Privacy Policy

← Back to Storynote

Storynote, LLC ("Storynote", "we", "us") builds a shared photo-album app for trips, celebrations, and family life. This Privacy Policy explains what we collect, why, who we share it with, and how you can get your data out or delete it — for both our website and the Storynote iOS app (including pre-release TestFlight builds).

By using Storynote you agree to the practices described below. If you do not agree, please do not use the website or the app.

1. Information we collect

1.1 Information you give us

• Email address, when you create an account or join our mailing list.
• Your name, username, profile photo, optional profile background image, and optional bio.
• Photos, videos, captions, stories, notes, reactions, comments, and any other content you create or upload in Storynote.
• Your connections in Storynote: the people you follow and who follow you, the people you add to a story as contributors or viewers, any contact groups you create, and anyone you block. These are built from Storynote usernames — we never read your device's contacts.
• Feedback, support requests, and anything else you send us.

1.2 Information collected automatically

• Device information, such as device model, operating system version, app version, your device's language and region settings, and its time zone (stored with each note so its time displays correctly).
• Device identifiers used to deliver push notifications, measure app usage, and confirm requests come from a genuine copy of the app. These are not advertising identifiers.
• IP address, and a general geographic region derived from it by our analytics provider.
• Usage data — which screens you visit, which features you use, and in-app interactions such as creating a story or adding a note, linked to your account. We use this to understand which parts of the product work, never for advertising.
• Log data, and crash and diagnostic reports, used for debugging, security, and reliability.
• Approximate database read counts per session, which we use to keep our own hosting costs predictable.

1.3 Photo metadata and location

We never request access to your device's location, and the app contains no location tracking. What we do read is the date and location your photo library already holds for the photos and videos you choose to add:

• Capture date and time — used to sort photos chronologically within a story, which is the heart of how Storynote works.
• Location, when a photo has one — converted into a readable place name (a city and state or region) using Apple's location service: the coordinates are sent to Apple to look up the name, and only the place name is stored with your note. Storynote never stores the coordinates. You can remove a note's place name at any time from that note's menu.

The files we store don't carry your location either: photos are re-encoded when you upload them, and location data is removed from videos.

If you choose a location for a story, the place you type is looked up with Apple's map search and stored as the story's location. If you filter your library by date when adding photos, the app looks through your library on your device to find matching photos and may look up their place names with Apple; nothing from that search is sent to Storynote unless you add the photo.

If a photo has no location, nothing is derived. If you strip metadata before uploading, or your camera never recorded it, Storynote simply has nothing to read.

1.4 Cookies and website analytics

On our website we use Google Analytics to understand how visitors find and use the site — information such as IP address, browser type, pages visited, and time on page. To learn how Google uses this data, see Google's Partner Sites policy.

1.5 What we deliberately do not collect

• No advertising identifiers. The app does not use the IDFA, does not show ads, and never presents an app-tracking permission prompt, because it has nothing to ask for.
• No cross-app or cross-site tracking of your activity outside Storynote.
• No device location. See 1.3.
• No camera access. Storynote adds photos from your library; it does not take them.
• No access to your phone’s contacts or address book, and no microphone or health data. The people you add in Storynote come from Storynote usernames (section 1.1).
• No payment card details. See section 7.

2. How we use it

We use the information we collect to:

• Provide, operate, secure, and improve the website and app.
• Show your stories to the people you have shared them with, and show you theirs.
• Sort photos chronologically and display a place name for context.
• Send you notifications about activity on your stories.
• Send account emails, such as email verification and password resets.
• Send onboarding emails and product updates. When you create an account, we add your email address and name to our mailing list (managed with Loops, see section 3). Every message has an unsubscribe link, and you can unsubscribe at any time.
• Respond to support requests.
• Understand aggregate usage and reliability so we can fix what is broken and improve what is not.
• Enforce our Terms of Service, review reported content, and prevent abuse, fraud, and security incidents.
• Determine which plan you are on and which features it unlocks.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

3. Who we share it with

We share information with service providers who help us run Storynote. They may only use it to provide services to us, and may not sell it:

• Google / Firebase and Google Cloud — our core infrastructure: database, file storage, authentication (including account emails), serverless functions, push delivery, abuse prevention, crash reporting (Crashlytics), and product analytics (Google Analytics for Firebase, which receives app usage events linked to your account identifier; we don't use it for advertising).
• Google Cloud CDN — a content delivery network that caches public images close to viewers so they load quickly. Private content is never served through it.
• RevenueCat — manages subscription status. It receives your Storynote account identifier, purchase information from Apple, and basic device and app information. It does not receive your photos, stories, or payment card details.
• Apple — handles App Store purchases and billing, delivers push notifications, looks up place names and location searches (see 1.3), verifies that requests come from a genuine copy of the app, and, if you choose it, Sign in with Apple.
• Google Sign-In — if you choose to sign in with Google.
• Loops — our email platform. It holds your email address, name, and account identifier to send onboarding emails and product updates, and handles unsubscribes. When you delete your account we remove you from it.
• Google Analytics — on our website (see 1.4).

We may also disclose information if required by law, regulation, legal process, or a governmental request, or where we believe it is necessary to protect the rights, property, or safety of Storynote, our users, or the public. If Storynote is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction; we will give notice before your information becomes subject to a materially different policy.

4. Your content, and who can see it

Storynote is collaborative by design. You create stories made of notes (photos or videos with captions), and you decide who can take part:

• Only Me — visible to you alone.
• Private — visible to the contributors and viewers you add. Contributors can add their own notes; viewers can see, react, and comment.
• Public — visible to anyone, and eligible to appear in Discover. See section 5 before choosing this.

Individual notes can be more private than the story they sit in — never more public. You can set any note you added to Public, Private, or Only Me, or leave it matching the story.

If you contribute to someone else's story, they control that story's privacy level. If the owner later makes a private story public, your notes do not automatically become public: they stay private and we notify you, so that publishing your own photos is always your decision.

You retain ownership of your content. By uploading it you grant Storynote a limited license to store, process, and display it as needed to run the service — including generating a smaller display copy of each image so pages load quickly, and a still frame from each video. See the Terms of Service for the full license terms.

5. What "public" really means

When a story or a note is Public, its images are served from a public web address. That address is long and effectively unguessable, and we do not publish a directory of it — but anyone who has the address can open the image without a Storynote account and without signing in. "Public" means publicly accessible on the internet, not merely visible to other Storynote users.

The same is true of profile photos and profile background images, which are treated as public regardless of your story privacy settings. Their address is based on your account identifier, so it should not be treated as secret.

Content you keep Private or Only Me is handled differently. Within moments of upload it is moved to a separate, non-public location, and from there it can only be retrieved through a short-lived link that our servers issue after checking that the requester is allowed to see it. It is never served through the public content delivery network.

If you change something from public to private, we immediately move the file out of public storage and clear it from the content delivery network's caches. Two honest caveats:

• Clearing caches is prompt but not instantaneous, so there can be a short window during which a previously-issued address still returns the image.
• Anyone who already downloaded, screenshotted, or copied the image while it was public still has their copy. No privacy setting can reach that, on any service.

Full-resolution photo originals are a separate case: they are never served publicly, whatever a story's privacy level, and are downloaded only through an authenticated request. Videos are stored at a single quality, so a public video is publicly accessible in full, like a public photo's display copy.

6. Device permissions we ask for

• Photo library — so you can choose photos and videos to add to a story, and set a profile photo. Normally Storynote sees only what you select. If you filter your library by date, the app asks for full access so it can find photos from those dates on your device (see 1.3); only the photos you add are uploaded.
• Saving to your photo library — so you can download a photo from a story back to your device.
• Push notifications — so we can tell you about activity on your stories, such as new notes, comments, reactions, or invitations.

That is the complete list. You can change or revoke any of these at any time in iOS Settings, and Storynote will keep working without them (with the corresponding feature unavailable).

7. Subscriptions and payments

Storynote offers optional paid plans, sold through the App Store. Apple processes every payment. We never see or store your card number, bank details, or billing address.

What we do receive and store is limited to what we need to unlock the right features: which plan you are on, when it renews or expires, whether you have used a free trial, and a purchase identifier from Apple. This is handled by RevenueCat on our behalf and is linked to your Storynote account identifier.

Purchase history, refunds, and cancellations are managed by Apple. See the Terms of Service for the commercial terms, and Apple's own privacy policy for how Apple handles your payment information.

8. Reporting, blocking, and moderation

Storynote lets you report content and block other users. To make that work:

• When you submit a report, we record what was reported, the reason you gave, and that you submitted it. Reports are reviewed by us and are not shown to the person reported.
• When you block someone, we store that relationship so we can hide each person’s content from the other in both directions. Blocking also removes any follow between you, removes each of you from the other’s stories and groups, moves the photos and videos each of you added to the other’s stories into an Only Me story owned by the person who added them (counting toward their storage), permanently deletes the comments (including any replies under them), likes and reactions each of you left on the other’s stories, and deletes the notifications you had received about each other. The relationship is deleted when neither of you is blocking the other.
• You can report a story, note, comment, or reply, or a person from their profile.
• Content reported by three or more different people is hidden automatically from everyone except the person who posted it, pending our review. Accounts are reviewed by us, not hidden automatically. We do not scan or analyze your photos proactively — review is triggered by reports, not by upload.
• We may remove content or suspend accounts that breach our Terms of Service.

Child sexual abuse material is a legal exception to everything else in this policy. Where we become aware of it we are required by US law (18 U.S.C. § 2258A) to report it to the National Center for Missing & Exploited Children and to preserve the related material and account records. That obligation overrides a deletion request: we cannot delete what we are required to preserve, and we will not notify the account holder.

8.1 Who at Storynote can access your content

Being straightforward about this, because "private" can be read to mean more than it does. Storynote is a small company, and a small number of authorized personnel can technically access stored content, including private stories, using administrative tools. We do so only where necessary — investigating a report, debugging a fault you have asked us to fix, or complying with a legal obligation — never to browse. No third party is given that access, and our service providers hold data only to provide their service to us (see section 3).

9. Where data is stored, and for how long

Your data is stored on Google Cloud infrastructure in the United States.

Storynote is offered in the United States only and is intended for US residents — we do not offer or direct it to people in the European Economic Area, the United Kingdom, or Switzerland, and it is not designed to meet those jurisdictions' data protection requirements (see Terms section 1). This is about where you live, not where you travel: using Storynote on a trip abroad is exactly what it is for, and doing so means your information is sent to the US for processing.

We keep your information for as long as your account is active and for as long as reasonably necessary to run the service, meet legal obligations, resolve disputes, and prevent abuse.

Deletion is not instantaneous at the storage layer, and we would rather say so than imply otherwise. When a photo, video or account is deleted, our cloud storage keeps the deleted files in a private recovery window — currently up to 37 days — so that an accidental deletion, or a fault on our side, can be undone. During that window the files are not part of your account and are not linked from anywhere; afterwards they are purged. Separately, our database is backed up on a rolling basis, and those backups are kept for up to 14 weeks before being overwritten, so deleted data can also persist in backups for that long.

10. Deleting your account

You can delete your account from inside the app: Settings → Delete account & data. No email to us is required.

When you submit the request, your account is scheduled for permanent removal and enters a 30-day recovery window. During those 30 days you can cancel the request and restore access — this exists so a mistaken tap is not permanent. After the window closes, your account and associated personal data are deleted from our live systems, and your uploaded files then pass through the storage recovery window described in section 9 before being purged.

Things to know:

• What is deleted: your stories and everything in them (including notes other people added), and the notes, comments and replies you added to other people's stories. If you want to keep any of your photos, download them before deleting your account.
• We may retain limited information for longer where necessary for legal obligations, fraud prevention, security, or to resolve a dispute. This includes reports and moderation records about content, and material we are legally required to preserve (see section 8).
• Deleted files sit in our storage's private recovery window (currently up to 37 days) before being purged, and database backups are kept for up to 14 weeks — so deleted data can persist in both after it is gone from your account.
• App usage analytics and crash reports linked to your account identifier are not deleted with your account. They expire automatically within 14 months.

Deleting your Storynote account does not cancel an App Store subscription. Cancel that in iOS Settings → your name → Subscriptions.

11. Your rights

Depending on where you live, you may have rights under privacy laws including the California Consumer Privacy Act (CCPA/CPRA). These may include the right to:

• Know what personal information we hold about you, and how it is used and shared.
• Request a copy of your data in a portable format.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information.
• Opt out of the sale or sharing of personal information — we do neither, so there is nothing to opt out of.
• Not be discriminated against for exercising these rights.
• Withdraw consent where our processing relies on it.

You can exercise the most common ones directly in the app: edit your profile to correct information, and use Settings → Delete account & data to delete. For anything else, email support@storynote.com. We may need to verify your identity first, and we will respond within the time required by applicable law.

11.1 Categories of personal information we collect

Stated in the categories US state privacy laws use, so the list can be checked against them:

We do not knowingly collect sensitive personal information as those laws define it, we do not use personal information for automated decision-making or profiling, and we do not sell or share personal information for cross-context behavioral advertising. Because we do not sell or share it, there is no "Do Not Sell or Share My Personal Information" mechanism to offer.

11.2 Do Not Track and Global Privacy Control

Our website does not currently respond to browser Do Not Track signals, as there is no common standard for them. Where we are required to honor an opt-out preference signal such as Global Privacy Control, we will — though as noted above, we do not sell or share personal information, so there is nothing for such a signal to switch off. The iOS app contains no cross-app tracking and no advertising identifier.

12. Age requirement

Storynote is not directed to children. You must be at least 18 years old to use Storynote, and we do not knowingly collect personal information from anyone under 18. If you believe a child has created an account or that we hold their information, contact support@storynote.com and we will remove it.

13. Security

We take security seriously and design for it rather than bolt it on. Among other measures: all traffic is encrypted in transit; data is encrypted at rest by our cloud provider; access to private content is checked on our servers rather than trusted from the app; private media is moved within moments of upload into storage separate from public media, and served only through short-lived authorized links; and requests to our backend are attested to come from a genuine copy of the app.

No service can promise perfect security. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law.

14. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. If the changes are significant, we will give additional notice — by email or in the app — before they take effect.

15. Contact us

Questions about this policy, or about how your information is handled? Email us at support@storynote.com and a real person will answer.

Storynote, LLC