to a text-to-speech provider, and scene descriptions (and, for saved characters, their reference pictures) are sent to an image provider. Prompts and stories also pass through automated safety checks. If one provider is unavailable we may use another from the list below for the same step.

We do not use your stories to train AI models ourselves. We use these providers under their paid business API terms, and where a provider offers a setting that keeps API content out of model training, we turn it on. Each provider handles your content under its own terms, which may let it keep inputs for a limited time for abuse monitoring.

Please don’t put sensitive personal information (such as health details or information about other real people) in prompts.

Who we share it with

We share personal information only with service providers who process it for us under contract, as described here, and when the law requires it. We don’t sell or rent personal information, and we don’t share it for cross-context behavioural advertising.

Share pages. When you share a story, anyone with its link can listen to it and see its title, summary and illustrations. The page doesn’t show your name or email. You can stop sharing at any time.

If Intostory is ever sold or merged, personal information may transfer to the new owner under this policy. We may disclose information when required by law or to protect people’s safety.

How long we keep it

• Account data and your stories: while your account exists.
• A story you delete: removed from your library at once, and permanently deleted within 30 days.
• Unfinished files from failed stories: deleted after 48 hours. Replaced versions of pictures or audio: after 7 days.
• Crash reports and analytics events: up to 90 days in detailed form; after that only in aggregate.
• Support messages and safety records: up to 2 years, or longer if needed for a legal claim.
• Purchase records: 7 years after the purchase, for tax and accounting law.
• Backups: overwritten within 30 days.

When you delete your account, see Delete your account for exactly what is removed and what is kept.

Your choices and rights

• Delete: Settings → Delete account in the app, or by email.
• Access, correct or export: email us and we will respond within 30 days.
• Notifications: turn push notifications off in your phone’s settings at any time.
• Object or withdraw consent: email us to object to analytics or other processing based on our legitimate interests.

Depending on where you live (for example the EEA, the UK or California), you may have further rights, such as to restrict processing, to data portability, to know what we collect, and not to be discriminated against for using these rights. You can also complain to your local data protection authority. We will verify requests using the email address on your account.

International transfers

Intostory runs on servers in the United States, and some providers process data in other countries. Where data leaves the EEA or the UK, we rely on safeguards such as the European Commission’s Standard Contractual Clauses.

Age limit

Intostory is for people aged 16 and over, and is not directed at children. We don’t knowingly collect information from anyone under 16; if we learn that we have, we delete the account. If you believe a child is using Intostory, email us.

Security

We protect data in transit with encryption, restrict access to it inside our systems, and keep payment details out of our systems entirely. No service is perfectly secure; if a breach affects you we will tell you as the law requires.

Changes

We will update this page when our practices change and change the date above. For significant changes we will tell you in the app or by email.

Contact

Questions or requests: support@intostory.app.