Privacy policy

1. Data controller

Jon Zubizarreta, Spanish tax ID (NIF) 72601799E, with registered address at Iñaki Azpiazu 28 3A. Contact email for anything related to your data: soporte@story256.com.

2. What data we process on the website

The website can be visited without an account and without cookies. We process:

• Beta waitlist: your email address, whether you ticked the newsletter box (and when), which page you signed up from (home or founders) and the language of the page. Only if you sign up.
• Sign-up limit: to prevent abuse we keep for one hour a salted hash of the IP address the form was sent from. The IP cannot be recovered from it and it is never matched with the emails.
• Internal notice: every new sign-up is announced (email, language and origin) in a private team channel on Discord, to manage the beta invitations.
• Audience measurement: we use Vercel Web Analytics and Speed Insights, which use no cookies or persistent identifiers. Vercel computes on its network an identifier that changes every day from the IP address and the browser, and gives us only aggregate figures (page views, country, device type, events such as “waitlist sign-up” without the email).
• Page preferences: your choice of theme (ink or paper) and language is stored in your browser’s local storage. It never leaves your device and cannot identify you.
• Fonts: the page loads its typefaces from Google Fonts, so your browser sends Google the request for the fonts (with your IP address), as with any web resource.

3. What data we process in the app

Account and identity:

• Email address (to create the account and verify it with a code; we don’t show it to anyone).
• Username and, if you upload one, profile photo. Both are public.
• An internal account identifier.

Content and activity (what you do on Story256):

• The fragments you publish, the stories you create (title, language, categories, cover, “18+” flag) and the forks you open, with their date; the characters, objects and places you create and the images you upload.
• Hearts (votes) you give, stories and people you follow, queues you join, reports you send and people you block.
• Quota spent each day, streak, achievements, device time zone, reading languages, the “show 18+ stories” preference and notification preferences.
• Your last read of each story you follow (to show you what’s new) and story openings, with an installation identifier, to know what is read and where people come from.

Purchases:

• The status of your subscription or purchase (plan, renewal or expiry date, store transaction identifier) and which plan screen you opened or bought from. We never see your card or bank details: payment is handled by Apple, Google or the web payment provider.

Device and notifications:

• If you accept notifications, a device push token (an identifier that allows notifications to be sent to it) and the platform (iOS/Android).
• Technical session data: IP address, device type and operating system, app version, language. We use them for security and to make the app work.

Diagnostics and performance:

• Error reports (technical trace, screen where it happened, device model, OS, app version and an installation identifier) and performance metrics (start-up time, load time of each screen, version). They never include the text you write.

In the web app we use only technical browser storage (session, whether you have already seen the onboarding). We don’t use advertising or third-party cookies.

4. Why, and on what legal basis

• Managing the waitlist and sending you the beta invitation. Basis: your request (pre-contractual steps) and your consent when signing up, which you can withdraw by asking us to remove you.
• Sending you the newsletter. Basis: your consent, given by ticking the box and withdrawn with the unsubscribe link in any email.
• Providing the service: creating and maintaining your account, publishing and displaying your fragments, managing quotas, queues, streak, achievements and follows, and processing your purchases. Basis: performance of the contract (the Terms of use).
• Sending you notifications about your activity (it’s your turn to write, someone forked your fragment, hearts, activity in stories you follow) and daily reminders. Basis: your consent, given when you accept the system permission and withdrawable in Profile or in the device settings.
• Moderating content, handling reports, applying blocks, preventing abuse (duplicate accounts, manipulation of the time zone or the queues, mass waitlist sign-ups) and protecting the security of the service. Basis: legitimate interest in keeping the service safe and meeting the obligations the app stores impose on us.
• Measuring the website’s audience and the app’s performance, and detecting and fixing errors. Basis: legitimate interest in knowing whether the website and the app work, with aggregate data or data limited to the technical.
• Answering your enquiries and requests to exercise your rights. Basis: legal obligation and performance of the contract.
• Complying with legal obligations (for example, requests from authorities or invoicing). Basis: legal obligation.

We don’t make automated decisions with legal effects on you. The automatic removal of a fragment after three reports is a provisional moderation measure reviewed by a person.

5. What is public

Story256 is a public writing space. Anyone, with or without an account, and also through shared links, shared images and the web, can see:

• Your fragments, with your username and profile photo, and the publication date.
• The stories you create (with their cover) and the forks you open; the characters, objects and places you create.
• Your public profile: name, photo, number of fragments, stories, forks and hearts received, and how many people follow you and how many you follow.
• Your position in the leaderboard, if you are among the top.
• The number of hearts on each fragment and the number of people in each queue (not who voted or who is in the queue).

Not public: your email, your plan, your time zone, your streak, your languages, your preferences, who you have blocked, what you have reported, what you have voted for, which entities you have marked as favourites or which stories you follow.

Bear in mind that fragments can’t be edited or deleted once published (they are links in a collective story). If you delete your account they are unlinked from you (section 8).

6. Who we share data with

We don’t sell your data or pass it on to advertisers. To provide the service we use providers that process data on our behalf and under contract (processors):

• Supabase (database, server functions and realtime): hosts all the app’s data and the waitlist. Servers in the European Union.
• Clerk (authentication): handles sign-up, the email address, the verification code, the username and the profile photo. United States.
• RevenueCat (subscriptions): manages the status of your purchases from Apple, Google or web payment receipts, keyed by your account identifier. United States.
• Apple (App Store) and Google (Google Play): process payments under their own privacy policies; we don’t receive your payment details.
• Expo (EAS): sends push notifications through its service (Expo Push, which in turn uses Apple Push Notification service and Google’s Firebase Cloud Messaging), distributes app updates and collects anonymous start-up and performance metrics (EAS Insights and EAS Observe). United States.
• Sentry (error reports): receives the diagnostic reports described in section 3. United States or European Union depending on the project configuration.
• Vercel (website hosting and audience measurement): serves the pages from its delivery network and gives us the aggregate figures described in section 2. United States, with points of presence in the European Union.
• Discord (internal notice of waitlist sign-ups): receives the email, language and origin of each sign-up in a private team channel. United States.
• Google Fonts (website typefaces): receives the font request from your browser. Google Ireland Ltd. / Google LLC.

We may also disclose data to authorities when the law requires it, and to the app stores as part of their review and safety processes.

7. International transfers

Some of the providers above process data in the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified and, in any case, on the standard contractual clauses approved by the European Commission, with any additional measures that apply.

8. How long we keep data

• Waitlist: until we invite you and you create your account, until you ask us to remove you or, at most, six months after the end of the beta. The IP hash is deleted after one hour. The Discord notices are deleted when the beta closes.
• Newsletter: until you unsubscribe.
• Account and activity data: for as long as the account exists.
• When you delete your account (Profile → “delete account”, or by email) we delete the email, username, photo, streak, time zone, languages, preferences, votes, follows, queues, notifications, blocks and push tokens, and the account is removed from the authentication provider. Fragments are kept anonymously, signed “deleted account”, because they are part of other people’s stories.
• Reports: kept anonymously as a moderation record.
• Story openings and plan-screen events: up to 180 days.
• Purchase records: for as long as tax and consumer law requires.
• Error reports and metrics: up to 90 days.
• Database backups: up to 30 days, after which deletion is final.

9. Your rights

You can at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given (for example, for the newsletter or notifications) without affecting the processing carried out until then.

Write to soporte@story256.com from the email address you signed up or created your account with (or stating your username). We’ll reply within one month. Many things you can do directly in the app: change your name or photo, your languages, your notification preferences, and delete your account from Profile.

If you believe we haven’t handled your rights properly you can lodge a complaint with the Spanish Data Protection Agency (AEPD):

www.aepd.es

10. Minors

Story256 is not aimed at people under 14 and we don’t allow them to create an account or join the waitlist. If you know that someone under 14 has done so, write to us and we’ll delete their data.

11. Security

Data travels encrypted (TLS) and is stored with providers holding recognised security certifications. Database access is limited by per-user rules: each account can only read its own private data. Administrative access is restricted and logged. No system is infallible; if we detect a breach affecting your data we’ll inform you and notify the authority as the law requires.

12. Changes to this policy

If we change this policy in a significant way (for example, a new provider or a new purpose), we’ll tell you in the app or by email before it takes effect. The date of the latest version appears at the top of this page.