Privacy Policy

This policy applies to information collected through StoryVerse, our website, account systems, support channels, payments and related services.

• Account information such as email address, authentication identifiers and account settings, including the language you read in.
• User Content such as fictional character details, worlds, preferences, boundaries, prompts, story directions and saved stories.
• Subscription and transaction information. Full card details are handled by the payment processor, not stored by StoryVerse.
• Technical information such as IP address, device and browser data, log data, security events and cookies (see section 7).
• Usage information such as generation events, feature interactions, subscription status and performance or error data.
• Advertising measurement information: which of our own campaigns brought you to StoryVerse and, on the consent terms set out in section 7, the identifiers described there.
• Support communications and information you choose to provide when contacting us.

Because StoryVerse is a personal fiction service, prompts, preferences or stories may reveal private information. You should avoid submitting unnecessary real-world identifying or sensitive information. We treat private story data as confidential account content and apply access controls appropriate to its sensitivity.

• Provide, personalise and maintain StoryVerse.
• Generate, save and continue stories, characters, worlds and memories.
• Authenticate users and protect accounts.
• Process subscriptions and manage entitlements.
• Provide support and respond to requests.
• Detect fraud, abuse, security incidents and prohibited use.
• Measure performance and improve reliability and user experience.
• Measure our own advertising and report the results to the advertising platforms we buy from, on the consent terms set out in section 7.
• Meet legal, regulatory and compliance obligations.
• Send service messages and, where permitted, marketing communications.

Information submitted for story generation is transmitted to contracted AI infrastructure providers to generate and deliver the requested output. Providers are contractually limited to processing this data to deliver the Service, and we configure available data-retention and training settings consistently with the promises in this policy. The current provider list is available on request via support@getstoryverse.com.

Payments are processed by Stripe. We may receive transaction identifiers, payment status, subscription details, billing country and limited payment metadata. We do not store complete card numbers. Stripe’s handling of your payment details is described in its own privacy policy.

StoryVerse sets a small number of first-party cookies the Service cannot run without and, for analytics and advertising measurement, loads tags from three providers and sets one first-party cookie of its own — where you have agreed to it or, outside the European Economic Area, the United Kingdom, Switzerland and Brazil, until you switch it off (see “Where the rules differ” at the end of this section). Nothing described in this section involves the content of your stories.

Essential cookies. These are always set, because the Service cannot be delivered without them:

• Your sign-in session, so you stay signed in from page to page.
• sv_locale — the language you read StoryVerse in.
• sv_cur — the currency prices are shown in.
• sv_cc — the country your connection appears to come from, used to show the right price and to decide which consent rules apply to you.
• sv_consent — the cookie choice you made, so we do not ask again; it lasts 12 months.
• sv_attr — if you arrive from one of our own advertisements, the campaign reference carried in our own web address, kept for 30 days. It is a first-party, HttpOnly cookie: your browser returns it only to us, and no script on the page can read it. When you create an account it is stored against your account so we know which campaign earned a subscriber, and our servers read it again when they send one of the events described below. The campaign names it holds (our own utm_ values and the page you landed on) stay inside StoryVerse. It also holds the click reference the platform added to the address — Meta’s fbclid, TikTok’s ttclid, Google’s gclid — and that reference is sent back to the platform it came from only with the events our own servers send, described below in this section — three in-app steps, the start of a free week and the purchase conversion at the first payment — and only where you have agreed to advertising measurement (or, outside the European Economic Area, the United Kingdom, Switzerland and Brazil, have not switched it off). Our servers send it nowhere else; where you have allowed the Meta Pixel and the TikTok Pixel, they can also read it from the page address itself, as described below. We treat the cookie itself as essential because it is an internal record of a relationship you deliberately started with us, not cross-site tracking: it is read from our own address and kept in our own cookie, and the one part of it that can ever be sent on is governed by the consent rules in this section.
• sv_click_id and sv_click_src — if you arrive through an advertising network that marks its links with its own click reference, that reference and the name of the link parameter that carried it, kept for 30 days. Like sv_attr, they are first-party, HttpOnly cookies. The reference is stored against your account when you create it and is sent back only to the network it came from, only once the first payment of a subscription has been taken, and only where you have agreed to advertising measurement (or, outside the European Economic Area, the United Kingdom, Switzerland and Brazil, have not switched it off). Our servers send it nowhere else; where you have allowed the Meta Pixel and the TikTok Pixel, they can also read it from the page address itself, as described below.

Analytics and advertising measurement, on the consent terms below. Where you have agreed to it — or, outside the European Economic Area, the United Kingdom, Switzerland and Brazil, until you switch it off — we load Google Analytics 4, the Meta Pixel and the TikTok Pixel, and our own servers send the in-app steps, the start of a free week and the purchase conversion described below to Meta and TikTok, through the Meta Conversions API and the TikTok Events API, and the start of a free week and the purchase to Google Analytics, through its Measurement Protocol.

The cookies these tags set on our domain, and how long they last: Google Analytics — _ga and _ga_<ID>, up to 13 months; Meta Pixel — _fbp and, when you arrive from a Meta advertisement, _fbc, 90 days; TikTok Pixel — _ttp and _tt_enable_cookie, up to 13 months, ttcsid and ttcsid_<ID>, 90 days, and ttclid when you arrive from a TikTok advertisement, up to 30 days. The providers may also use cookies on their own domains, under their own policies. Our own servers set one more first-party cookie, on the same consent terms: sv_relay, which records which of the three in-app steps described below have already been sent, so that each is sent at most once a day. It holds only those steps, the day or time each was last handled, and a shortened, irreversibly hashed form of your account identifier, so that it applies only to the account signed in on that browser. It is an HttpOnly cookie that your browser returns only to us; it is never sent to Google, Meta or TikTok, and it lasts 2 days. If you refuse or withdraw advertising measurement, no further steps are sent, and this cookie, which no script on the page can remove, simply expires.

What the pixels see, and Google’s advertising features. Like any page tag, the Meta Pixel and the TikTok Pixel read the address of the public page they run on — including any campaign parameters in it. So if you arrive from an advertisement, the click reference in the address (for example Meta’s fbclid or TikTok’s ttclid) reaches both pixels with that page visit. Where you have agreed to advertising measurement, Google Analytics may also use Google’s advertising features (Google signals), which send the analytics identifier — never a page address, title or story detail — to Google’s advertising servers. Where you have agreed to advertising measurement, the TikTok Pixel and Google Analytics may also use a hashed form of an email address you type on one of our public pages, such as the sign-in page, to match your visit (TikTok’s automatic advanced matching and Google’s user-provided data collection).

What is sent. Visits to our public pages (the landing page, these policy pages and the sign-in page), and seven steps of the signup journey: opening the landing page, starting a free story, making a first story choice, creating an account, reaching the subscription screen, starting a free week and the first payment of a subscription. The Meta Pixel and the TikTok Pixel only ever run on the public pages, so they receive the visits and the account creation. The steps taken inside the app are reported from the browser to Google Analytics under a page name with no identifier in it — except the start of a free week, which only our servers report — and three of them — starting a free story, making a first story choice and reaching the subscription screen — are also sent to Meta and TikTok from our own servers, only where you have agreed to advertising measurement (or, outside the European Economic Area, the United Kingdom, Switzerland and Brazil, have not switched it off). Those server events carry the name of the step and a generic page name — “/story”, never a page address, a title or any story detail — (and, for the subscription screen, the plan it opens on), together with an irreversibly hashed form of your email address, an irreversibly hashed form of your account identifier, the advertising identifiers listed above, and your IP address and browser user agent, which those platforms use to match the step to the advertisement you saw. Google Analytics also measures, by itself, how long a page stays open and, depending on its settings, how far it is scrolled; those measurements, too, carry only a page name with no identifier in it. When a free week starts we send that step from our servers, on the same consent terms: to Meta and TikTok with the plan, the same identifiers as the steps above and your IP address and browser user agent, but no amount, because nothing is charged that day; and to Google Analytics with the plan and its own analytics identifier only. When the first payment of a subscription is taken — at once for a plan paid straight away, or with the first charge after a free week — we also send that one conversion from our servers, carrying the plan, the amount and currency, an irreversibly hashed form of your email address, an irreversibly hashed form of your account identifier, the advertising identifiers listed above, and your IP address and browser user agent, which those platforms use to match the purchase to the advertisement you saw; Google Analytics receives it with its own analytics identifier, the plan, the amount, the currency and a transaction reference, never your email address or account identifier. It is sent once per account: a renewal, or a free week that ends without a charge, sends nothing.

What is never sent. No story text, story title, chapter, character name or story address ever reaches Google, Meta or TikTok. No address that identifies a story, a character or an account is ever reported to them: inside the app an event carries only a general page name such as “/story” or “/home”. Our measurement events can carry only a closed list of values — a page name from a fixed list, a plan name, an amount, a transaction reference — and have no field that story content could travel in.

Changing your mind. You can change your choice at any time through “Cookie settings”, in the footer of every public page and in your account Settings. A refusal takes effect immediately: the tags are told to stop, are not loaded again, and the cookies they set on our domain (listed above) are deleted.

Where the rules differ. In the European Economic Area, the United Kingdom, Switzerland and Brazil, nothing in the analytics and advertising group is loaded until you have agreed to it. Elsewhere we tell you that these technologies are in use and you may opt out at any time in the same place. If we cannot tell which country you are in, we apply the stricter rule.

We may disclose personal information to service providers that help operate StoryVerse, including hosting, AI, payment (Stripe), communications and security providers; to the analytics and advertising providers named in section 7, on the consent terms set out there and limited to the measurement events described there; to professional advisers; to regulators or law-enforcement bodies where legally required; and to a purchaser or successor in connection with a genuine corporate transaction, subject to appropriate safeguards.

Some service providers process information outside Australia (including in the United States and the European Union). We take steps required by applicable privacy law in relation to cross-border disclosure and processing.

We use industry-standard administrative, technical and organisational safeguards designed to protect information from misuse, interference, loss and unauthorised access, modification or disclosure. No online service can guarantee absolute security.

Our sign-in and sign-up forms use Cloudflare Turnstile to check that a real person, not an automated script, is creating or accessing an account. For this check Cloudflare processes technical signals such as your IP address and browser characteristics; it is used for security only, never for advertising, and Cloudflare’s handling of this data is described in its own privacy policy.

We retain personal information only for as long as reasonably necessary for the purposes described, legal obligations, fraud and security prevention and dispute resolution. You may request account deletion by contacting support@getstoryverse.com. Some information may be retained where legally required or reasonably necessary for security, fraud prevention or legal claims.

You may request access to, or correction of, personal information we hold about you, subject to applicable exceptions. Contact support@getstoryverse.com. We may need to verify identity before fulfilling a request.

Where permitted, we may send marketing messages to users who have consented or where otherwise lawful. Marketing emails include an unsubscribe mechanism. Transactional, security and account messages may still be sent where necessary.

Privacy questions or complaints may be sent to support@getstoryverse.com. We will investigate and respond within a reasonable period. Where Australian privacy law applies, individuals may also complain to the Office of the Australian Information Commissioner.

StoryVerse is not directed to children and requires account holders to be 18 or over. If we learn that an under-18 user has provided personal information contrary to our eligibility requirements, we may close the account and delete information where appropriate and lawful.

We may update this policy. The current version and effective date will be published on StoryVerse. Material changes will receive additional notice where required.

Privacy contact: SV Interactive Media Pty Ltd (ACN 701 247 707), Australia. Email: support@getstoryverse.com.