Privacy Policy and Notice
Storyvio · Notice version 1 · Last updated 27 October 2026 · हिन्दी में पढ़ें
Storyvio turns a line of text into a narrated, illustrated story video. This notice tells you what personal data we use, why, who receives it, how long we keep it, and your rights. Storyvio is available worldwide except, for now, the European Union, the EEA, the United Kingdom and Switzerland. This is our notice under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the DPDP Rules, 2025, which apply to everyone because we operate from India, and it also covers the EU and UK General Data Protection Regulation (GDPR) and the privacy laws of the other countries where the app is offered. Your rights below apply wherever you live. We do not show ads, we do not track you across other apps or websites, and we do not sell your data.
Who we are
Storyvio is run by Raj Bagri, an individual developer in India, who is the Data Fiduciary for your personal data. Contact: rajbagri3214@gmail.com.
Who can use Storyvio
Storyvio is only for people 18 or older. You confirm your age before you start. We do not knowingly process the personal data of anyone under 18; if we learn we have, we delete it. A parent or guardian who believes their child has used the app can write to us.
What we use, and why
We ask for your consent in the app before you sign in. We use each item only for the purposes listed with it.
| Personal data | Purpose | Kept |
|---|---|---|
| Sign-in details: account id and, if you share it, your email address (from Apple, Google or email sign-in) | Creating and running your account, credits and support | Until you delete your account |
| A one-way hash (a scrambled code) of your sign-in identity and email | Making sure the free story is given only once per person | Kept after account deletion, for this purpose only. It cannot be turned back into your email or name |
| Your iPhone's free-story mark (Apple DeviceCheck: one bit that Apple stores per iPhone) | Giving the free story only once per iPhone | Stored by Apple. It tells us nothing else about you or your device |
| Your story ideas, and the story text made from them | Writing, checking, painting and voicing your story; looking into abuse of the service | 30 days, then deleted automatically |
| Your finished story (its text, pictures and narration) | Getting it to your phone if the connection drops or the app is closed while it is being made | 24 hours, then deleted |
| Your finished videos, with each story's title, art style, length and date | Keeping a backup copy so your stories are not lost, and showing them again when you sign in on a new phone or reinstall the app | Until you delete your account |
| Credit balance and history; Apple transaction ids, and Razorpay order and payment ids, of purchases (we never see your card, UPI, bank or PayPal details) | Selling and tracking credits; handling refunds and fraud | Balance and history until you delete your account. Purchase records (transaction id, product, date, account id) for as long as Indian tax and accounting law requires, at most 8 years |
| On the website: your browser's time zone, and the country it points to | Showing and charging your country's price for credits | The country is kept with each purchase order, as part of the purchase record |
| On the website: a bot check by Google reCAPTCHA (Firebase App Check), which reads signals from your browser and device | Keeping bots and scripts away from story making, free credits and payments | Processed by Google under its Privacy Policy; we receive only a pass or fail |
| On the website: your sign-in, your unsent idea and story settings, and the id of a story being made, kept in your browser's own storage (no tracking or advertising cookies) | Keeping you signed in, and not losing a draft or a story if the tab closes | On your device, until you sign out or clear the site's data |
| Consent record: which notice version you agreed to, when, and your 18+ confirmation | Proving your consent, as the DPDP Act requires | Until you delete your account |
| Security and usage logs: request times, account id, request ids, errors; App Check results | Keeping the service secure, applying limits, finding and investigating misuse and data breaches | 1 year, as the DPDP Rules require |
We do not collect your contacts, precise location, photos, microphone or camera, and we do not store your name. When you buy on the website, the name and email of your sign-in are filled in for you in Razorpay's payment window. Videos you save to your photo library stay on your iPhone.
Who receives your data
These companies process data only on our instructions, to provide the service to us (Data Processors). None of them may use your story ideas or stories to train their AI models, and we do not either.
- Google (Firebase and Google Cloud): sign-in, database, server functions, and Google Cloud AI services for story writing, content checks and narration voices.
- Cloudflare: Cloudflare AI services for painting the pictures, and storing videos.
- Apple: Sign in with Apple, in-app purchases, DeviceCheck and App Attest.
- Razorpay (Razorpay Software Pvt. Ltd., India): payments for credits bought on the website. Razorpay collects your payment details itself under its privacy policy; for buyers outside India the payment may be made through PayPal, under PayPal's privacy policy. We receive only the payment's id, amount, currency and status.
The Storyvio website lets you sign in with Google or email, create story videos, buy credits, and see your stories and credit balance. It sends your idea and settings to the same secure server functions the iPhone app uses, and it asks for the same consent before your first story. The website can read only your own account, as enforced by Firebase security rules, and cannot change credits itself. The one-time welcome credits are given once per person, whether you start on the website or in the iPhone app. The website puts the video together in your browser and, where your browser makes an MP4 file, keeps a backup copy in your account like the app does, so it appears in My stories on the website and in the app.
We share personal data with government authorities only when Indian law requires it, for example under a lawful order.
Where your data is processed
We operate from India. Our servers are in the United States (Google Cloud, us-central1), and Cloudflare works through its global network. Your data is therefore transferred to the United States and other countries, which may not have the same data protection laws as yours. The DPDP Act allows this except to countries the Government of India restricts, and we will follow any such restriction. For people in the EU, EEA, UK and Switzerland, transfers to Google and Cloudflare are protected by the European Commission's Standard Contractual Clauses (and the UK addendum) in their data processing terms, and both companies are certified under the EU-U.S. Data Privacy Framework. Your data reaches us in India because it is necessary to provide the service you asked for (GDPR Art. 49(1)(b)).
How we protect it
- Data is encrypted in transit (HTTPS) and at rest.
- App requests are checked with Apple App Attest, and website requests are checked with Firebase App Check. Firestore rules deny all client writes and access to other users' data; credits and story costs are enforced by server functions.
- Access to the data is limited to the operator's own accounts, protected by two-step sign-in.
- Access and errors are logged and kept for a year so misuse can be detected and investigated.
If a personal data breach affects you, we will tell you without delay, through the app or by email, with what happened, what it means for you and what we are doing, and we will report it to the Data Protection Board of India within 72 hours.
Your rights
Under the DPDP Act you can:
- Get a copy of the personal data we hold about you, what we do with it, and who we share it with: in the app, Account → Get a copy of my data; on the website, Account → Download my data.
- Correct, complete or update it: write to us from the app (Account → Correct my data) or by email.
- Withdraw your consent at any time, as easily as you gave it: Account → Delete account, in the app or on the website. We then stop using your data and erase it, except what the law requires us to keep (listed above). Withdrawing does not affect what was done before. Without consent we cannot make stories for you.
- Erase your data: deleting your account deletes your account, credits, history, consent record, story ideas and stored videos. Stories saved on your iPhone are removed when you delete them in the app or delete the app.
- Nominate someone to exercise these rights for you if you die or become unable to: email us their name and contact details.
- Complain to our Grievance Officer (below). If you are not satisfied with the answer, you can complain to the Data Protection Board of India, or to the data protection authority where you live.
To act on a request we need your account id (shown in the email the app prepares) or the email you signed in with, and we may ask you to confirm the request from that account. We answer within 30 days, and in any case within the 90 days the DPDP Rules allow.
If you are in the EU, EEA, UK or Switzerland (GDPR)
Storyvio is not offered in these countries yet. If you use it there anyway, or once we launch there, this section applies. The controller of your personal data is Raj Bagri (contact above). We use your personal data on these legal bases:
- To provide the service you asked for (performance of a contract, Art. 6(1)(b)): your account, story ideas and stories, sending them to the AI services named above, videos, credits and purchases.
- Your consent (Art. 6(1)(a)), which you give on the notice screen before you start, for sending your story ideas to those AI services. You can withdraw it at any time.
- Our legitimate interests (Art. 6(1)(f)) in keeping the service secure and preventing abuse: security logs, limits, content checks, and the one-way hash that stops the free story being claimed twice. You can object to these.
- Legal obligations (Art. 6(1)(c)): keeping purchase records for tax and accounting.
Besides the rights above, you have the right to restrict or object to our use of your data, and to data portability: the copy in Account → Get a copy of my data is a machine-readable JSON file. You can complain to the data protection authority in your country, or in the UK to the Information Commissioner's Office. We answer requests within one month.
Story ideas are checked automatically for harmful content, and an idea that breaks our Terms is refused. This only decides whether a story is made, has no legal or similarly significant effect on you, and you can contact us if you think a refusal was wrong.
If you are in the United States
We do not sell or share your personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information. Wherever you live in the US, you can use the rights above (to know, correct and delete), and we will not treat you differently for doing so. Storyvio is not for children; we do not knowingly collect data from anyone under 18 (including under 13).
Other countries
If you live elsewhere (for example Brazil, Canada, Australia, Japan, Singapore or South Africa), you have the rights your local law gives you, which include at least the rights described above. Write to us to use them.
Grievance Officer
Raj Bagri · rajbagri3214@gmail.com · India
We acknowledge complaints within 24 hours and resolve them within 15 days. Requests to remove content that is illegal or
that shows you without your consent are acted on within the times Indian law sets.
AI-generated content
Every video Storyvio makes is labelled "AI-generated" on screen and carries an AI-generated tag with an id in the video file, as India's IT Rules and the EU AI Act require. Story ideas and stories are checked automatically for harmful content before and after writing, and requests that break our Terms are refused.
Changes
If we change this notice we update the date and version above. If the change affects what we collect, why, or who receives it, the app shows you the new notice and asks for your consent again before you make another story.