Privacy policy
Plain English, on purpose.
The short version
- Children never have accounts, logins, email addresses or passwords in our apps. A parent or carer signs in and adds a child's first name (or nickname) and age.
- We collect the minimum we need to run the apps and we don't sell, rent or trade personal data with anyone.
- There is no advertising in anything we make, and no advertising trackers on this site.
- Your data is stored in the United Kingdom and the European Economic Area, and you can ask us to show, correct or delete it at any time.
Who we are
Storygram Ltd ("Storygram", "we", "us") is a company registered in England and Wales, company number 16176524, registered office c/o The Accountancy Partnership, Suite 5, 5th Floor, City Reach, 5 Greenwich View Place, London E14 9NN. We are the data controller for the personal data described here and are registered with the Information Commissioner's Office (registration ZC248895). You can reach us at hello@storygram.org.
This website (storygram.io)
Waiting lists
If you join a waiting list on this site (for Odyssey, Buy Me Books, or Storygram for schools) we store your email address, which one you joined and the date. We use it only to tell you when that product opens, or, for schools, to get in touch about your setting. You can ask to be removed at any time by emailing us.
Analytics
We use Vercel Web Analytics, which counts page views without cookies and without identifying individual visitors. There is no consent banner because there is nothing to consent to.
Newsletter
Footnotes is published on Substack. If you subscribe, Substack holds your email address under its own privacy policy, and you can unsubscribe from any issue.
Storygram Quest
This is the summary. The full policy for Quest, including the ICO Age Appropriate Design Code measures we follow, is published inside the app at quest.storygram.io/privacy; where the two differ, the app's policy is the one that applies to the app.
The grown-up's account
To use Quest, an adult signs in with an email address using a one-time code or link, or with Google or Apple; we don't store passwords. We hold the email address, a display name if you set one, and the family you belong to. Family members can invite a second adult by email.
Children's profiles
A parent or carer creates a profile for each child with a first name or nickname and an age, and may choose a hero, worlds and a picture from our own artwork. We do not ask for a child's surname, date of birth, school, photograph, location or contact details, and we never contact children.
Reading data
The apps record what a family chooses to record: books added, chapters ticked, reading sessions and their length, streaks, points and badges, ratings and short answers to the Sage's questions, and the books on a family's shelf or wishlist. This is the product; it exists so a child can see progress and a parent can see it too. Ratings and chosen worlds are also used, only within the family's own account, to suggest books.
Feedback
The "? Feedback" button in Quest sends us your message, the app version, and, if you leave the option on, a screenshot of the current screen. We use it to fix things.
Book information
When you add a book we may look up its title, author and cover from public book-metadata services using the ISBN or title you typed. We don't send them anything about you or your child.
Payments
Optional premium features are paid for through Stripe, which handles card details under its own privacy policy. We never see or store card numbers; we hold only a record that a family has a subscription.
Legal bases (UK GDPR)
We process account and reading data because it is necessary to provide the service you asked for (contract). We process waitlist and feedback data because you asked us to (consent), and analytics and security logs because we have a legitimate interest in keeping the apps working and safe. Children's data is entered by, and under the control of, their parent or carer.
Where data lives and who helps us
Our database and file storage are provided by Supabase, hosted in London, United Kingdom. The apps and this site are served by Vercel. Sign-in emails are sent through our email provider. Payments are handled by Stripe. These providers process data on our instructions and under contracts that meet UK data-protection requirements. We do not transfer your data outside the UK or EEA except where a provider's own safeguards (such as standard contractual clauses) apply.
Aggregate statistics
We may look at anonymous, aggregated numbers (for example, which books are most read across all families) to improve the catalogue and to write about reading. Any figure below a minimum number of households is suppressed so nothing can be traced to one family.
How long we keep it
For as long as you have an account. If you delete a child's profile, its reading data goes with it. If you ask us to delete your account, everything in the family is removed within 30 days, apart from records we're legally required to keep (such as payment receipts). Waiting-list entries are deleted once the product they were for opens, or sooner on request.
Your rights
You can ask us to show you the data we hold, correct it, delete it, restrict or object to how we use it, or send it to you in a portable form. Email hello@storygram.org from the address on your account. If you're unhappy with how we've handled something, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
If we change this policy in a way that matters, we'll say so in the apps and here, with the date above updated.