Privacy policy

The controller of your account data is Diana Vasyliuk, an individual resident in Poland (“MakeStory”, “we”). Privacy questions and requests: support@makestory.com.

If your manuscripts or posts contain personal data about other people, you decide how it is used and are its controller; we process it on your instructions to provide the Service.

Account data: name, email address, password (stored only as a hash), profile picture, your Google account ID if you sign in with Google, and when you accepted the Terms.

Your writing: projects, chapters, notes, posts, covers, version history, story bible entries, style presets, writing preferences and daily word counts.

AI requests: when you ask for AI help, the relevant text, your instructions and relevant story-bible facts are sent to OpenAI to produce suggestions. We keep the suggestions and a record of each run (what you asked for, how many AI words it used and its result) so you can review changes and see your history. OpenAI processes this data only to return the result and does not use it to train models.

Billing: if you subscribe or buy a top-up, Stripe processes your payment details; we receive your Stripe customer ID, plan, subscription status and billing period, never your full card number. We keep a ledger of AI words used and added.

Reading links and blogs: when a reader comments through a beta-reader link we store the name they type, the comment and any quoted passage. Readers of public blogs and links don’t need an account.

Usage and technical data: security and error logs that may include IP address, browser/device information, the time and type of each request and error details; and support messages you send us.

Provision of account data is required to use the Service. We do not intentionally collect special-category (sensitive) data.

To provide the Service you asked for (create your account, store your writing, AI suggestions and analysis when you ask for them, exports, sharing and publishing, subscriptions and top-ups, verification emails) — performance of a contract.

To keep the Service secure and working (authentication, abuse prevention, error logging, fixing bugs) — our legitimate interests.

To answer support requests and handle content complaints — contract and legitimate interests.

To meet legal obligations, and to establish or defend legal claims — legal obligation and legitimate interests.

We send only service emails (verification codes, password resets, account and billing notices). We do not send marketing emails; if we ever do, we will ask for your consent first. We do not sell personal data, do not use it for advertising or to train AI models, and do not make decisions about you by automated means that have legal or similarly significant effects.

We use service providers who process data on our behalf, only to provide the Service: DigitalOcean (Amsterdam, Netherlands) for hosting, database and uploaded files; Zoho Mail for transactional email; OpenAI for AI suggestions, only when you use AI features; Stripe for payments; and Google for sign-in with Google (if you choose it) and Google Analytics (if you accept analytics cookies). We bind each provider to confidentiality and data protection terms.

Your writing is private unless you share it: a beta-reader link shows the shared chapters to anyone with the link, and a public blog shows published posts to everyone. We may disclose data if required by law or to protect rights and safety.

Our providers may process data outside your country, including in the United States. Where data leaves the EEA, the UK or Switzerland we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or otherwise the European Commission’s Standard Contractual Clauses. Our servers and file storage are located in Amsterdam, Netherlands. You can ask us for a copy of the safeguards at the email address above.

Account data and your writing are kept while your account is active. Archived projects remain until you delete them. Version history is kept for the period your plan includes (7 days on Free, 90 days on Writer, without limit on Pro).

If you delete your account, we start a 30-day grace period after you confirm the request; after it, we permanently delete your account, projects, versions, story bibles, presets, AI history and uploaded files. Activity-log entries lose your user ID, email address and IP address. Billing records are kept as long as tax law requires. Unverified sign-ups are removed automatically.

Logs are kept for 30 days. Support messages are kept for 2 years after the request is closed.

Depending on where you live, you have the right to: access your data and get a copy; correct inaccurate data; delete your data; restrict its processing; object to processing based on our legitimate interests (and at any time to direct marketing, which we do not do); receive your data in a structured, commonly used, machine-readable format and have it passed to another provider; withdraw consent at any time where we rely on it (withdrawing does not affect processing done before); and complain to a data protection authority.

You can edit your profile and delete your account in the account settings, or email support@makestory.com. Requests are free of charge and we answer within one month; if a request is complex we may extend this and will tell you why. We may need to verify your identity before acting, and we will use the information you give us for verification only. If we correct, delete or restrict data, we tell the recipients we have shared it with, unless that is impossible or disproportionate; on request we tell you who they are. If we refuse a request, we explain why.

You can complain to your data protection authority (in Poland, the President of the Personal Data Protection Office (UODO), https://uodo.gov.pl). We would appreciate the chance to resolve your concern first.

Switzerland: you have the rights of access, objection (including restriction, deletion and blocking of disclosures), data portability and correction under the Swiss Federal Act on Data Protection. Requests are free and answered as soon as possible.

Brazil: under the LGPD you may confirm that we process your data, access it, correct it, ask for anonymization, blocking or deletion of unnecessary data, request portability, obtain information about who we share it with, revoke consent, object to unlawful processing and complain to the ANPD. We process data on the basis of contract, legitimate interests, legal obligation and, for analytics, your consent. We transfer data outside Brazil to carry out our contract with you and to provide the Service.

Strictly necessary storage is always on. Two secure, httpOnly cookies keep you signed in: an access token (valid for 30 days) and a refresh token (30 days, or up to 365 days if you choose to stay signed in). Your browser’s local storage remembers your cookie choice, the project type you picked at sign-up, and, on reading links, the name you last used to comment.

Analytics is optional and off until you accept it in the cookie banner. If you accept, we load Google Analytics (provided by Google), which sets cookies and sends your IP address, page views and device information to Google to tell us which pages are used. We do not use advertising cookies. You can change your choice at any time with “Cookie settings” in the site footer; rejecting or withdrawing stops analytics, and the site works the same either way. Details, including the cookie names, are in our Cookie policy (/cookies).

We use measures such as encrypted connections, hashed passwords, and access controls. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

MakeStory is not intended for anyone under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, email support@makestory.com and we will delete it.

We may use or disclose personal data to establish, exercise or defend legal claims, to respond to a valid request from a public authority, or to protect the rights, property and safety of MakeStory, our users or others, including where someone misuses the Service. Where the law allows, we will tell you before we disclose your data.

The Service and our public pages contain links to other sites, and shared books and blogs may contain links added by their authors. We are not responsible for the privacy practices of those sites; this policy applies only to MakeStory.

“Personal data” means any information that identifies, or can be used to identify, a person. “Controller” decides why and how personal data is used; “processor” handles it on the controller’s behalf. “Sale”, “sharing” and “targeted advertising” have the meaning given by applicable US state law; we do none of them. “Usage data” means information collected automatically, such as IP address, browser and device type, pages and features used, and the time of requests.

We will post changes here, update the effective date above, and notify you by email or in the Service before material changes take effect. Earlier versions are available on request at support@makestory.com.