Privacy Policy

This policy covers everyone who uses StoryMe: parents and guardians, the children whose stories are created, teachers running Classroom Project Packs, and invited guests who join multiplayer adventures. If you create an account on behalf of a child, you are responsible for that child's use of StoryMe and confirm you are their parent or legal guardian, or that you have permission from a parent or legal guardian.

When this policy says "you", it usually means the adult account holder. Where it refers to a child's information, we are describing information about a child that an adult has provided to us, or that is created while the family uses the service.

We collect only what StoryMe needs to work. That is:

• Account details — your name (as given by Google sign-in), email address, and a unique account identifier.
• Child information you give us — your child's first name, age, chosen themes, and the photo you upload so illustrations can feature them. We never ask for a child's surname, school, address, or any government identifier.
• Generated content — the stories, illustrations, narration audio, read-along practice results, and adventure timelines you create, including the choices and dice rolls made during adventures.
• Voice recordings — short recordings of a child reading a page aloud, made only when you press the read-along button. These are used to give pronunciation feedback and are not used for any other purpose.
• Classroom details — for Classroom Project Packs: the teacher's project details, and learner first names and photos submitted by parents through the class join link.
• Payment records — the plan purchased, amount, currency, date, and payment status. Card and banking details are handled by PayFast, our payment provider; we never see or store your full card number.
• Technical logs — standard security logs such as sign-in events, error reports, and the language setting you choose, used to keep the service working and safe.

• To create the books, illustrations, narration, read-along feedback, and adventures you request.
• To show your library, plan balance, and purchase history to you.
• To process payments through PayFast and keep the records required by tax and accounting law.
• To run multiplayer and classroom features, including the invite codes you choose to share.
• To check the quality and safety of generated illustrations and text before they reach your library.
• To fix problems, prevent abuse, and keep accounts secure.
• To respond when you contact us for support.

We do not sell your personal information, we do not rent it, and we do not use your child's photo, voice, or stories to advertise to you or to anyone else. We do not make automated decisions that have a legal or similarly significant effect on you.

We rely on the following grounds under POPIA and, where relevant, the GDPR:

• Consent — you actively choose to upload a photo, record a voice, or create a book. You can withdraw consent at any time by deleting the content or your account.
• Performance of a contract — creating the books and adventures you ask for, and delivering the plan you paid for.
• Legal obligation — keeping payment and tax records as South African law requires.
• Legitimate interest — security logging, abuse prevention, and improving reliability, in ways that do not override your rights.

StoryMe uses artificial-intelligence services to write, illustrate, and narrate stories, and to transcribe read-along practice. When your child's name, photo, or a recording is sent to these services, it is used only to generate your content, and we instruct our AI providers not to use this content to train their models.

Generated content goes through automated quality and safety checks before it appears in your library. Illustrations are reviewed by a vision model to make sure your child is shown fully and clearly, and text is guided to stay gentle, age-appropriate, and free of frightening or inappropriate themes.

Because generation is automated, we also give you practical control: you can regenerate pages you do not like, delete any story or adventure at any time, and ask us to review anything you think is wrong.

Read-along practice records short clips of the child reading a page aloud, only after the adult or child presses the microphone button. The clip is sent for transcription, compared with the page's text to give word-by-word feedback, and then kept with the book so the practice results can be shown again.

Voice recordings are never used to identify a child, never used for advertising, and never shared with other users — including other players in a multiplayer adventure. They are deleted when you delete the book or your account.

We share personal information only with the providers needed to run StoryMe:

• Hosting and database provider — stores your account, stories, and files in encrypted systems.
• AI services — generate story text, illustrations, narration, and transcription, under instructions not to train on your content.
• PayFast — processes payments and sends us confirmation of transactions.
• Google — if you sign in with Google, so you can use your Google account.

Each provider receives only the minimum needed for its job, and each is bound by its own contractual and legal obligations to protect it. We may also disclose information if required by South African law, by a valid court order, or to protect the safety of our users.

We do not share personal information with advertisers, data brokers, or social-media platforms.

Some of our service providers process information in data centres outside South Africa. When information crosses borders, we take steps to ensure it stays protected at a standard comparable to POPIA — through contractual safeguards and by choosing providers with strong security certifications. By using StoryMe you consent to these transfers where they are needed to provide the service.

StoryMe is designed to be used by parents and teachers on behalf of children. Children do not create their own accounts, and the service never asks a child to provide personal information directly. A child's photo and first name are used only to personalise that child's books and adventures, and are stored in private storage that only you (and the teacher or guests you invite) can access.

In POPIA terms, a child's information is "special personal information" of a kind that may be processed with the consent of a competent person — the parent or legal guardian. By uploading a child's photo or submitting the class join form, you confirm you are that competent person.

If you believe a child's information was submitted to us without a parent or guardian's consent, contact us and we will delete it promptly.

Teachers create class projects and share a join link with parents. Parents submit their own child's photo and details directly — teachers never upload photos without a parent's action. Only the class teacher and StoryMe can see class submissions, and each learner's photo is used only for that learner's book.

Teachers act as the school's authorised operator of the project and are responsible for telling parents about the project and for distributing finished books. StoryMe's role is limited to providing the tool; we do not contact learners or parents for any other reason.

When you invite someone to an adventure with an invite code, they can see that adventure's story, scenes, the players' seat names, and the hero's first name. They cannot see the rest of your library, your email address, your payment history, or any voice recordings. Only share invite codes with people you trust, and ask us if you ever need an adventure closed to new players.

Your data is stored in encrypted databases and private file storage. Access is protected by sign-in authentication, and row-level access rules ensure every account can only see its own library. Photos and voice recordings live in private storage buckets that are not publicly reachable.

Security measures include encrypted connections (HTTPS) everywhere, signed and time-limited file access, server-side verification of all payment confirmations, and least-privilege access for administrative tools. No system is perfectly secure, but we review our protections regularly and act quickly on any issue.

• Stories, adventures, photos, and recordings — kept until you delete them, so your library stays available.
• Payment records — kept as long as tax and accounting law requires (generally five years in South Africa).
• Security and error logs — kept for a limited period and then rotated or deleted.
• Deleted accounts — if you delete your account, we delete your profile, stories, uploaded photos, and recordings within 30 days, except records we must legally retain.

Under POPIA (and the GDPR where it applies) you may:

• Ask us to confirm what personal information we hold about you and your child.
• Request a copy of that information.
• Ask us to correct or complete inaccurate information.
• Ask us to delete information we no longer need, or withdraw consent at any time.
• Object to how we process your information in certain circumstances.
• Complain to the Information Regulator of South Africa if you are unhappy with how we handle your information.

To exercise any of these rights, email us using the contact details below. We will respond within a reasonable time and always within the period the law requires. Some actions — such as deleting a story — can also be done yourself, directly in the app.

StoryMe uses only what it needs to work: keeping you signed in, remembering your language choice, and error reporting. These are stored in your browser's local storage and in strictly necessary cookies. We do not use advertising cookies, cross-site trackers, or analytics that profile individual users.

If a security incident compromises your personal information, we will investigate, contain it, and notify you and the Information Regulator where the law requires, with practical advice on any steps you should take. We keep our providers to the same standard.

If we change this policy in a meaningful way, we will tell you in the app before the change takes effect. The date at the top always shows when the policy was last updated. Continuing to use StoryMe after a change takes effect means you accept the updated policy.

Questions about privacy, or want to exercise your rights? Email us at privacy@story-me.world. Read also our Terms of Service.