Privacy Policy

1. Who is responsible

This policy describes how MindGrow Stories processes personal data when you use the web application. The data controller is Johannes Erfurt, operating the service as a private individual — not yet through a registered company. For privacy and data requests, contact the project team; a dedicated business contact email will be published here once one is set up.

2. What we collect

We collect and process the following categories of data:

• Account: email address, display name, bcrypt-hashed password, session cookies, and login timestamps.
• Book inputs: child age, character names, story themes, emotional-personalization choices, optional free-text context, dedication notes, and illustration preferences.
• Uploads: reference photos and character descriptions you provide (highest sensitivity when photos show real children).
• Generated content: story text, scene images, PDF exports, and technical metadata (job IDs, seeds, provider names).
• Library: book titles, favorites, and links between your account and completed jobs.
• Browser storage: settings, character library portraits (IndexedDB), and generation drafts in localStorage on your device.

3. Why we use it

We use this data to authenticate you, generate and store your personalized books, show your library, improve service stability, and prevent abuse (for example rate limits).

We do not sell your personal data. We do not use it for advertising profiles.

4. Third-party processors

When you generate a book, parts of your inputs are transmitted to external AI providers configured for this deployment. This deployment uses OpenAI (text generation, vision-based image quality checks, and as a fallback image generator if Google's service is unavailable) and Google's paid Vertex AI service (Gemini) for story writing, image generation, and quality checks.

We do not currently use deAPI or Hugging Face as image providers and have no plans to. If that changes, this policy will be updated first.

OpenAI's API and Google's paid Vertex AI service do not use the content we send through their APIs — including photos — to train their underlying AI models. This is a commitment tied to each provider's paid/API tier, and is distinct from their free consumer products, which may use submitted content to improve their services.

Hosting infrastructure (Render) stores server-side files and databases in Frankfurt, Germany. Contracts and data-processing agreements for production use with children's data must be completed before wider public launch.

We also use Sentry for error monitoring, so we can detect and fix problems with the service. Sentry receives technical error reports (for example a crash report or a failed request), not your book content or photos, and its default PII collection is switched off; known personal-data fields are stripped before a report is sent. Sentry's data region for this deployment is the EU, and error reports are kept for 30 days, matching how long we keep other server-side data.

5. Where data is stored

Server data lives in a SQLite authentication database and on-disk job folders (by default under var/runs/, scoped per user when authenticated), hosted on Render infrastructure located in Frankfurt, Germany.

Generated books and other server-side job artifacts are deleted automatically after 30 days, as described in "How long we keep it" below. Other account data we still need — for example your account and library records — remains on this Frankfurt server for as long as your account exists.

Some data never leaves your browser until you send it to the API (character library portraits, UI preferences, local drafts).

6. How long we keep it

Sessions expire after 14 days of inactivity.

Generated book files on our servers — including images, PDFs, and other job artifacts — are automatically deleted when they are more than 30 days old. Cleanup runs when the API service restarts. Download a PDF if you want to keep a copy beyond that period.

Your account and library metadata remain until you delete individual books, request account deletion, or we remove data as described above. Deleting your account removes or de-identifies associated server-side data as described in "Your choices and rights" below — some transaction records are retained in de-identified form as required by law.

7. Your choices and rights

You can permanently delete individual books from “My Books”, which removes the library entry and all related files on our servers.

You can request deletion of your account by contacting the project team; a self-service control in Settings is not available yet. On account deletion, your book content and any remaining source files are deleted immediately rather than waiting for the normal 30-day window, and your account and library metadata are removed. Purchase and payment records (amount, currency, status, and provider IDs) are kept for up to 8 years as required by German commercial and tax law, but are no longer linked to your account or name once your account is deleted.

Backups are kept for at most about two weeks (our two most recent weekly backups) and then discarded. If we ever need to restore from a backup, we reapply any deletions or expirations that happened after that backup was taken before anything goes live again, so a restore cannot bring back data you deleted.

You can clear character library and local settings from the Settings page or by clearing site data in your browser.

You may request access, correction, or deletion of your data by contacting the project team. Depending on your location (for example the EU/EEA under GDPR), you may have additional rights such as restriction of processing or data portability. We respond to lawful requests within one month, extendable by a further two months for complex requests.

8. Children's data

The service is designed for parents to create content about children. We treat photos of minors and identifying story details as high-sensitivity data.

Please avoid uploading images you are not allowed to share. Before we send a photo of a real person to an external AI provider, we require your explicit consent, and the upload is re-encoded to strip EXIF/location metadata. We use your uploaded photo only to generate a character reference sheet: the original uploaded photo is deleted immediately once that reference sheet has been created, and also if generation fails, is cancelled, or times out.

9. Security

Passwords are hashed with bcrypt. Session identifiers are stored as hashes server-side; cookies are HttpOnly. HTTPS is used in production deployments.

No system is perfectly secure. Report suspected incidents to the project team.

10. Changes to this policy

We will update this page when data practices change. The “Last updated” date at the top reflects the latest revision.

A detailed technical inventory is maintained in docs/DATA_INVENTORY.md in the project repository.