Effective: October 10, 2026. Version 2026-10-10.

This policy applies to the My Story app and the My Story School Edition app for iPhone and iPad, the My Story web app, and this website, all operated by My Story LLC ("My Story," "we," "us," "our").

My Story is made for children roughly ages 3 to 11. That shapes everything below, so this policy is written plainly and addressed to the parents, guardians, and teachers who decide whether a child uses it. If anything here is unclear, please ask us. Contact details are at the end.

Two editions, two ways of handling information

My Story comes in two editions, and they work differently:

• The iOS app (My Story and My Story School Edition for iPhone and iPad) has no accounts. Stories are kept on the device, and nothing leaves it unless an adult chooses a feature that needs to send something, such as a Magic AI feature, the Community Library, a share link, or a printed book.
• The web app (My Story in a web browser) uses an account that only an adult can create. The stories made under that account are saved to our cloud storage so they are there whenever the adult signs in, on any computer.

Where the two editions differ, the sections below are split under the headings "iOS app" and "Web app & accounts." Everything else applies to both. If we introduce accounts to the iOS app, the "Web app & accounts" sections will apply to iOS accounts too, and we will tell you, and ask for any consent the law requires, before that happens.

Contents

1. The short version
2. Who we are
3. Notice to parents
4. The information we collect
5. How we use information, and our legal bases
6. Magic AI features
7. The Community Library and share links
8. Purchases and printed books
9. Who we share information with
10. Children's privacy, parental consent and COPPA
11. How long we keep information
12. Deleting your account and exporting your data
13. Security
14. International transfers
15. Your privacy rights
16. Cookies, analytics and similar technologies
17. Schools and student data
18. Changes to this policy
19. Contact us

1. The short version

• We do not show third-party advertising, and we do not sell, rent, or trade personal information. Ever.
• We do not use children's stories, drawings, photos, or voice recordings to train AI models.
• iOS app: a child does not need an account, an email address, a phone number, or a real name. Stories stay on the device unless an adult chooses to share, publish, or print them.
• Web app: only an adult aged 18 or over can create an account. The stories, drawings, photos, and voice recordings made under that account are stored in our cloud (Google Cloud, through Firebase) so they are available when the adult signs in. The adult can export or delete them, or the whole account, at any time.
• Magic AI features send the prompt, and any picture or text the feature needs, to AI service providers that create the result. Those providers may not use it to train their models.
• A parent, guardian, or teacher can review, export, or delete a child's information, and stop further collection, at any time.

2. Who we are

My Story LLC operates My Story and is responsible for the personal information described in this policy (under European and UK law, we are the "controller"). You can reach us at:

• My Story LLC
• Postal address: 2066 N Capitol Ave #9071, San Jose, CA 95132, USA
• Telephone: +1 (202) 709-3383
• Email: privacy@mystory.co
• EU representative (Article 27 GDPR): Prighter EU Rep GmbH, Schellinggasse 3, 1010 Vienna, Austria. If you are in the European Union, you can contact our representative about how we handle your personal information, and it will pass your request on to us.

3. Notice to parents

This section is our notice to parents and guardians under the U.S. Children's Online Privacy Protection Act (COPPA). We show a summary of it to the adult when they create a web account, and before we collect personal information from a child in the iOS app.

• What we collect from a child. The things a child makes: story text, drawings, photos, stickers, video, voice recordings, the name and picture chosen for their author profile, and the prompts they type into Magic AI features. Children are never asked for an email address, phone number, postal address, or full name. Details are in section 4.
• Why. Only to provide the features the child and their adult use: saving and showing stories, creating Magic AI results, printing a book, or publishing to the Community Library if an adult chooses to. We never use it for advertising.
• Consent. We need your consent before we collect this information from your child. On the web, you give it when you create the account, as described in section 10. You can withdraw it at any time.
• Who else receives it. Only the service providers that run My Story for us, such as our cloud host and AI providers (section 9). We do not disclose children's information to anyone for their own purposes, and we would ask for your separate consent before we ever did.
• Your rights. You can review your child's information, have it deleted, and refuse to let us collect or use any more of it. On the web you can do this yourself in Settings → Account, or you can email privacy@mystory.co (sections 10 and 12).

4. The information we collect

Story content a child creates

Story text, drawings, photos, stickers, voice recordings, music selections, and video.

iOS app: story content is stored on the device, and in the device's own iCloud backup if the device is set up that way. We do not receive it unless an adult uses a feature that has to send it: Magic AI, the Community Library, a share link, or a printed book.

Web app & accounts: when an adult is signed in, everything made under their account is stored in our cloud database and file storage, which Google runs for us through Firebase (Cloud Firestore and Cloud Storage). This includes each book and its pages, drawings, photos and other images, video, voice recordings of narration, and the Magic Characters the child creates. It is stored this way so the book is there the next time the adult signs in, and so the book can be printed or shared if the adult chooses. It stays there until it is deleted (section 11). If you use the web app without signing in, stories are saved only in your browser's own storage on that computer, and are not sent to us.

Author profiles

Both editions support several author profiles, one for each child or student, each protected by an optional PIN. A profile has a name, which the family or teacher chooses, and a picture, which is either a colour or a photo. We ask that you use a first name, initials, or a nickname rather than a full name. My Story does not need a real name.

iOS app: profiles are stored on the device.

Web app & accounts: the profile name, picture, and a scrambled (hashed) form of its PIN are stored with the account in our cloud database. The child's age range, which you may choose so that suggestions suit the reader, is kept only in your browser's local storage and is not saved to our servers. When you use Magic Storybook, Magic Stickers or the Story Guide chat, the age range is added to that request, for example "for children aged 6 to 8," so the AI writes or draws at the right level for the reader. It is sent only as part of that request, and we do not store it.

Information about the adult account holder (web app)

To create and run an account, we collect from the adult:

• Sign-in details: an email address and password (the password is handled by Firebase Authentication, and we never see it), or, if you choose Sign in with Google or Sign in with Apple, the name, email address, and, for Google, profile photo that the provider shares with us. If you use Apple's "Hide My Email," we receive only Apple's relay address.
• Account identifiers: the user ID that Firebase assigns to the account.
• Your consent record: your confirmation at sign-up that you are 18 or over and a parent, guardian, or teacher, whether you use My Story as a parent, a teacher, or otherwise, the date, the versions of the Terms of Service and this Privacy Policy you agreed to (section 18), and whether you ticked the optional box to receive emails from us.
• Settings: for example a parental PIN, stored only in hashed form, and your notification choices.
• Purchase and order records: see section 8.

We use this to create and secure the account, keep you signed in, let you manage your family's profiles, keep a record of your consent, and contact you about the account. We keep it for as long as the account is open (section 11).

Support and newsletters

If you contact support, we receive whatever you send us: your name, email address, the message, any attachment, and basic information about your browser or app version so we can help. Support is intended for adults, and in both editions it sits behind an adult gate. If an adult chooses to sign up for our newsletter or product emails, we receive the email address and, if given, a name. Newsletter sign-up is optional and sits behind an adult gate; on the web you can also opt in with a separate, optional box when you create your account. You can unsubscribe at any time.

Device, usage and diagnostic information

We collect limited technical information so we can keep My Story working, fix bugs, prevent abuse, and understand which features are worth improving. This includes device or browser type, operating system and app version, language, general region, crash reports, and records of which features were used. We do not use any of it to build advertising profiles.

iOS app: the app uses Google's Firebase services for crash and stability reports (Crashlytics), performance measurement, remote settings, and push notifications if you allow them, and Google Analytics for feature-usage statistics. If the app was installed after someone tapped one of our Apple Search Ads campaigns in the App Store, the app also retrieves an attribution token from Apple so we can measure which of our campaigns led to installs. Apple provides this token without identifying the person.

Web app & accounts: the web app uses Google Analytics (through Firebase) for feature-usage statistics about the grown-up parts of the app (section 16). We never send your account's user ID to Google Analytics, and we remove names, email addresses, and postal addresses from the event data. The web app also uses Firebase App Check with Google reCAPTCHA to block automated abuse; reCAPTCHA looks at browser and interaction signals. Our servers and hosting provider (Vercel) receive your IP address and browser type with every request, as all websites do. If you turn on notifications, we store a push-notification token for your browser. When something goes wrong in the web app or in our server functions, an error report is sent to Sentry so we can find and fix the problem. An error report contains the kind of error and where in our code it happened, your browser and operating system, the app version, the address of the page with any IDs and link tokens removed, and a scrambled identifier for the account that cannot be turned back into your user ID. It does not contain names, email addresses, story content, or what was typed into a Magic AI feature. Sentry is set not to store IP addresses, and we do not use it to record screens or follow what a child does.

Device and browser permissions

My Story asks permission before using the camera (to take a photo for a story), the microphone (to record narration), and the photo library or your files (to add a picture). In the iOS app, augmented-reality features also use the camera and motion sensors. You can withdraw these permissions at any time in your device or browser settings. Photos and recordings captured this way become part of the story content described above.

The web app's Memory Book can turn spoken memories into text using your browser's built-in speech recognition. Some browsers, including Google Chrome, do this by sending the audio to the browser maker's servers under that company's own privacy terms. My Story receives only the resulting text.

We do not use photos or voice recordings to create biometric identifiers such as face templates or voiceprints.

5. How we use information, and our legal bases

We use personal information only for the purposes described in this policy. Where European or UK data protection law applies, each use has one of the following legal bases:

6. Magic AI features

Some features use artificial intelligence to create or improve story content. These include Magic Characters, Magic Stickers, Magic Covers, Magic Pages, Magic Storybook and Magic Story outlines, the Story Guide chat, Magic Narrate, Magic Soundtracks, Magic Animate, Magic 3D, Memory Book, and the picture editing tools. When you use one, the information the feature needs is sent over an encrypted connection to an AI provider, which returns the result. That information can include:

• the text prompt, story text, character names, and theme;
• a picture the feature works on, for example a page, a drawing, or a photo the child or adult chose, such as a photo used to create a Magic Character, a Memory Book photo, or a picture being enhanced, animated, turned into 3D, or having its background removed;
• the text of a page to be read aloud, or a description of the music to be composed; and
• for Magic Storybook, Magic Stickers and the Story Guide chat on the web, the reader's age range (section 4).

iOS app: requests go through our own server functions on Google Cloud (Firebase) to the provider, or directly to Google's Gemini models through Firebase.

Web app & accounts: requests go through our server on Vercel to the provider. Because the request is passed along, the provider can also see the request's IP address and browser type. Narration, music and Story Guide chat requests go through the My Story service described in section 9. Story Guide conversations are not saved: once the chat is closed, we do not keep what was said, only a count of messages so we can apply the daily limit.

Before a story is submitted to the Community Library, its text is also checked by an AI model for anything unsafe (section 7).

AI providers and the models we currently use

• Replicate, Inc. runs most of our AI models:
  • Story and suggestion text, and the Story Guide chat: OpenAI GPT-5 mini; Google Gemini 3 Flash.
  • Narration (text-to-speech): Google Gemini 3.1 Flash TTS.
  • Pictures: Google Nano Banana and Nano Banana 2; Black Forest Labs FLUX.1 [dev]; in the iOS app, also FLUX.1 Kontext [pro].
  • Animation: Wan 2.2 image-to-video; in the iOS app, also ByteDance Seedance 1 Lite.
  • 3D models: TRELLIS.
  • Picture understanding and editing: Moondream2, plus models for background removal, upscaling, and deblurring.
  • Safety checks: Google Gemini 3 Flash, which reviews story text submitted to the Community Library and Community Library comments.
• Some of these models are operated by the company that developed them on Replicate's behalf, currently OpenAI for GPT-5 mini and Google for the Gemini and Nano Banana models. Content sent to those models is also processed by that company.
• Google (Gemini, through Firebase): in the iOS app, text generation, translation, and understanding pictures, including Memory Book photos.
• ElevenLabs: narration voices and Magic Soundtracks music. It receives the text to be spoken or the music description.
• Dezgo: in the iOS app, background removal for pictures.

We may change the models we use as better or safer ones become available. When we add a new provider, we will update this list.

These commitments apply to everything sent to AI providers:

• No training. We do not use children's stories, drawings, photos, or voice recordings to develop, improve, or train any AI or machine-learning model, and our AI providers may not use them to train their models either.
• No advertising use. Nothing sent to an AI provider is used for advertising, profiling, or marketing.
• Processing only. Providers may keep content only as long as they need to return the result and meet their own abuse-monitoring obligations, and may not use it for their own purposes. We do not keep a separate copy of AI requests. A result is saved only if you add it to a story.

Magic AI features use content filtering intended to keep results age-appropriate. No filter is perfect. If something inappropriate is ever generated, please report it to us so we can investigate and tighten the filters. Magic Stickers and Magic Covers are not included in the School Edition.

7. The Community Library and share links

The Community Library

The Community Library lets families choose to publish a finished story so other My Story users can read it, and browse stories others have published. Publishing is always a deliberate choice for each story, never a default.

What becomes public. When a story is published, the whole story file becomes readable and downloadable by other My Story users. That includes its text, pictures, and any photos or voice recordings in it. The story's title, summary, cover, reading age range, and language are also shown. Published stories may also be viewable on the web at mystory.co and appear in search engines. The story is shown under an automatically generated pen name (for example, "happy-panda-123"), not the name on the author profile. The profile name is visible only to our moderators. Please do not publish a story that contains a child's full name, school, address, face, or any other detail that identifies them, and please review any photo or voice recording before publishing. A name written inside the story itself will be visible.

Comments and likes. Users can like and comment on published stories. Comments appear under the same pen name.

Moderation.

• Every submitted story is reviewed by a member of our team before it appears in the Library.
• On the web, the story's text is first checked automatically for unsafe content.
• Comments pass an automatic word filter when posted and appear straight away. They are then reviewed by automated moderation, which hides any that break our rules.
• Anyone can report a story or comment, and our team reviews reports.

We remove content that is unsafe, inappropriate for children, or appears to contain a child's personal information. Where child safety is involved, we may remove a story or comment for any reason and without notice.

Removing a published story. You can unpublish your own story from within the app. If you want a story taken down and cannot do it yourself, or you believe a published story contains a child's personal information or infringes your rights, email privacy@mystory.co and we will act promptly. We cannot recall copies that other users downloaded before removal.

Share links

Web app & accounts: you can turn on a share link for a book. Anyone who has the link can view that book, including its pictures and recordings, without signing in. Turning the link off stops access immediately.

iOS app: sharing a story as a link uploads a copy of it to our servers, where anyone with the link can view it. The link may be shortened using a link-shortening service (is.gd or TinyURL). These links do not currently expire and cannot yet be turned off from within the app. To have one removed, email privacy@mystory.co.

8. Purchases and printed books

iOS app

The app is a free download with optional in-app purchases, which may include Story Sparks. All App Store and in-app purchases are processed by Apple. We receive confirmation that a purchase happened, not your payment details. Purchases sit behind an adult gate. The School Edition is a one-time purchase with no in-app purchases.

Web app & accounts: Story Sparks

Story Sparks are bought through Stripe's secure checkout page. Card details are entered directly into Stripe, and we never see or store full card numbers. From Stripe we receive confirmation of the purchase, the bundle bought, the amount, and your account's user ID and email address. We use that to add Sparks to your balance and to keep a purchase record. Your Sparks balance and a record of each time Sparks are added or spent are kept by the My Story service (section 9).

Printed books (both editions)

A finished story can be ordered as a professionally printed book. To place an order, the adult provides the recipient's name, shipping address, phone number, and an email address for order updates. For deliveries to some countries (currently Brazil, Chile, Ecuador and Mexico), a recipient tax ID is also needed.

• Stripe processes the card payment and receives the name, email address, and shipping address. Stripe Tax uses the shipping address to calculate sales tax or VAT. We never see or store full card numbers.
• Lulu Press, Inc. (lulu.com), our print-on-demand partner, receives the print files for the book (cover and pages), the recipient's name, shipping address, phone number and email, and, where needed, the tax ID. Lulu prints and ships the book as our service provider and also handles this information under its own privacy policy.
• As you type an address, Google Maps Platform (Places) may suggest completions. It receives the text you type.
• We send order confirmation and shipping emails through Twilio SendGrid.

Printing a book is a real-world action by an adult with a payment card, and we also treat it as confirmation of parental consent for sending that story to be printed. We keep order records (what was ordered, where it shipped, and when) for the period described in section 11.

9. Who we share information with

We share information only with service providers who need it to make My Story work, and only for that purpose. They are bound by contract to protect it and may not use it for anything else. The table below lists them.

Other disclosures. We may also disclose information where the law requires it, for example in response to a valid court order or subpoena. We may also disclose it where we believe in good faith that this is necessary to protect a child's safety, to investigate a breach of our Terms of Service, or to protect the security of our services. If we are ever involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. If so, we will give notice here before any information becomes subject to a materially different privacy policy, and children's information will remain subject to the commitments in this policy.

What we never do

• We do not sell, rent, or trade personal information.
• We do not show third-party advertising, and we do not allow third parties to advertise to our users inside My Story.
• We do not build advertising or behavioural profiles of children, and we do not permit targeted advertising based on any information collected through My Story.
• We do not use children's content to train AI or machine-learning models.
• We do not require a child to disclose more personal information than is reasonably necessary to use a feature.

10. Children's privacy, parental consent and COPPA

We operate My Story in line with the U.S. Children's Online Privacy Protection Act and the FTC's COPPA Rule, as amended in 2025. We also follow the EU and UK General Data Protection Regulation as it applies to children (including the UK Age Appropriate Design Code), Canadian privacy law, and other applicable privacy laws.

How parents give consent

Web app & accounts: children cannot create accounts. Only an adult can. When creating an account, the adult:

• confirms that they are 18 or older and a parent, guardian, or teacher of the children who will use the account;
• tells us whether they are using My Story as a parent, a teacher, or otherwise;
• is shown the notice in section 3; and
• agrees to the Terms of Service and this Privacy Policy.

We record that consent with the date and the version of each document (section 18). A child's stories are stored under an account only after this step. When either document changes in a way that needs fresh agreement, we ask again the next time the adult signs in, before the app can be used. Children then use My Story under the adult's account and supervision.

iOS app: by default the app collects no personal information from a child. Every feature that would change that, including Magic AI, the Community Library, share links, printed books, and support, sits behind an adult gate. Where the law requires it, the feature also requires a real-world action by an adult, such as completing a card payment for a printed book or confirming a Community Library publication.

Schools: see section 17.

Separate consent for disclosure to third parties

We disclose children's personal information only to service providers who are integral to running My Story (section 9), and only so they can provide their service to us. We do not disclose it to anyone for their own purposes, including advertising or sale. If we ever wanted to, we would first ask for your separate consent to that specific disclosure. You could refuse it and still use My Story.

Persistent identifiers used only for internal operations

My Story uses a few persistent identifiers:

• the account's user ID;
• random IDs the app or browser generates, for example to keep track of Community Library likes;
• push-notification tokens; and
• analytics and crash-reporting identifiers.

We use them only to support the internal operations of My Story: keeping you signed in, saving and syncing stories, keeping Sparks balances accurate, delivering notifications you asked for, preventing fraud and abuse, fixing crashes, and measuring which features are used. We do not use them to contact a child, to build a profile of a child, or for behavioural advertising.

Parental rights

As a parent or guardian, you may at any time:

• review the personal information we hold about your child;
• have it deleted;
• refuse to let us collect or use any more of it; and
• withdraw consent you previously gave.

Exercising these rights is free, and we will not degrade your child's use of My Story for asking. If you delete information a feature depends on, that feature may stop working. For example, deleting an order record means we can no longer track that shipment.

• Web app & accounts: you can see everything stored under your account by signing in. You can delete books and author profiles in the app, download a copy of your data, or delete the whole account (section 12).
• iOS app: stories are on your device, where you can view and delete them. For information we hold, such as orders, published stories, shared stories and support messages, email us.

You can always email privacy@mystory.co instead. Tell us enough to find the information, for example your account email, an order number, or the pen name a story was published under. We may take reasonable steps to confirm that you are the child's parent or guardian before we act, so that we do not disclose a child's information to the wrong person.

11. How long we keep information

This is our written data retention policy. We keep personal information only as long as we need it for the purpose we collected it for, and then delete it. We never keep children's personal information indefinitely.

12. Deleting your account and exporting your data

Web app & accounts

In the web app, go to Settings → Account:

• Export my data prepares a copy of the information held in your account, including your author profiles and your books with their pictures and recordings, for you to download. The download is available for 7 days.
• Delete my account permanently deletes your account and sign-in, author profiles, books, pages, drawings, photos, videos, voice recordings, Magic Characters, share links, print files and exports, your settings (including PINs), your sign-up consent record, and any remaining Story Sparks balance. It also removes stories the account published to the Community Library. This cannot be undone, so please export anything you want to keep first.

Some records are kept after deletion:

• Print-order and Story Sparks purchase records needed for tax, accounting, and fraud prevention are kept for the period in section 11, with your name and email address removed. They are no longer linked to your deleted account, and are de-identified except for the details the law requires on a tax or accounting record.
• A minimal record that parental consent was given is kept for 3 years, so we can show it was obtained. It holds the documents and versions accepted, how and when, and a one-way hash of the account email, but no name and no information about your child.
• Stripe and Lulu keep their own records of payments and shipments as the law requires of them.
• Copies other users downloaded from the Community Library while a story was published cannot be recalled.

Unused Story Sparks are lost when an account is deleted, as explained in the Terms of Service.

If you can't use the in-app option, email privacy@mystory.co from the address on the account and we will export or delete it for you.

iOS app

The iOS app has no account to delete. Stories and author profiles live on the device and are removed when you delete them or the app, and from iCloud backups according to your iCloud settings. To have us delete or send you a copy of information we hold, such as orders, Community Library stories, shared stories, or support messages, email privacy@mystory.co.

13. Security

We maintain a written information security program designed to protect personal information, and children's information in particular. Under it:

• named staff are responsible for coordinating the program;
• we assess risks to personal information at least once a year and whenever our systems change significantly;
• we put safeguards in place to address those risks. These include encryption of information in transit between the app, our services and our providers; access controls that limit who at My Story can see personal information; hashed PINs; and protections against automated abuse;
• we regularly test and monitor those safeguards, and review and update the program at least once a year; and
• we choose service providers that can protect information, and require them by contract to do so.

On the device, author profiles can be protected by PIN codes set by the family or teacher, and settings are protected by an adult gate or a separate adult or Teacher PIN.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting personal information, we will notify affected users and the relevant regulators as required by applicable law.

14. International transfers

My Story LLC is based in the United States, and our service providers process information in the United States and other countries. Where information is transferred out of the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on an appropriate safeguard. This may be the European Commission's standard contractual clauses (with the UK Addendum or Swiss amendments where relevant), or, where a provider is certified under it, the EU–U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for more information about these safeguards.

15. Your privacy rights

Everyone. Wherever you live, you can ask us to access, correct, export, or delete the personal information we hold about you or your child, and you can withdraw any consent you have given. To do so, email privacy@mystory.co or use Settings → Account in the web app.

EEA, UK and Switzerland. You have the right to:

• access your personal information;
• have it corrected (rectification) or deleted (erasure);
• restrict how we use it;
• object to processing we base on legitimate interests;
• receive it in a portable format; and
• withdraw consent at any time, without affecting processing already carried out.

We do not make decisions that produce legal or similarly significant effects based solely on automated processing. You also have the right to complain to your local data protection authority, such as the UK Information Commissioner's Office. We would appreciate the chance to address your concern first.

U.S. state privacy laws. Depending on your state, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comprehensive privacy laws, you may have the right to:

• know what personal information we collect, use, and disclose, and to access it;
• correct or delete it;
• receive a portable copy; and
• opt out of the sale of personal information, "sharing" for cross-context behavioural advertising, targeted advertising, and certain profiling.

We do not sell or share personal information as those laws define it, we do not use it for targeted advertising or profiling, and we do not sell or share the personal information of anyone under 16. The categories of information we collect, their sources and purposes, and who receives them are described in sections 4, 5 and 9. We do not collect sensitive personal information for the purpose of inferring characteristics about anyone.

You can make a request yourself or through an authorised agent. We will verify the request in proportion to the sensitivity of the information. If we decline your request, you can appeal by replying to our decision, and we will explain the outcome of the appeal and how to contact your state attorney general if you disagree. We will not discriminate against you for exercising any privacy right.

We respond within the time the applicable law requires.

16. Cookies, analytics and similar technologies

This website (mystory.co)

This website is aimed at parents, guardians, and teachers rather than children. It uses cookies and similar technologies for two purposes:

• Google Analytics, to understand in aggregate how visitors use the site; and
• Zendesk, to run the support widget.

It also loads fonts, icons, and scripts from content delivery networks, which receive your IP address in order to serve those files.

Web app

The web app uses your browser's storage to work:

• Firebase Authentication keeps you signed in.
• Stories made while signed out are saved in the browser's own database.
• Small settings are stored locally, such as the reader's age range, your language, dismissed tips, and Community Library likes.

It also uses:

• Google Analytics cookies for usage statistics about the grown-up parts of the app: signing in, account settings, purchases, printing and sharing;
• reCAPTCHA, through Firebase App Check, to block automated abuse;
• Stripe's cookies on the payment form, for fraud prevention; and
• Zendesk, but only when you open support. It sets its own cookies only if you have allowed optional cookies.

In the web app, we do not measure what children do in the editor, the reader, Story Guide chat, the Magic tools or the Community Library. We never send your account ID to Google Analytics.

Your choice

Google Analytics and the Zendesk support widget are optional. The storage the web app needs to work, reCAPTCHA and Stripe's fraud-prevention cookies are strictly necessary, so they are not covered by this choice.

If your browser settings indicate that you are in the EEA, the UK or Switzerland, we show a cookie banner and load neither Google Analytics nor Zendesk's website widget, so neither sets cookies, until you choose "Accept". Choosing "Reject" is just as easy. Elsewhere, they are on by default.

Your choice is saved in your browser and applies to both this website and the web app. You can change it at any time: on this website with Cookie settings, and in the web app under Settings → Privacy. Turning analytics off deletes the Google Analytics cookies.

We also use Google Consent Mode, so that if Google Analytics does load, it sets no cookies for visitors Google places in the EEA, the UK or Switzerland unless they have accepted. Google signals and ad personalisation are turned off. We do not use advertising cookies, and we do not use cookies to build a profile of you or your child.

You can also block or delete cookies and site data in your browser settings. Refusing them may stop parts of My Story from working. For example, you won't stay signed in, and the support widget may not load. Clearing your browser's site data also deletes any stories you made on the web while signed out.

17. Schools and student data

When a school or district uses My Story School Edition, or a teacher uses the web app with their class, the school may consent to the collection and use of student information for educational purposes, acting on behalf of parents as COPPA permits. In that case we use student information only to provide My Story to the school, and schools are responsible for giving parents appropriate notice.

Student work belongs to the student and their school. We do not use it for advertising, we do not sell it, we do not use it to train AI models, and we do not build student profiles for any non-educational purpose. Magic Stickers and Magic Covers are not included in the School Edition. A school may ask us to review or delete student information we hold by writing to privacy@mystory.co.

18. Changes to this policy

We may update this policy to reflect new features, technologies, or legal requirements. Each version is identified by its effective date, in the form YYYY-MM-DD, which is shown at the top of this page. When you create a web account, we record the version you agreed to.

When we make a change, we post the new version here with a new date. If the change is material, particularly any change in how we handle children's information, we will give prominent notice. Where the law requires it, we will also get fresh parental consent before the change takes effect. We will not use information we have already collected in a materially different way without that notice and consent.

19. Contact us

For privacy questions, parental requests, or anything else about this policy, email privacy@mystory.co, write to us at 2066 N Capitol Ave #9071, San Jose, CA 95132, USA, or call +1 (202) 709-3383. You can also reach us through the support widget on this site.

Information you send us in a privacy enquiry is used only to handle that enquiry. We will not use it to send you marketing.

A final note to parents and guardians

The best protection a child has online is an involved adult. We have tried to make My Story a place where a child can create freely without giving anything away. We would still encourage you to sit down with your child, look at what they have made, and talk about what is worth sharing publicly and what is not. If you ever think we have fallen short of what is described here, please tell us.