Privacy Policy

We only collect what is needed to run the Service:

• Account data: your email address, name, password (stored only as a hash by our authentication provider), preferred language and time zone, and when you confirmed our Terms. If you sign in with Google or Apple you create no password: we receive your name and email address from that provider (with Apple you may choose to share a private relay address instead of your real one).
• Profile data about the person or pet an archive is about: first name, nickname, birthday, gender and an optional profile photo.
• Memories you add to an archive: photos, videos, voice recordings, text, milestones and time-locked "future messages", together with their dates, captions, comments and reactions.
• Family data: the email addresses you invite, the role you assign to each member, and who added what.
• Subscription data: your current plan (Free, Storya Plus or Storya Family), its status and renewal dates, and the store that billed it. Payments are processed by Apple or Google; we never see your card details.
• Device and diagnostic data: app version, device model and operating system, crash reports, and a push-notification token if you enable notifications.
• Usage analytics in the mobile app, only if you opt in: which screens and features are used, linked to your account identifier but never to your name, email address or the content of your memories.
• Support requests you send us through the app.

• To provide the Service: storing your archive, showing the timeline, sending invitations, unlocking future messages and delivering notifications.
• To enforce plan limits (storage, number of archive profiles and contributors) and keep your subscription in sync with the app store.
• To keep the Service secure and reliable: authentication, abuse prevention, error monitoring and crash reporting.
• To send transactional emails such as email confirmation, password reset and family invitations. We do not send marketing emails without your consent.
• To answer your support requests.
• To understand how the app is used and improve it, only with your analytics consent.

Where the GDPR or the Turkish Personal Data Protection Law (KVKK) applies, we rely on the performance of our contract with you, your consent (analytics, optional notifications), and our legitimate interest in keeping the Service secure.

An archive is about a person you love, or a pet. When it is about a child it contains personal data of a minor; when it is about another adult it contains their personal data. You are responsible for having the right to add that information and for choosing who you invite to see it. Archives are private by default: only the family members you invite can see them, and you can remove a member at any time.

Storya does not use children's data — or any other archive data — for advertising or profiling and does not share it with third parties except the processors listed below.

We do not sell your data. We share it only with service providers that process it on our behalf, under contracts that restrict what they can do with it:

• Supabase — database, authentication and file storage that hold your account and archive.
• Cloudflare — hosting of the website, DNS and bot protection (Turnstile).
• Apple App Store and Google Play — in-app subscriptions; RevenueCat validates purchase receipts and tells us which plan is active.
• Resend — delivery of transactional emails.
• Google and Apple — sign-in, only if you choose "Continue with Google" or "Continue with Apple"; when you delete an account created with Apple, we also revoke Storya's access to your Apple ID.
• Firebase (Google) — push notifications and crash reporting for the mobile app, and product analytics only if you opt in.
• Mixpanel — product analytics for the mobile app, only if you opt in, hosted in the EU.

Family members you invite can see the memories of the archive they belong to, according to the role you give them. We may also disclose data when required by law or to protect the rights and safety of our users.

• Memories you delete are kept in "Deleted memories" for 30 days so you can restore them, then permanently removed.
• If you delete your account from the app, your profile, email address, comments, reactions, memberships and subscription record are deleted. An archive you created is handed over to another member who has the parent or guardian role in it; if there is none, the archive and all of its files are deleted. Memories and future messages you added to archives that continue to exist are kept for the family, but they are no longer linked to you — they show as added by a former member.
• Deleted data can remain in our encrypted database backups for up to 30 days before those backups expire; backups are never used to restore an individual account.
• Server logs, crash reports and error reports may contain your user id or email address and are kept for up to 90 days for security and debugging.
• We may retain data longer when the law requires it, for example purchase records.

• Access and export: you can download your entire archive from the app at any time (Export archive).
• Correction: you can edit your profile and any memory you added.
• Deletion: you can delete individual memories, archive profiles or your whole account from the app.
• Analytics: you can withdraw your analytics consent in Settings at any time.
• Notifications: you can turn push and email notifications off in Settings or on your device.
• Under the GDPR and KVKK you may also have the right to restrict or object to processing, to data portability and to lodge a complaint with your supervisory authority.

To exercise any of these rights, write to support@storya.life. We will respond within the time required by applicable law.

Data is encrypted in transit (TLS) and at rest by our hosting providers. Media files are stored in private buckets and are only served through signed links to family members who are signed in. Access to production systems is limited to the people who operate the Service.

No system is perfectly secure. Please use a strong, unique password and keep your devices protected.

storya.life does not use advertising or tracking cookies. The website stores your language choice in your browser's local storage, and Cloudflare Turnstile may set a cookie to tell people from bots on sign-up forms. The apps keep your session token and preferences on your device so you stay signed in.

Our providers may process data in countries other than the one you live in. Where required, we rely on standard contractual clauses or equivalent safeguards offered by those providers.

We may update this policy as the Service evolves. The date at the top shows the latest revision; for material changes we will notify you in the app or by email.

Questions about privacy? Email us at support@storya.life.