Privacy Notice
Last updated: 4 June 2026
1. Who we are
Storybored is operated by William Francis, a sole trader based in the United Kingdom. For the purposes of UK and EU data protection law, William Francis is the data controller for personal data collected through Storybored.
You can reach us at hello@storybored.online.
2. Personal data we collect
- Account data — email address, display name, hashed password or third-party sign-in identifier.
- Game content — story lines you write, room codes, co-writers in your rooms.
- Points & perk data — your points balance, perks unlocked and purchase history.
- Support communications — messages you send to us.
- Technical data — IP address, device and browser information, log timestamps, basic analytics.
3. How and why we use your data
| Purpose | Legal basis |
|---|---|
| Create your account and provide the game | Performance of a contract |
| Process points, perks and purchases | Performance of a contract |
| Keep the service secure, prevent fraud and abuse | Legitimate interests |
| Respond to support requests | Legitimate interests |
| Improve the product (aggregated analytics) | Legitimate interests |
| Send service announcements | Legitimate interests / contract |
| Comply with legal obligations (tax, accounting) | Legal obligation |
4. Who we share data with
- Paddle.com Market Ltd — our Merchant of Record. Paddle processes payments, manages subscriptions, calculates tax and issues invoices on our behalf.
- Hosting and infrastructure providers — cloud hosting, database, authentication and storage providers used to run Storybored.
- AI providers — when you use the AI illustration feature, the prompt derived from your story is sent to our AI provider to generate the image.
- Professional advisers — legal and accounting advisers, where strictly necessary.
- Authorities — where required by law, court order or to protect our rights.
5. International transfers
Some of our providers are based outside the UK / EEA. Where this is the case, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses or an adequacy decision.
6. Data retention
We keep your personal data only for as long as needed for the purposes above. Account and game data is kept while your account is active and for a reasonable period afterwards in case you wish to reactivate. Purchase records are kept for as long as required by tax and accounting law (typically 6 years). We then delete or anonymise the data.
7. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- request correction of inaccurate data;
- request erasure of your data;
- restrict or object to certain processing;
- data portability;
- withdraw consent where processing is based on consent;
- complain to your supervisory authority — in the UK that is the ICO.
To exercise these rights, email us at hello@storybored.online. We will respond within one month.
8. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and regular review of our providers.
9. Cookies
We use essential cookies and local storage to keep you signed in and to remember your preferences. We do not use advertising cookies. Our payment provider Paddle may set its own cookies during checkout.
10. Changes
We may update this notice from time to time. Material changes will be announced in-app.