Privacy Policy

1. What we collect

• Account — email address, your name, and caregiver role, used to sign you in and sync your memories across your devices.
• Children's information you choose to record — names, dates of birth, gender, birth details, and photos you upload.
• Memory content — voice recordings, text notes, polished story content, and attached photos.
• Sharing preferences — family members you invite and auto-share recipient identifiers.
• Contacts (optional, only when you choose) — when you tap "Pick from Contacts" to add an auto-share recipient, the app opens your device's contact picker and reads only the single email address or phone number of the person you select, to fill in that recipient. We do not read, upload, or store your address book; you can always type a recipient in by hand instead.
• Purchases — subscription status and transaction identifiers, processed through the App Store or Google Play and our billing provider (RevenueCat) to give you access to paid features. We never receive your card or payment-card details.
• Automatically — device type, app version, session timestamps, error logs (not story content), and IP address at account setup.

We do not collect GPS location, your address book, data from other apps, or advertising data.

2. How we use it

• To provide the service: store and retrieve your stories, process voice/text into written memories using AI, generate AI illustrations, and enable sharing you authorize.
• To improve the service: fix bugs and resolve errors reported through the app.
• To communicate: account emails, policy-change notices, and support responses.

We do not use your content to train AI models, serve advertising, build profiles for third parties, or sell your data.

3. Service providers

We do not sell your personal data and do not share it with advertisers. We use trusted providers solely to operate SayStory: OpenAI (transcription, story polishing, illustrations — under a data-processing agreement that prohibits training on your data), Amazon Web Services (hosting, authentication via Cognito, database), Resend (transactional email), RevenueCat (subscription management and purchase validation, working with the App Store and Google Play), and Telegram (only to deliver stories to recipients you configure). Each provider processes only what is needed to deliver the requested feature and acts under its own terms; we are not responsible for their independent acts, outages, or security incidents beyond our reasonable control.

4. How we store & protect it

Data is stored in a database on AWS infrastructure in the United States; your device keeps a local copy for offline access. We use reasonable, industry-standard safeguards including encrypted connections (HTTPS/TLS), token-based authentication, access controls, rate limiting, and audit logging.

No method of transmission or storage is completely secure, and we cannot and do not guarantee that the service will be free from unauthorized access, loss, or breach. You acknowledge and accept this risk when you use SayStory. We respond promptly to security incidents and notify affected users where required by applicable law. To the fullest extent permitted by law, we are not liable for unauthorized access, loss, or disclosure that is not caused by our gross negligence or willful misconduct — including incidents originating with a third-party provider, your own device or account, or anyone you choose to share content with.

5. Your rights & choices

• Access / edit / delete individual memories, child profiles, or your entire account in the app (Settings → Account → Delete Account).
• Export a full copy of your data from within the app.
• Opt out of AI processing in Settings → Use AI.
• EEA/UK/Switzerland (GDPR): rights of access, rectification, erasure, restriction, portability, and to object. California (CCPA/CPRA): rights to know, delete, and opt out of sale (we don't sell data). Contact support@saystory.app.
• Manage subscriptions through the App Store or Google Play.

6. Children's information

SayStory is an adults-only service for caregivers to record memories about children. Children do not create accounts and may not use the service directly, including via a family invitation; every user must be 18 or older. Because the content you provide (a child's name, date of birth, photos, voice recordings) may relate to a minor, it is treated as sensitive. As the adult caregiver, you are responsible for having the legal right and any necessary parental or guardian consent to record and share information about a child. We do not knowingly collect personal information directly from a child, and do not use children's information for advertising, profiling, or AI training, nor sell it. If you believe a minor has gained direct access, or that we inadvertently collected information directly from a child, contact support@saystory.app and we will take appropriate action, including deletion.

7. Changes

If we make material changes, we will notify you through the app and ask for your acknowledgment before you continue using the service.

8. Contact

Privacy questions, data deletion, and GDPR/CCPA requests: support@saystory.app.