Privacy policy
Last updated: October 22, 2026
⚖️ Template – this text has not yet been reviewed by a lawyer and must be checked before going live.
1. Controller
Your Full Name or Company, Street 1, 12345 City, Germany, email: hello@example.com.
2. Our principles
- Data minimisation: children can use StoryNest without an account and without giving any personal data.
- No advertising, no third-party tracking, no profiling.
- Accounts, ratings and comments are for adults (parents/guardians) only.
3. What we process and why
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Delivering the website | IP address, time, requested page, browser type (server logs) | Art. 6(1)(f) – security and operation | 14 days |
| Cookie-consent record | Random consent ID (hashed), choice, policy version, salted IP hash | Art. 6(1)(c) with Art. 7(1) | 3 years |
| Parent account | Email, display name, password hash, adult confirmation | Art. 6(1)(b) – contract | Until account deletion |
| Ratings and comments | Rating, comment text, time, moderation result | Art. 6(1)(b) and (f) | Until deletion of comment/account |
| Contact and reports | Name, email, message | Art. 6(1)(c) and (f) | Up to 3 years |
| Optional statistics (only with consent) | Pseudonymous usage data, self-hosted, no cross-site tracking | Art. 6(1)(a) | 13 months |
4. Recipients and processors
- Hosting: Hostinger (server in the EU – [check location of your VPS]). Data processing agreement under Art. 28 GDPR.
- OpenAI: used to write, translate, illustrate and narrate stories and to moderate comments. Comment texts are sent to the OpenAI moderation service; no account data is sent. OpenAI may process data in the USA; transfers are based on the EU–US Data Privacy Framework and/or Standard Contractual Clauses. Data processing agreement in place.
- Cloudflare Turnstile (spam protection on forms, if enabled): processes technical data to tell humans from bots.
- We do not sell or share personal data for advertising.
5. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and to withdraw consent at any time (Art. 7(3)). Logged-in users can export and delete their data in their account settings. You may also complain to a data-protection supervisory authority.
6. Children
See our Children's privacy statement.
7. Security
TLS encryption, hashed passwords (Argon2), encrypted tokens, access controls, regular backups and a data-breach response plan.
8. Changes
We will update this policy when our processing changes. Version: 2026-10-22.