Last updated: August 14, 2026. This policy applies to the My Story app, the My Story School Edition app, and this website, all operated by My Story LLC ("My Story," "we," "us," "our").
My Story is made for children roughly ages 3 to 11. That shapes everything below, so this policy is written plainly and addressed to the parents, guardians, and teachers who decide whether a child uses it. If anything here is unclear, please ask us — contact details are at the end.
We operate My Story in line with the United States Children's Online Privacy Protection Act (COPPA), the EU and UK General Data Protection Regulation as it applies to children (including the UK Age Appropriate Design Code), Canadian federal and provincial privacy law, and other applicable privacy laws.
We built the app so that the default experience collects as little as possible. A child can open My Story, write, draw, narrate, and finish a whole book without giving us any personal information at all. Everything that would change that — buying a printed book, publishing to the Community Library, or contacting support — requires an adult to pass an adult gate first.
Verifiable parental consent. Where we collect personal information from a child, or let a child make information public, we obtain verifiable parental consent first. In practice this happens through an adult gate combined with a real-world adult action — completing a credit card purchase for a printed book, or an adult confirming a Community Library publication. We do not proceed without it.
Parental rights. As a parent or guardian, you may at any time: review the personal information we hold about your child; ask us to delete it; refuse to permit any further collection or use of it; and withdraw consent you previously gave. Exercising these rights is free, and we will not degrade your child's use of the app for asking. Note that if you ask us to delete information we need in order to provide a feature, that feature may stop working — for example, deleting an order record means we can no longer track that book shipment.
To exercise any of these rights, email privacy@mystory.co from an address we can correspond with, and tell us enough to locate the information (for example, the order number, or the author name a story was published under). We may need to take reasonable steps to verify that you are the child's parent or guardian before we act, so that we do not disclose a child's information to the wrong person.
Story content a child creates. Text, drawings, photos, stickers, voice recordings, music selections, and video. By default this is stored on the device and in the child's own iCloud backup if the device is set up that way. We do not receive it, unless the child's adult uses one of the features described below (Magic AI, Community Library, or printed books) that necessarily sends content to us or to a service provider.
Author profiles. Both editions support multiple author profiles on one device, each protected by a PIN. A profile name is chosen by the family or teacher and lives on the device. We ask that you use a first name, initials, or a nickname rather than a full name — the app does not need one.
Order information for printed books. When an adult orders a printed book, we and our print partner need a shipping name and postal address, an email address for order updates, and payment details. See "Printed books" below for exactly who receives what.
Support enquiries. If you contact support, we receive whatever you write to us, including your email address. Support is intended for adults.
Device and diagnostic information. The app collects limited technical information — device model, operating system version, app version, general region, crash reports, and anonymous feature-usage counts — so we can fix bugs and understand which features are worth improving. This is not tied to a child's name or identity, and we do not use it to build advertising profiles.
Two Google services are used for this: Google Analytics, for aggregate feature-usage counts, and Firebase Crashlytics, for crash and stability reports. Neither is used for advertising, and we do not permit either to be used to build advertising or behavioural profiles of children.
Device permissions. My Story asks your permission before using the camera (to take a photo for a story), the microphone (to record narration), the photo library (to add an existing picture), and, for augmented-reality features, the camera and motion sensors. iOS will ask you before any of these are used for the first time, and you can withdraw any of them at any time in the iOS Settings app. Photos and recordings captured this way are part of the story content described above.
Some features — including Magic Characters, Magic Stickers, Magic Covers, Magic Story Outlines, and Magic Pages — use artificial intelligence to generate images or starter text. To do this, the text prompt and, where the feature requires it, the image the child selected are sent over an encrypted connection to an AI provider that generates the result and returns it to the app.
We use two AI providers for these features:
Three commitments apply to everything sent to those providers:
Magic AI features apply content filtering intended to keep generated results age-appropriate. No filter is perfect. If something inappropriate is ever generated, please report it to us so we can investigate and tighten the filters. Magic Stickers and Magic Covers are not included in the School Edition.
The Community Library lets families choose to publish a finished story so other My Story users can read it, and to browse stories others have published. Publishing is always a deliberate choice, never a default, and it sits behind an adult gate.
When a story is published, the story itself becomes publicly visible inside the app, along with the author name on the profile that made it and any narration recorded in it. Please do not publish a story that contains a child's full name, school, address, or any other detail that identifies them, and please review any voice recording or photograph before publishing it. Once a story is public, other users may read and download it.
Moderation. Published stories are screened by automated content moderation and reviewed by trained human moderators. We remove content that is unsafe, inappropriate for children, or that appears to contain personal information about a child. We may remove a story for any reason and without notice where child safety is involved.
Removing a published story. You can unpublish your own story from within the app. If you want a story taken down and cannot do it yourself, or you believe a published story contains a child's personal information or infringes your rights, email privacy@mystory.co and we will act promptly. Copies that other users downloaded before removal may persist on their devices; we cannot recall those.
A finished story can be ordered as a professionally printed physical book. Ordering is behind an adult gate and requires a credit card, which is our verifiable-parental-consent step for this feature.
Printing and shipping are handled by Lulu Press, Inc. (lulu.com), our print-on-demand partner. To fulfil an order, the story file, the shipping name and postal address, and an email address for delivery updates are transmitted to Lulu. Lulu processes this information as our service provider in order to print and ship the book, and handles it under its own privacy policy. Payment card details are handled over a secure, encrypted connection by the payment processor — we never see or store full card numbers.
We retain order records (what was ordered, where it shipped, and when) for as long as needed to support the order and to meet tax and accounting obligations, then delete them.
We share information only with service providers who need it to make a feature work, and only for that purpose. They are contractually barred from using it for anything else. The categories are:
We may also disclose information where the law requires it — for example in response to a valid court order or subpoena — or where we believe in good faith that disclosure is necessary to protect the safety of a child, to investigate a violation of our Terms of Service, or to protect the security of our services. If we are ever involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction; if so, we will give notice here before any information becomes subject to a materially different privacy policy, and children's information will remain subject to the commitments in this policy.
Story content stays on the device until deleted by the person using it. Published Community Library stories remain until unpublished or removed. Order records are kept for as long as needed to support the order and satisfy tax and accounting requirements. Diagnostic and crash data is kept in a limited retention window and then deleted or aggregated so it no longer relates to a device. Support correspondence is kept as long as needed to resolve the matter and for a reasonable period afterwards.
When a school or district deploys My Story School Edition, the school may provide consent for the collection and use of student information for educational purposes, acting on behalf of parents as COPPA permits. Schools are responsible for giving parents appropriate notice.
Student work created in the School Edition belongs to the student and their school. We do not use it for advertising, we do not sell it, we do not use it to train AI models, and we do not build student profiles for any non-educational purpose. Magic Stickers and Magic Covers are not included in the School Edition. A school may ask us to review or delete student information held by us, by writing to privacy@mystory.co.
We maintain physical, electronic, and managerial safeguards designed to protect information against unauthorised access, disclosure, alteration, and destruction. Information in transit between the app and our services, and between us and our service providers, is encrypted. Author profiles are protected on the device by PIN codes set by the family or teacher, and settings are gated by a separate adult or Teacher PIN.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting personal information, we will notify affected users and the relevant regulators as required by applicable law.
We operate globally, and information may be stored or processed in countries other than the one you live in, including the United States. Where information is transferred out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's standard contractual clauses, or another lawful transfer mechanism.
Depending on where you live, you may have the right to access the personal information we hold, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out. You also have the right to complain to your local data protection authority.
California. California residents have the right to know what personal information is collected and to whom it is disclosed, to request deletion or correction, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not sell or share the personal information of anyone under 16. We will not discriminate against you for exercising any privacy right.
To exercise any right, email privacy@mystory.co. We respond within the timeframe the applicable law requires.
This website (mystory.co) is aimed at parents, guardians, and teachers rather than children. It uses cookies and similar technologies for two purposes: Google Analytics, to understand in aggregate how visitors use the site, and Zendesk, to run the support widget. The site also loads fonts, icons, and scripts from content delivery networks, which necessarily receive your IP address in order to serve those files.
Most browsers accept cookies automatically, and you can set yours to warn you before accepting one or to refuse them entirely through your browser settings. Refusing cookies may stop parts of the site, such as the support widget, from working properly. We do not use website cookies to advertise to you or to build a profile of you.
We may update this policy to reflect new features, technologies, or legal requirements. When we do, we will change the "Last updated" date above and post the new policy here. If a change is material — particularly any change in how we handle children's information — we will give prominent notice and, where the law requires it, obtain fresh parental consent before the change takes effect. We will not use information previously collected in a materially different way without that notice and consent.
For privacy questions, parental requests, or anything else about this policy, email privacy@mystory.co. You can also reach us through the support widget on this site.
Information you send us in a privacy enquiry is used only to handle that enquiry. We will not use it to send you marketing.
The best protection a child has online is an involved adult. We have tried to make My Story a place where a child can create freely without giving anything away, but we would still encourage you to sit down with your child, look at what they have made, and talk about what is worth sharing publicly and what is not. If you ever think we have fallen short of what is described here, please tell us.