Privacy Policy

1. Information we collect

Account information. When you create an account we store your name, email address and a password hash. If you sign in with Google we receive your name, email address and profile picture from Google and store your Google account identifier so we can recognise you next time. We never receive your Google password.

Content you create. Scripts, story trees, clip descriptions, timelines and any images, audio or video you upload or generate through connected tools are stored so that we can show them back to you and play your project. Your content belongs to you.

Integration credentials. If you connect an AI agent (for example Cursor or Codex) through our MCP server, we store the API keys or OAuth tokens you create so that those tools can act on your behalf. You can revoke them at any time from your Account page.

Technical data. Like most web services we receive your IP address, browser type and basic request logs when you use the site. We use this for security, debugging and abuse prevention only.

2. How we use information

• To provide, operate and improve StoryForge, including playing back your projects and syncing live sessions.
• To authenticate you and keep your account secure.
• To send transactional email such as email verification, password resets and important service notices. We do not send marketing email without your consent.
• To respond to support requests sent to [email protected].

We do not sell your personal information and we do not use your stories or media to train machine-learning models.

3. Google user data

Signing in with Google requests only your basic profile (name, email address and profile picture). We use this data solely to create and sign you into your StoryForge account. StoryForge's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not request access to your Gmail, Drive, Calendar or any other Google data.

4. Cookies

We use a small number of strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. We do not use third-party advertising or tracking cookies.

5. Where your data lives and who can see it

StoryForge runs on DigitalOcean (database and application servers) and stores uploaded media in DigitalOcean Spaces. Transactional email is delivered through Resend. These providers process data on our behalf under their own security commitments. Media files are served through signed or public CDN URLs that are only reachable by people who have the link; project data is only visible to the account that owns it.

We disclose information only when required by law, to protect the rights or safety of StoryForge and its users, or with your direction (for example when you connect a third-party AI tool).

6. Retention and deletion

We keep your account and content for as long as your account exists. You can delete projects, media and integration tokens yourself at any time. To delete your account and all associated data, email [email protected] from the address on the account and we will complete the deletion within 30 days. Backups are rotated on a schedule and purged automatically.

7. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal information, or to object to certain processing. You can exercise most of these rights directly in the app; for anything else, contact us and we will help.

8. Children

StoryForge is not directed at children under 13 (or the minimum age in your jurisdiction) and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will remove it.

9. Changes and contact

We may update this policy as StoryForge evolves. Material changes will be announced in the app or by email before they take effect. Questions about privacy can be sent to [email protected].