Skip to content

Privacy Policy

Last updated: 2026-06-21 · alpha-grade content; reviewed before public launch.

What we collect

  • Account data: email address, display name (if you set one), and authentication tokens.
  • Content you create: requirements you submit, generated user stories, INVEST validation results, task breakdowns, effort estimations, and any edits you make.
  • Usage telemetry (only with your consent — see Cookies below): page views, generation events, export events, and aggregate Core Web Vitals via Vercel Analytics and Speed Insights.
  • Error reports (only with your consent): anonymised stack traces via Sentry to help us fix bugs.
  • Product analytics (only with your consent): funnel-shape event counts via PostHog. Autocapture is disabled — only named events fire.

Where it's stored

Account data and content are stored in Supabase (Postgres) in the EU (Frankfurt) region. The application itself is hosted on Vercel, served from EU edge locations. Telemetry is routed through PostHog EU (Frankfurt) and Sentry EU (Frankfurt).

AI-residency disclosure

Generation, validation, task breakdown, and estimation are powered by Google's Gemini 2.5 Flash and (as a fallback) Groq Llama 4 Scout. Both providers' APIs are US-region at the time of writing. When you submit a generation request, the requirement text and the returned stories transit US infrastructure on both providers.

We're tracking EU-region availability for both providers (e.g., Vertex AI for Gemini) and will migrate when it becomes viable without quality regression. This is documented as ADR-015 in our architecture decisions.

Free-tier Gemini API traffic may be retained by Google for model improvement, per their published policy. The same applies to free-tier Groq. We will move to paid tiers (which exempt this) before opening alpha to non-invited users.

How long we keep it

Account and content data: for the lifetime of your account. When you delete your account (see Your rights), everything cascades — sessions, stories, validations, tasks, estimations, and generation logs.

Sentry traces: 7-day retention on the free tier. PostHog events: 7-day retention on the free tier. Vercel Analytics: 30 days. If you reject analytics, no data flows to these processors in the first place.

Third-party processors

  • Supabase (auth + database + storage) — EU Frankfurt
  • Vercel (hosting + Analytics + Speed Insights) — EU edge
  • Sentry (error tracking, opt-in) — EU Frankfurt
  • PostHog (product analytics, opt-in) — EU Frankfurt
  • Google (Gemini) — US-region; AI inference only
  • Groq (Llama) — US-region; AI inference fallback only

Your rights

Under GDPR, you have the right to access, export, and delete your data. From your account page, you can:

  • Export all your data as a single JSON file
  • Delete your account and all associated data — this is irreversible and cascades to every row tied to your user id

Data captured before you accepted the consent banner (if any — alpha invitees prior to 2026-06-21) may persist in third-party processor logs until their retention window expires. We do not have the ability to retroactively remove it from vendor systems.

Cookies

We use a single first-party browser storage entry (storycraft.consent.v1, in localStorage) to remember your consent choice. This is a strictly-necessary item, exempt from consent rules. All other cookies / storage entries — set by Sentry, PostHog, and Vercel Analytics — fire only after you click Accept. If you click Reject or have not chosen, no third-party tracker is loaded.

Contact

Questions or requests: email privacy@storycraft.example (alpha placeholder — to be replaced with a real contact before public launch).