StoriBuk, operated by Strataward provides family storybooks that a parent and child share. Accounts are for parents and caregivers only. Children never get their own account; they read only through a parent or guardian account. Questions about this policy go to [email protected].

We collect: (1) your account email and display name; (2) the first names and birthdates of children you add, which we use only to match story reading level and age band; (3) family photos you upload to create story characters; (4) reading activity, such as which stories were opened and finished, so the app can show progress and rewards; (5) purchase history for subscriptions, credit packs, videos, and printed books; and (6) technical logs and crash reports needed to run and fix the service. We do not collect precise location.

Photos you upload are used for one purpose: to draw cartoon-style story characters of the people in them. To do this, photos are sent to third-party AI providers — OpenAI generates story text and character illustrations, and fal.ai generates optional story videos. These providers process the photos to produce the artwork and are not permitted to use them to train their models under our agreements. Photos are encrypted at rest in our storage, and the app reads them only through signed URLs that expire. Photos are never shown publicly and are never used as decoration or marketing.

We use these providers to run StoriBuk: Clerk (sign-in and account security), Stripe (payments on the web; card numbers never touch our servers), RevenueCat (in-app purchases on iOS and Android), Lulu (printing and shipping keepsake books; they receive the book file and the shipping address for an order), Cloudflare R2 (encrypted file storage), OpenAI (story text and character illustrations), fal.ai (story videos), Resend (transactional email), Sentry (crash reporting), PostHog (product analytics), and Google Analytics 4 (consented public website traffic only). Each receives only the data it needs for its job.

On the website, PostHog and Google Analytics 4 run only after you accept analytics cookies. You can withdraw this choice in Family → Settings → Privacy and data. Google Analytics receives public page categories without story IDs, names, search terms, or private links. We do not send child profiles or story content to Google Analytics or use it for ads.

We keep your content while your account is active so your library keeps working. When you delete a character, a photo, or your whole account, we delete the underlying data and issue an erasure receipt code you can save. You can also request deletion by email. Backup copies clear on a rolling schedule after deletion. Payment records are kept as long as tax and accounting law requires.

You can export your family data from Family → Settings → Privacy and data. Delete your account from Family → Settings → Delete account. The account deletion page on our website also offers self-service deletion, and you can always email [email protected]. Deletion is immediate for your library and photos.

StoriBuk is built for parents. All child information in StoriBuk is provided by a parent or guardian, not collected from the child. Children do not have accounts, cannot enter personal information, and see no ads. We do not use children's data for marketing or profiling. If we learn that a child created an account, we delete it. This is how we meet the Children’s Online Privacy Protection Act (COPPA): the parent is the account holder and controls all child data, including deletion at any time.

Cast characters may depict real people. When you add a photo, you attest that every real person shown gave you permission, or that you are the parent or guardian of a depicted child. You can also send another adult a consent link so they grant or decline directly.

Data moves over TLS and photos are encrypted at rest. Access to production data is limited to the people who operate the service. No system is perfectly secure; if a breach affects your data we will notify you as the law requires.

StoriBuk, operated by Strataward. Privacy requests: [email protected]. Support: [email protected]. We answer privacy requests within 30 days.