9.1 Introduction
StoryMate ("StoryMate", "we", "us", "our") provides a service that helps a parent or legal guardian create personalized, illustrated, and narrated storybooks for their child (the "Service"). This Privacy Policy explains what personal information we collect, how we use and protect it, who we share it with, and the choices and rights you have.
This policy applies to storymate.au, app.storymate.au, and related apps and communications. It should be read together with our Terms of Service and Cookie Policy.
The entity responsible for your information (the "data controller") is Konsep Media (ABN 70 381 377 396), New South Wales, Australia.
9.2 A service for parents, used on behalf of children
StoryMate is designed to be set up and operated by a parent or legal guardian. We do not knowingly allow children to create their own accounts or provide information to us directly. Before a child's character is created, the adult must confirm that they are the child's parent or guardian and consent to the use of the child's photo and details as described here. If you believe a child has provided us information without parental consent, contact us at support@storymate.au and we will delete it.
9.3 Information we collect
a) Information you give us
- Account information: the parent/guardian's email address, display name, and password (stored only as a secure hash).
- Child inputs: a photo you upload to create a character, and details you enter such as the child's first name/nickname and age.
- Content you create: characters, stories, cover images, reading progress, favorites, quiz results, ratings/feedback, and any parent PIN you set.
- Communications: messages you send us (e.g. support requests).
b) Information collected automatically
- Strictly-necessary technical data: a session cookie and preference cookies (Kids Mode, theme) — see our Cookie Policy. We do not use advertising or third-party tracking cookies.
- Limited service/diagnostic data: basic technical information needed to operate and secure the Service (e.g. error diagnostics, rate-limiting signals).
- Product analytics & diagnostics: we use PostHog, a third-party product-analytics tool, in the StoryMate app to collect basic usage and error/diagnostic data that helps us fix problems and improve the Service. We do not use session recording, and this data is never used for advertising or sold.
c) Payment information
Payments are processed by Stripe. We do not receive or store your full card number. We receive limited billing metadata (e.g. a customer/subscription identifier and payment status) needed to manage your subscription and gem balance.
9.4 How we use information (purposes)
We use personal information to:
- provide and operate the Service — create characters and stories, save progress, deliver narration and PDF downloads;
- generate story text and illustrations (see Section 9.6) and run automated safety checks;
- process payments, manage your gem balance and subscription, and prevent abuse/fraud;
- send essential service messages (email verification, password reset, "your story is ready") and, where you opt in, push notifications;
- respond to your requests and provide support;
- maintain security, debug, and comply with legal obligations.
We do not sell your personal information, we do not show advertising, and we do not use children's data for advertising or profiling.
Legal bases (where GDPR/UK GDPR applies): performance of a contract (providing the Service); consent (uploading a child's photo; optional push notifications; optional community publishing); legitimate interests (security, fraud prevention, service improvement) balanced against your rights; and legal obligation.
9.5 Photos — special handling
The photo you upload is used solely to generate the child's stylized illustrated character. The original uploaded photo is deleted after the character is created. The resulting illustrated character (not the photo) is retained as part of your content so it can be reused across stories, until you delete it or your account.
9.6 AI generation and automated processing
Story text and illustrations are produced with the help of third-party artificial-intelligence providers. Story text is automatically checked for safety before any illustrations are generated, and generated images are also subject to automated checks. Content is generated to fulfil your request and is shown back to you; it is not used to serve ads. We instruct these providers to use your content only to provide the Service to you, not to serve advertising.
9.7 How we share information (processors & recipients)
We share personal information only with service providers ("processors") who help us run the Service, under contracts that require them to protect it and use it only on our instructions. Categories:
- AI generation providers — to produce story text, illustrations, and narration.
- Payment processor — Stripe, to process payments and manage subscriptions.
- Cloud hosting & storage — to host the application, database, and generated files.
- Email delivery — to send transactional email.
- Push notification delivery — where you have opted in.
- Product analytics — PostHog, to collect usage and error diagnostics that help us improve the Service (no session recording).
The categories of processors above reflect how we run the Service. A current list of our named sub-processors is available on request from support@storymate.au.
We may also disclose information if required by law, to protect the safety of a child or any person, to enforce our Terms, or in connection with a business transfer (with notice where required). We never sell your data.
9.8 International data transfers
We and our processors may store and process information in countries other than where you live. Where required, we use appropriate safeguards for such transfers (e.g. standard contractual clauses).
9.9 Data retention
We keep personal information for as long as your account is active or as needed to provide the Service:
- Uploaded photos: deleted after the character is created (Section 9.5).
- Account, characters, stories, progress: retained until you delete them or close your account.
- Billing records: retained as required for legal, tax, and accounting purposes.
- Fraud prevention: after you delete your account we retain a one-way anonymized identifier (a hash derived from your email — not the email itself, and not reversible) solely to prevent abuse of one-time signup rewards (e.g. repeatedly deleting and recreating an account to re-claim them).
When you delete your account, we delete or de-identify your personal information within a reasonable period, except where we must retain limited records to meet legal obligations.
9.10 Security
We use technical and organizational measures to protect personal information, including encryption in transit, hashed passwords, access controls, private-by-default content, and signed, time-limited URLs for stored files. No method of transmission or storage is 100% secure, but we work to protect your information and continuously improve our safeguards.
9.11 Children's privacy
StoryMate is a parent-operated service and is not directed to children for the creation of their own accounts. We minimize children's data by design: no child logins, no child contact details, and photos deleted after character creation. We handle children's information consistent with applicable laws, including the U.S. Children's Online Privacy Protection Act (COPPA), the "children's data" provisions of the GDPR/UK GDPR, and the Australian Privacy Principles.
9.12 Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. You can:
- view, edit, and delete your characters and stories in the app at any time;
- delete your account and associated data from Settings;
- opt out of push notifications in your device/app settings;
- contact us at support@storymate.au to exercise any right.
We will respond within the timeframe required by applicable law and will not discriminate against you for exercising your rights. If we deny a request, we will explain why where permitted.
9.13 Cookies and tracking
We use strictly-necessary cookies plus a first-party product-analytics tool (PostHog) for error monitoring and product improvement — see our Cookie Policy. We do not use advertising or cross-site tracking cookies, session recording, or ad-targeting, and we never sell your data.
9.14 Changes to this policy
We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice (e.g. by email or in-app).
9.15 Contact & complaints
Questions or requests: support@storymate.au (Konsep Media, New South Wales, Australia). If you are in Australia and are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC). If you are in the EEA/UK, you may contact your local data protection authority.
Konsep Media · New South Wales, Australia · support@storymate.au