Privacy Policy

Stogenai is operated by halaSpace, an unincorporated sole proprietorship of Ahmed Almurtadha, based in Türkiye (“we”, “us”). This policy explains what personal data we collect, why, and what rights you have over it.

From the parent/account holder:

• Email address and a hashed password (we never store your password in plain text — see /security).
• Preferred language and timezone.
• Payment is handled entirely by our payment processor (Lemon Squeezy) — we never see or store your card number.

From child sub-profiles (created by a parent, under the parent's account):

• Display name and birth year only — not a full birthdate, and no other identifying information (data minimization).
• Content the child creates: stories, characters, drawings.

Generated automatically:

• Stories, character descriptions, and illustrations you ask us to generate.
• Usage logs (sign-in times, device/session metadata) used for security and abuse prevention.
• A push-notification device token, if you enable notifications on the mobile app.
• If you choose to watch an optional rewarded video in the mobile app: a random app-install identifier, the app version and whether the video was completed, so we can credit your account and prevent abuse.

Stogenai is a family product. Registering an account for a child under 13 requires a parent or guardian's email address; the child's account stays restricted (“Safe Mode” — private-only, no public sharing, no reference-photo uploads) until the parent confirms via an emailed link. Parents can review, edit, or delete their child's content and profile from the parent account at any time.

When you create a story or drawing, the text and description you provide (title, character descriptions, your written beginning/ending) is sent to a third-party AI provider to generate the rest of the story and illustrations. Depending on what's configured, this may be OpenAI, Anthropic, or Google Gemini. These providers process the content to generate a response but Stogenai does not permit them to use your content to train their models beyond what their standard API terms provide. Generated content passes through an automated safety check before it is shown to you or stored.

We use the following third-party processors, each only for the specific purpose listed:

• OpenRouter (which routes requests to OpenAI / Anthropic / Google Gemini) and those providers directly — story text and image generation, content moderation.
• Google AdMob — optional rewarded videos in the mobile app. Every ad request is marked as child-directed, so no advertising ID is sent and no personalised ads are shown.
• Lemon Squeezy — subscription billing (they hold your payment details, not us).
• Cloudflare R2 (or equivalent object storage) — hosting uploaded/generated images.
• Our email provider (an SMTP service or Postmark) — sending the emails described below.
• Firebase Cloud Messaging — mobile push notifications, if enabled.
• Sentry (or equivalent) — error monitoring, to help us fix bugs.

We do not sell your data, and we do not use it for personalised or targeted advertising. The only ads are the optional rewarded videos described above, which are child-directed and non-personalised.

Emails only ever go to the adult account holder (for a child under 13, to the parent's address), never to a child.

• Account and security emails: verifying your email, welcome, password reset and change, parental consent, account deletion. These are needed to run your account, so they can’t be turned off.
• Plan notices: payment problems and plan changes.
• Optional emails: a new chapter is ready, and event results when someone in your family wins. Turn these off any time in Account → Settings or with the unsubscribe link in each email.

Emails contain the story or event title and the child's display name at most, never story text. We keep a record of what was sent (not the email itself) for up to 90 days to make sure emails are delivered, and stop optional emails to addresses that bounce or report spam.

We keep account data for as long as your account is active. When you ask us to delete your account, it is scheduled for deletion after a 30-day grace period (signing back in during that time cancels it). After that, your personal information (email, name), child profiles and content are permanently deleted or anonymised; some records (e.g. billing history) may be retained longer where we're legally required to keep them.

You can download a copy of everything tied to your account at any time from Account → Export my data, and permanently delete your account from Account → Delete my account. Depending on where you live, you may also have the right to correct inaccurate data or object to certain processing — contact us (below) to exercise those rights.

We use strictly-necessary cookies to keep you signed in. With your consent (see the cookie banner), we may also use analytics cookies to understand product usage. You can change your choice at any time from the cookie preferences link in the site footer.

Questions about this policy or your data: privacy@stogenai.com.