Privacy Policy

StoryHop is operated by Aleksandr Gorin. Aleksandr Gorin is the controller responsible for StoryHop.

Controller: Aleksandr Gorin, StoryHop, Käthe-Kollwitz-Str. 10b, 14943 Luckenwalde, Germany

Privacy contact: privacy@storyhop.io

Support contact: support@storyhop.io

Contact form: https://storyhop.io/contact

Further legal provider information is available in the Impressum.

We have not appointed a Data Protection Officer. You can contact us about privacy at privacy@storyhop.io.

This policy applies to the StoryHop website at storyhop.io: its public pages, parent accounts, child profiles, the parent area, child-device sign-in on the website, StoryHop Plus subscriptions bought on the website, the contact form, support, and emails we send in connection with the website.

Your StoryHop account is the same on the website and in the StoryHop apps for iOS and Android. Data that is processed only in an app, such as purchases through the App Store or Google Play and scanning sign-in QR codes in the app, is described in that app's privacy policy: https://storyhop.io/en/legal/ios/privacy and https://storyhop.io/en/legal/android/privacy.

The website can be used from any country. StoryHop is offered in the European Union, the European Economic Area, Switzerland, Armenia, Georgia, Moldova, Serbia, and Ukraine. On the website, StoryHop Plus can be bought in the countries where purchases through Link are available (see section 5).

StoryHop is designed for children aged 6 to 15. Accounts are held by adults: the person who creates an account confirms that they are 18 or older and a parent or legal guardian. Parents or legal guardians create and manage child profiles. Children cannot access parent settings.

StoryHop does not currently provide school, classroom, or teacher accounts.

Anyone can read some stories and try riddles on the public pages of the website without an account.

Parents create a StoryHop account and may create child profiles. In the parent area, a parent can create a one-time QR code and sign-in link that signs a child's device in to StoryHop without giving the child a username or password.

StoryHop stores each child's progress so parents can see reading activity, so a child can continue reading on another device, and so StoryHop can recommend similar stories.

StoryHop has free features and an optional paid subscription, StoryHop Plus, which unlocks additional content such as more stories, collections, and riddle themes. A subscription belongs to the parent account and applies to every child profile on that account, on the website and in the apps, wherever it was bought. It can be bought on the website, in the StoryHop app for iOS through Apple, and in the StoryHop app for Android through Google Play, and only by a parent. An account can have only one subscription at a time.

Every visitor, with or without an account:

• when your browser connects to our servers, our servers record technical request information, which can include your IP address, browser and device information, and the address requested, to operate and secure the website. These server request logs are deleted after 14 days;
• your choice in the cookie banner, stored only in your browser (see section 15);
• with your consent, Google Analytics data (see section 6);
• on public story pages, the page you reached in a story, stored only in your browser and not sent to StoryHop;
• on the public riddles page, your answer is checked in your browser and is not sent to StoryHop;
• if you use the contact form: your email address, the topic, your message, and the language of the page;
• if you email one of our storyhop.io addresses: your email address, the recipient addresses, the subject, the text of the email, and the names of any attachments.

Parent account data:

• email address and name (if you use Sign in with Apple and hide your email, we receive Apple's relay address instead);
• your password, stored only as a secure hash, or the identifier we receive from Google or Apple if you sign in with them;
• your parent PIN, stored only as a secure hash; if you reset the PIN by email, the one-time code we send you, stored only as a secure hash and valid for 10 minutes;
• sign-in sessions and settings such as language and sound;
• when the account last started or renewed a sign-in session, and when we sent a notice before deleting an inactive account (see section 18);
• if you buy StoryHop Plus on the website, the ID of the customer record Stripe keeps for your account (see section 5);
• a random account token used to match App Store and Google Play purchases to your account (see section 5);
• consent and confirmation records (see section 7);
• support messages and privacy requests you send us.

Child profile data:

• the name or nickname the parent types in;
• age (6 to 15);
• avatar;
• reading level, which StoryHop may adjust automatically based on completed stories and quiz results;
• interface language and content language;
• whether reading reminders are turned on.

Learning activity for each child profile:

• stories finished and quiz answers;
• the page a child last reached in a story, so the child can continue on another device (see section 18);
• riddle rounds and whether each answer was correct (the answer the child types is sent to our server to check it, but only the result, correct or incorrect, is stored);
• XP, levels, badges, streaks, and reading statistics;
• reading history shown in the parent area;
• when the child last finished a story (see section 13).

Subscription and purchase data, if you use StoryHop Plus, is described in section 5. Analytics is described in section 6.

Parents should avoid entering a child's real name unless they choose to do so. StoryHop does not require child email addresses, phone numbers, postal addresses, photos, voice recordings, or location data.

Story images, such as covers and illustrations, are stored at Cloudflare, in storage controlled by StoryHop in the European Union, and delivered through Cloudflare's network. When the website shows an image, your browser connects to Cloudflare, which processes your IP address and technical request information, such as the requested image, the time, and browser information, to deliver the image and secure this traffic (see sections 16 and 17). These requests contain no account, child profile, or learning data.

The website also processes sign-in session data and the sign-in link used for child-device sign-in. The website does not ask for permission to use device features such as location, microphone, photos, or contacts, and it does not use advertising identifiers or advertising cookies.

StoryHop Plus can be bought on the website, in the StoryHop app for iOS, and in the StoryHop app for Android. An account can have only one subscription at a time. StoryHop Plus bought anywhere works on the website and in the apps, for every child profile on the account.

Wherever you bought it, we keep a subscription record linked to your parent account: the plan and, if it changes, the plan for the next period, the subscription status, whether a free trial applies, whether the subscription will renew, purchase and expiry dates and the end of any billing grace period, whether it is a test or real purchase, where it was bought, the identifier of the subscription at the payment provider (for the website, the Stripe subscription ID), when we last checked the subscription with the provider, and when we sent the reminder before a free trial ends. We use this record to give your account access to StoryHop Plus on the website and in the apps, to show the subscription in the parent area, and to prevent one account from holding two subscriptions or one purchase from being claimed by several accounts. If one StoryHop account has two active subscriptions at the same time, we mark the subscription records for manual review.

Subscription data is linked to the parent account, not to a child profile. We do not send Stripe, Link, Apple, or Google any information about child profiles, such as names, ages, or reading activity.

Purchases on the website:

Purchases on the website are made through Link, a Stripe service ("Sold through Link"), under Link's terms (https://link.com/terms). Link accepts the payment, sends receipts and invoices, and handles payment support. Stripe calculates and pays the taxes and handles disputes.

Only a parent can buy StoryHop Plus on the website: you must be signed in, have entered the parent PIN, and have verified your email address. The purchase is made on the payment page in the parent area. The payment form on that page is provided by Stripe and shown inside our page. What you enter in the payment form goes directly to Stripe and Link, not to our servers.

Before we open the payment form, we check in our records and with Stripe whether your account already has StoryHop Plus and whether it has had a StoryHop Plus subscription before, on any platform, to decide whether a free trial applies.

When you start a purchase, our server sends Stripe:

• the first time you buy: your account email address and your internal StoryHop account ID, so that Stripe creates one customer record for your StoryHop account;
• for each payment page: the ID of that customer record, your internal StoryHop account ID, the plan, whether a free trial applies, the language of the page, and the website address to return to after payment.

In the payment form, you enter your payment details. Depending on your country and payment method, Link and Stripe ask for your email address, name, country and billing address, and card or wallet details, and your phone number if you create a Link account. Payment methods include cards, Apple Pay, Google Pay, Link, and, depending on your country, local payment methods. Stripe may show the price in your local currency. If you pay with Apple Pay or Google Pay, Apple or Google also processes the payment under its own terms. While the payment form is open, Stripe's script on the payment page collects information about your device and how you use the page to protect payments against fraud (see section 15).

Stripe then informs our server about your subscription, and our server checks it with Stripe. We use the IDs of the Stripe customer record and the subscription, the subscription status, the free trial, the dates of the current billing period, whether the subscription will renew, the plan for the next period, and refunds and disputes of payments. Stripe's notifications and answers can also contain other details, such as your name, email address, billing address, and the amount and currency; our server does not store them. We use this information to give and remove access to StoryHop Plus, to show the subscription in the parent area, and to answer support requests.

We store the Stripe customer ID with your account and keep the subscription record described above. We do not store your name, billing address, country, card or bank details, or the amount and currency you paid, and we do not keep Stripe's notifications.

You manage a subscription bought on the website on the Subscription page of the parent area, after entering the parent PIN. Changing the plan, changing the card, cancelling, and viewing receipts open Stripe's customer portal, a page hosted by Stripe. To open it, our server sends Stripe the ID of your customer record, the language, the website address to return to, the screen to open, and, where that screen needs it, the ID of your subscription. You can also manage the subscription at link.com.

Link and Stripe send their own emails about website purchases, such as confirmation of a free trial, receipts and invoices, refund notices, a reminder before each yearly anniversary of the subscription, notices about an expiring card or a failed payment, and links to confirm a payment. These emails come from Link, not from StoryHop.

Link and Stripe process your purchase and payment data as independent controllers under their own privacy policies: https://link.com/privacy and https://stripe.com/privacy. Stripe also keeps the customer and subscription records in our Stripe account on our behalf, under Stripe's data processing agreement.

If you ask Link to delete your data, Stripe immediately cancels all subscriptions you bought through Link, including StoryHop Plus, so your access to StoryHop Plus ends at once. Stripe deletes your data from the records in our Stripe account and informs us, and we remove the Stripe customer ID from your StoryHop account.

Reminder before a free trial ends:

If your subscription is in a free trial and set to continue as a paid subscription, we email you a reminder, usually about two days before the trial ends. We send it for free trials on the website, in the App Store, and in Google Play. It goes to the email address of your StoryHop account, in the language set for your account, through our email provider Resend (see section 16). It states the plan, the date the trial ends, who bills the subscription (for the website: Link, a Stripe service), and how to cancel. It contains no price and no child profile data. If you cancel the free trial before then, no reminder is sent. We send one reminder per free trial and note in the subscription record when we sent it, so it is not sent twice.

Purchases in the StoryHop apps:

If you buy StoryHop Plus in the iOS app, Apple takes the payment; in the Android app, Google Play takes the payment. A random account token links the purchase to your account, and Apple and Google Play inform our server about the subscription. The details, including the notifications we receive and how long we keep them, are described in the privacy policies of the apps: https://storyhop.io/en/legal/ios/privacy and https://storyhop.io/en/legal/android/privacy. The website receives from our server only the status of your account's subscription and shows it in the parent area. You manage and cancel such a subscription in the store where you bought it.

Deleting your StoryHop account cancels a subscription bought on the website, but not a subscription bought in an app. See section 19.

The website contains no advertising. It uses Google Analytics only with your consent, and never on pages a child uses or on the payment pages.

Google Analytics:

With your consent, the website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how the public pages and the parent area are used, for example which pages are visited and how visitors find StoryHop, so that we can improve the website.

Google Analytics is loaded only after you allow Analytics in the cookie banner. Until then, and if you choose Reject optional, no Google Analytics code is loaded and no analytics cookies are set.

When you consent, your browser loads Google's script from googletagmanager.com, and Google Analytics sets cookies with a random identifier for your browser (see section 15). For each page you open, we send Google the page address without anything after "?", so that email addresses or codes contained in links are not sent, and the page title. We do not send child profile identifiers to Google Analytics: addresses of parent-area pages about a single child are sent without the child profile's internal ID. Google Analytics also records the start of a visit and how long pages are in use, and information about your browser and device, such as browser type, language, screen size, the referring page, and an approximate location derived from your IP address. We have turned off Google Analytics' optional automatic measurement of page changes, scrolling, clicks on links to other websites, site search, file downloads, videos, and forms.

We do not use Google Analytics for advertising. Consent for advertising storage, ad user data, and ad personalisation is always set to denied. Google signals is turned off, and Google Analytics is not linked to Google advertising products.

There is no cookie banner and no Google Analytics on pages a child uses: the library and collections, the reader and quiz, riddle rounds, progress, the "Who is reading?" profile picker, child settings, parent PIN entry and PIN reset, the child sign-in page, and the legal pages of the StoryHop apps. There is also no cookie banner and no Google Analytics on the payment page and on the page you return to after paying. If Google Analytics was already loaded earlier in the same visit, it is switched off on these pages.

Google Analytics can run on the public pages of the website, including public story pages, on the sign-in pages, and in the parent area, including the Subscription page, if the visitor has consented.

The legal basis is your consent (section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 6(1)(a) GDPR). You can withdraw consent at any time with Cookie settings in the website footer or in the parent area under Privacy. Google Analytics cookies are then removed from your browser and no further data is sent.

Google processes this data on our behalf under Google's data processing terms. Google may transfer data to the United States (see section 17). Google Analytics keeps event-level data linked to the analytics cookie for 2 months and then deletes it. Aggregated reports, which are no longer linked to a cookie or a browser, are kept without a time limit.

Paywall statistics in the StoryHop apps:

The StoryHop apps record a small set of events about the StoryHop Plus offer screen (the paywall) on our own servers, as described in the apps' privacy policies. The website does not send these events, including from its own subscription and payment pages.

When you create a child profile on the website, you can allow these events for that profile. The choice applies to that profile in every StoryHop app. Each event contains only the type of event, where it happened, the internal ID of the child profile, and the time. Events are never used for advertising and are deleted automatically 90 days after we receive them. If you do not consent, no events are stored for that profile.

The website has no switch to change this choice later. You can withdraw this consent in the parent area of a StoryHop app under Privacy, or by contacting privacy@storyhop.io. After you withdraw consent, no further events are stored for that profile; events already stored are deleted after the 90 days, or earlier if you ask us. Deleting the child profile or your account also deletes the stored events of that profile.

On the website, StoryHop asks for the following:

• the Terms of Use and this Privacy Policy: when you create an account on the website, with an email address and password or by continuing with Google or Apple, you accept the Terms and acknowledge this policy. If you have not accepted the current website versions, for example because you created your account in an app or because we published a new version, the website asks you to accept the Terms and confirm that you have read this policy (see section 23). On a device signed in with a child sign-in link, this request is shown only in the parent area, after the parent PIN has been entered;
• adult confirmation: required, once per account, after the account is created. You confirm that you are 18 or older and a parent or legal guardian. Child profiles cannot be created without it;
• parent confirmation for each child profile: required, when the profile is created. You confirm that you are the child's parent or legal guardian and authorise StoryHop to create the profile and process the child's data described in section 4 to provide StoryHop. The profile cannot be created without it;
• paywall statistics for each child profile: optional consent, when the profile is created (see section 6);
• cookies and Google Analytics: optional consent in the cookie banner (see sections 6 and 15).

Emails about new stories are an optional consent for the account. The website does not ask for it. You can give it in the parent area of a StoryHop app under Privacy, and withdraw it there or by contacting privacy@storyhop.io (see section 14).

The parent confirmation for a child profile authorises StoryHop to provide the service for that child. Under GDPR, the child profile data needed to provide StoryHop is processed to perform our contract with you, not on the basis of consent (see section 10).

For each choice except the cookie banner, we store whether it was given or refused, the time, the language, the edition of the legal documents shown (for the website: web), the version of the wording shown to you, and the versions of the Terms and this Privacy Policy shown to you. We keep these records so we can show what was agreed and when. Your choice in the cookie banner is stored only in your browser, in the storyhop_cookie_consent cookie, and not on our servers.

Consent and confirmation records are deleted together with the child profile or account they belong to.

StoryHop uses AI tools internally to prepare and improve content, including rewriting stories, adapting stories to reading levels, translating stories or variants, categorizing content, and generating illustrations.

StoryHop currently uses OpenAI for text-related content processing and Google for illustration generation.

StoryHop does not allow parents or children to enter custom free-text prompts for AI generation. StoryHop sends only StoryHop story and content materials to AI providers, not child profile data, parent account data, progress data, quiz answers, or reading history.

Generated illustrations are reviewed by a human before children can see them. Approved illustrations are stored at Cloudflare in storage controlled by StoryHop and delivered to the website through Cloudflare's network.

We process personal data to provide the public pages of the website, create and manage parent accounts and child profiles, authenticate parents and child devices, provide stories, collections, quizzes, riddles, and progress tracking, let a child continue reading on another device, show parent progress reports, recommend similar stories, provide and manage StoryHop Plus subscriptions, including purchases on the website made through Link, record consents and confirmations, understand how the website is used (with consent), operate and secure the service, answer contact form messages, emails, and requests, send service emails, let parents set reading reminders for the StoryHop apps, send parent marketing emails with consent, generate and moderate StoryHop content, and comply with legal obligations.

StoryHop does not make decisions based solely on automated processing that have legal effects on you or your child or similarly significantly affect you (Article 22 GDPR). The automatic reading-level adjustment only changes which stories and story versions are offered, and parents can see and change the reading level.

We rely on the following legal bases under the GDPR.

Contract (Article 6(1)(b) GDPR) covers providing the parent account, child profiles, and the core service for each child: reading progress, the page reached in a story, stories read, quiz and riddle results, XP, badges, streaks, reading level, and the statistics shown in the parent area. It also covers sign-in and child-device sign-in, service emails such as email address verification, password reset, and parent PIN reset codes, support, and StoryHop Plus, including opening the payment form and Stripe's customer portal for a purchase on the website, checking purchases with Stripe, Apple, and Google Play, keeping access in line with the subscription status, and the reminder before a free trial ends. This data is needed to provide StoryHop and is not optional. Reading reminders for a child profile are optional; if a parent turns them on, they are also part of this contract. When a parent creates a child profile, the parent concludes this contract for the child's benefit. Where the child is not treated as a party to that contract, we process the child profile data listed above because we and the parent have a legitimate interest in providing the service the parent chose for the child (Article 6(1)(f) GDPR). You can object at any time (see section 21).

The required parent confirmation given when a child profile is created (see section 7) is not the legal basis for this processing under GDPR. It confirms that the parent is authorised to set up the profile.

Consent (Article 6(1)(a) GDPR) covers Google Analytics, marketing emails, and paywall events linked to a child profile. For Google Analytics, and for paywall events sent from a device, consent is also required by section 25(1) TDDDG. All of these are optional. If consent is not given, Google Analytics is not loaded and paywall events are not stored.

Legitimate interests (Article 6(1)(f) GDPR) cover securing the service and keeping server request logs, delivering story images quickly and securely through Cloudflare, preventing misuse such as two subscriptions on one account or one purchase being claimed by several accounts, handling refunds and payment disputes for purchases on the website, also after an account is deleted, sending a notice when a password is set for your account or changed and when your parent PIN was reset, sending a notice before an inactive account is deleted, answering contact form messages and emails, keeping records of the confirmations described in section 7, and loading Google's and Apple's sign-in scripts on the pages that offer sign-in with them, so that these sign-in options work (see section 15).

Fraud prevention in the payment form is carried out by Stripe as an independent controller under its own privacy policy (see section 5).

Legal obligation (Article 6(1)(c) GDPR) covers keeping records that show consent was given, and handling privacy requests under sections 21 and 24.

Storing or reading information in your browser that is necessary to provide the website you requested, such as keeping you signed in, Stripe's fraud protection on the payment page, and the sign-in scripts of Google and Apple, is permitted without consent under section 25(2) no. 2 TDDDG (see section 15).

You may withdraw consent at any time. Withdrawal does not affect processing that happened before withdrawal.

StoryHop is parent-managed. Parents create accounts, create and confirm child profiles, and control child access. The parent area is protected by a parent PIN, and on the website it closes after 5 minutes without activity.

On the website, parents can view child progress and reading history, create, edit, or delete child profiles, create child sign-in links, set reading reminders for each child profile, buy and manage StoryHop Plus, change cookie settings, and delete the parent account. Switches for paywall statistics and marketing emails are available only in the StoryHop apps. Parents can contact us to request a copy of parent and child-profile data, or to review, correct, or delete child-related personal data.

Children cannot access parent settings. Pages a signed-in child uses show that some content is locked, but no prices or purchase buttons; a child can only ask a parent, and the Subscription page opens only after the parent PIN. Only a parent can buy StoryHop Plus on the website, after entering the parent PIN and with a verified email address. We do not send Stripe or Link any child profile data.

There is no cookie banner and no Google Analytics on pages a child uses (see section 6).

StoryHop does not sell child data, use child data for behavioral advertising, or knowingly allow child profile data to be used to create advertising profiles.

Parents may create a child sign-in QR code and sign-in link in the parent area. The link contains a one-time six-digit code, and the QR code contains the same link. The child's device opens the link, for example by scanning the QR code.

A code can be used once and expires after 5 minutes. We store only a secure hash of it, together with the account and child profile it belongs to, and delete it within 24 hours after it expires. After successful sign-in, the device receives a session for the parent account with the selected child profile opened, and the code is removed from the address shown in the browser. Parent settings on that device remain protected by the parent PIN.

Each signed-in browser has its own session, made up of an access token, valid for 14 days and kept in a cookie, and a refresh token, valid for 30 days and kept in the browser's local storage (see section 15). The website renews the session with the refresh token, which is replaced each time it is used. A browser that does not connect to StoryHop for 30 days has to sign in again.

Logging out in a browser removes that browser's refresh token and ends parent PIN authorisation there. Resetting your password removes the refresh tokens of all browsers and devices. A browser or device that already holds a valid access token can stay signed in until that token expires, at most 14 days.

Parent PIN authorisation is separate from the sign-in session and lasts up to 15 minutes. On the website it is kept only for the current browser tab, and the parent area closes after 5 minutes without activity.

The website does not send push or browser notifications and does not ask for permission to show them.

In the parent area of the website, you can also turn on reading reminders for each child profile. They are off unless you turn them on, and are sent every day at 18:00 in the time zone of the device. We store this setting with the child profile. Reminders are sent only to the StoryHop apps, to devices where that child's profile was the last child profile opened; the privacy policy of each app describes how. If a child finishes a story on the website, no reminder is sent for that child that day.

StoryHop sends marketing emails only to parents or guardians who separately opt in.

Marketing consent is optional, separate from account creation, and does not affect how StoryHop works. The website does not ask for it. You can opt in or withdraw in the parent area of a StoryHop app under Privacy, after your email address has been verified.

We have not started sending marketing emails yet. When we do, every marketing email will include an unsubscribe link. You can also withdraw consent at any time by contacting privacy@storyhop.io.

Service emails are sent regardless of marketing consent: email address verification, password reset, a notice when a password is set for your account or changed, parent PIN reset codes, a notice after your parent PIN was reset, the reminder before a free trial ends (see section 5), and a notice before an inactive account is deleted. For purchases on the website, Link and Stripe send their own emails, such as receipts and invoices (see section 5). We also reply to messages you send us.

The website stores small pieces of information in your browser: cookies, and data in the browser's local storage and session storage. Local storage stays until it is removed; session storage is removed when you close the browser tab.

Necessary storage, used without consent because it is needed to provide the website you requested (section 25(2) no. 2 TDDDG):

• storyhop_cookie_consent (cookie, 6 months): remembers your choice in the cookie banner;
• storyhop_access_token (cookie, up to 14 days): keeps you signed in;
• storyhop_email_verified (cookie, 30 days): remembers whether the signed-in account has verified its email address, so the website shows the right pages;
• two Stripe cookies (cookies, 1 year and 30 minutes; their names are listed in Cookie settings): set by Stripe's script, only on the payment page, to protect payments against fraud (see below);
• storyhop_refresh_token (local storage, until you log out): renews your sign-in session;
• storyhop.child_device_session (local storage, until you log out or a parent signs in): marks a browser signed in with a child sign-in link, so that parent-only prompts appear only after the parent PIN;
• storyhop_selected_profile_id (local storage, until you log out or choose another profile): the child profile currently selected;
• storyhop_settings (local storage): a copy of settings such as sound on or off;
• storyhop_avatar_onboarding_seen, one entry per child profile (local storage): whether the child was already offered the avatar builder in this browser;
• storyhop_public_progress, one entry per story and language (local storage): the page reached in a public story when reading without an account;
• storyhop_parent_authorization and its expiry time (session storage, at most 15 minutes): parent PIN authorisation;
• storyhop_pin_reset_code_requested_at (session storage): when you last asked for a parent PIN reset code in this tab, so that opening the reset step again uses the code already sent instead of requesting a new one;
• storyhop_billing_portal_snapshot (session storage): a copy of your subscription status (status, plan, expiry date, whether it is a free trial and will renew, where it was bought, and the end of any gifted StoryHop Plus), saved when you open Stripe's customer portal and removed when you come back, so the Subscription page can show when your change has arrived;
• quiz and riddle round state (session storage): the current quiz or riddle round, removed when the round ends;
• storyhop.legal_acceptance_later (session storage): remembers that you chose Later on the screen asking you to accept new Terms.

Analytics storage, used only with your consent (section 25(1) TDDDG), see section 6:

• two Google Analytics cookies, one of them named after our measurement ID (cookies, up to 2 years; their names are listed in Cookie settings): distinguish browsers and store the Google Analytics session;
• a short-term Google Analytics cookie (cookie, 24 hours), if Google Analytics sets it: distinguishes browsers for short-term statistics.

Cookies are sent along with requests to storyhop.io. Our servers use the access token and email-verification cookies; the refresh token is sent to our servers only to renew or end a session. The other entries in local and session storage stay in your browser.

You can change your cookie choice at any time with Cookie settings in the website footer or in the parent area under Privacy. Deleting the website's data in your browser settings removes all of the above and signs you out.

Payment page:

Stripe's script (from js.stripe.com) is loaded only on the payment page in the parent area, and only after our server has opened a payment session for you. It shows Stripe's payment form inside our page. To protect payments against fraud, it collects information about your device and how you use the page, such as browser, screen, mouse movements, and time spent on the page, and sends it to Stripe (m.stripe.com). It may also show a security check by hCaptcha. It sets the Stripe cookies listed above on storyhop.io. Inside the payment form, and on Stripe's customer portal and link.com, Stripe and Link use their own cookies on their own domains under their privacy policies. Stripe processes this information as an independent controller (see section 5). These cookies and this information are necessary for the payment you requested; they are used without consent and only on the payment page (section 25(2) no. 2 TDDDG).

Sign-in with Google and Apple:

On the sign-in and registration pages, and in the steps where you confirm your identity, such as resetting the parent PIN or setting or changing your account password, if your account is linked to Google or Apple, the website loads Google's sign-in script from Google's servers and Apple's sign-in script from Apple's servers (appleid.cdn-apple.com). The scripts load when these pages or steps open, before you click a button, so that the buttons work. Google and Apple then receive your IP address and browser information, even if you do not use their buttons, and may use their own cookies on their own domains under their privacy policies (see sections 10 and 16).

We share personal data only where needed to operate StoryHop, comply with law, or protect the service.

Service providers that process personal data on our behalf and under our instructions (data processing agreements under Article 28 GDPR):

• DigitalOcean: hosting of the website, our servers, our managed database, and backups in Frankfurt, Germany;
• Resend: sending service emails from info@storyhop.io, currently email address verification, password reset, notices that a password was set or changed, parent PIN reset codes, notices that a parent PIN was reset, reminders before a free trial ends, and notices before an inactive account is deleted, and receiving emails sent to our storyhop.io addresses;
• Google Ireland Limited: Google Analytics, only with your consent (see section 6);
• Stripe: keeping the customer and subscription records in our Stripe account for purchases on the website (see section 5);
• Cloudflare: storing story images and delivering them to the website through its content delivery network, which includes processing your IP address and technical request information when your browser loads an image (see section 4). No account, child profile, or learning data is stored at Cloudflare.

Independent controllers, which process data under their own terms and privacy policies when you use their services:

• Stripe and Link: purchases of StoryHop Plus on the website, payments, taxes, receipts, refunds, disputes, payment support, and fraud prevention in the payment form (see section 5);
• Apple: purchases and payments in the iOS app, subscription notifications and status checks, and Sign in with Apple;
• Google: purchases and payments through Google Play in the Android app, subscription notifications and status checks, and Google Sign-In, only if you choose to sign in with Google.

Google and Apple also receive technical information from your browser when their sign-in scripts load (see section 15). The service providers we use only for purchases in the apps are described in the apps' privacy policies.

AI providers used for content preparation (see section 8) receive only StoryHop story and content materials, not personal data.

We do not sell personal data or share it for targeted advertising.

StoryHop is operated from Germany. Our website, servers, database, and backups are hosted by DigitalOcean in Frankfurt, Germany.

Resend may process the emails it sends and receives for us in the United States. This transfer is based on Resend's certification under the EU-U.S. Data Privacy Framework and on the European Commission's Standard Contractual Clauses (controller to processor), which Resend's data processing agreement also applies to transfers from Switzerland.

DigitalOcean is a US company. Where DigitalOcean accesses data from outside the EU, this is based on its certification under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, with the Standard Contractual Clauses as a fallback.

Cloudflare is a US company with data centres in many countries. An image request is usually answered by a Cloudflare data centre near your device. When your device is outside the EU, for example in Armenia, Georgia, Moldova, Serbia or Ukraine or while you travel, this data centre is usually outside the EU too. Cloudflare can also store the request data in its central systems in the United States. Where Cloudflare processes this data outside the EU, this is based on the Standard Contractual Clauses in Cloudflare's data processing agreement and, for the United States, on Cloudflare's certification under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework.

Google may transfer Google Analytics data to Google LLC in the United States. This transfer is based on Google LLC's certification under the EU-U.S. Data Privacy Framework and on the Standard Contractual Clauses in Google's data processing terms.

Stripe processes purchases on the website through Stripe companies in Ireland and the United States. Stripe, LLC is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, and Stripe also uses the Standard Contractual Clauses.

Apple and Google, as sign-in and app-store providers, transfer data as independent controllers under their own safeguards.

If you live in Armenia, Georgia, Moldova, Serbia or Ukraine, your data is sent to our servers in Germany; the data protection law of each of these countries recognises Germany as providing an adequate level of protection. Transfers to our service providers in the United States are based on the safeguards described above.

You can request a copy of the safeguards we use from privacy@storyhop.io.

We keep personal data only as long as needed for the purposes described in this policy.

• parent account data, including sign-in sessions, the random account token, and the Stripe customer ID: until you delete your account, or until an inactive account is deleted; the Stripe customer ID is removed earlier if you ask Link to delete your data (see section 5);
• child profiles and their learning activity: until you delete the child profile or your account, or until an inactive account is deleted;
• the page a child reached in a story: deleted automatically 90 days after it was last updated, or earlier when the child profile or account is deleted;
• inactive accounts: if an account has not started or renewed a sign-in session on any device or browser for 24 months, and it has no StoryHop Plus subscription that still gives access (active, in a free trial, or in a billing grace or retry period), we email the parent once. Unless someone signs in by the date given in the email, 30 days after the email, we delete the account in the same way as described in section 19. If our email provider rejects the email address when we try to send the email, the account is not deleted automatically; we review it manually;
• consent and confirmation records: until the child profile or account they belong to is deleted;
• subscription record: while your account exists; the Stripe subscription ID is removed 90 days after the subscription has ended and Stripe last reported on it, or immediately when you delete your account; after account deletion, only the record described in section 19 is kept. The identifiers of App Store and Google Play purchases are kept as described in the apps' privacy policies;
• notifications from Stripe about purchases on the website: not stored; our server uses them only to update the subscription record;
• notifications from Apple and Google Play about purchases in the apps: as described in the apps' privacy policies;
• paywall events: deleted automatically 90 days after they are received, or earlier when the child profile or account they belong to is deleted;
• server request logs: deleted after 14 days;
• messages sent through the contact form (https://storyhop.io/contact) and emails sent to our storyhop.io addresses: deleted automatically from our database 90 days after they are received; for privacy requests, we keep a short record of the date, type of request, and outcome to show how we handled it;
• email delivery records at our email provider Resend: kept according to Resend's retention period, currently 30 days;
• image request data at Cloudflare (see section 4): processed by Cloudflare only for a limited period, as needed to deliver the images and secure this traffic, under its data processing agreement with us;
• server backups: weekly backups are kept for up to 4 weeks, so deleted data is removed from backups at the latest 4 weeks after it is deleted from the database;
• child-device sign-in codes: expire 5 minutes after they are created and are deleted within 24 hours after they expire;
• parent PIN reset codes sent by email: valid for 10 minutes;
• parent PIN authorisation: expires after 15 minutes at the latest;
• cookies and browser storage: as listed in section 15;
• Google Analytics data: as described in section 6;
• approved story illustrations: retained while used in StoryHop content.

Stripe and Link keep their records of purchases on the website under their own policies and retention periods. The customer record in our Stripe account is kept after account deletion for as long as refunds or payment disputes for your purchases are possible (see section 19). Apple and Google keep the records of app store purchases under their own policies.

If we need specific data to establish, exercise, or defend legal claims, we keep only that data for as long as needed for that purpose.

You can delete your account on the website in the parent area under Privacy. This immediately deletes all child profiles, their learning activity (including riddle history and the pages reached in stories) and statistics, consent and confirmation records, paywall events, child-device sign-in codes, parent PIN data, sign-in sessions, the random account token, and the Stripe customer ID, and then the account itself.

You can also delete a single child profile in the parent area. This immediately deletes that profile, its learning activity (including riddle history and the pages reached in stories) and statistics, its consent and confirmation records, its paywall events, and its child-device sign-in codes.

Deleted data is removed from backups when those backups expire (see section 18). Data stored in your browser is removed when you log out or delete the website's data in your browser, as described in section 15.

If you have a StoryHop Plus subscription bought on the website, deleting your account cancels it immediately, and you will not be charged again. The rest of the current period is not refunded automatically; you can ask for a refund as described in section 10 of the Terms of Use. Payment pages still open for your account are closed. Before you delete your account, the website tells you that the subscription will be cancelled. If we cannot reach Stripe to cancel the subscription, your account is not deleted, and the website asks you to try again later. If a payment started before the deletion is completed in another browser tab afterwards, the new subscription is cancelled automatically, and if a payment was taken, we refund it in full.

Deleting your account does not cancel a StoryHop Plus subscription bought in an app. To stop future charges, cancel it in the store where you bought it: for Apple, in the settings of the Apple ID that bought it (on iPhone or iPad: Settings, your name, Subscriptions); for Google Play, with the Google account that bought it (in the Google Play app: your profile icon, Payments & subscriptions, Subscriptions). StoryHop cannot cancel these subscriptions. Refunds for them are described in the Terms of Use of the app.

When you delete your account, we remove the Stripe subscription ID, or the identifiers of an app store purchase, and the link to your account from your subscription records. What remains (the plan, subscription status, whether a free trial applied and whether it would renew, purchase and expiry dates, and whether it was a test or real purchase) contains no identifier, is not linked to any account, and is kept only for statistics.

We do not delete the customer record in our Stripe account when you delete your StoryHop account. We keep it for as long as refunds or payment disputes for your purchases are possible, for example a refund you request under section 10 of the Terms of Use or a chargeback through your bank. The legal basis is our legitimate interest in handling these refunds and disputes (Article 6(1)(f) GDPR). After the deletion, the record is no longer linked to a StoryHop account, and we use it only for this purpose. Stripe and Link also keep their own records of your purchases under their own privacy policies and retention periods. You can ask Link to delete your data at any time (see section 5).

Notifications from Apple and Google Play received before you deleted your account are kept as described in the apps' privacy policies.

You can also ask us to delete your account by contacting privacy@storyhop.io.

We use technical and organizational measures designed to protect personal data, including HTTPS, limited administrator access, passwords, parent PINs, and sign-in codes stored only as secure hashes, sign-in sessions with a limited lifetime, checking the signature of notifications from Stripe and of purchase data from Apple, reading the current state of a website subscription directly from Stripe instead of relying on a notification alone, payment details entered only in Stripe's payment form and never sent to our servers, no email addresses or Stripe customer or subscription IDs in our server logs about website purchases, short retention for server logs and backups, no analytics on pages children use or on the payment pages, and server-side controls to separate parent settings from child access.

No online service can guarantee absolute security.

Under the GDPR, you have the right to access your personal data, to have inaccurate data corrected, to have data deleted, to restrict processing, to receive a portable copy of data you provided, to object to processing, and to withdraw consent at any time. In Switzerland, you have comparable rights under the Swiss Federal Act on Data Protection. If you live in Armenia, Georgia, Moldova, Serbia or Ukraine, you have the rights described in this section; the data protection law of your country may give you further rights.

Parents may exercise these rights for their own account and for child profiles they manage.

On the website, you can edit and delete child profiles, change or withdraw your cookie consent, and delete your account. Paywall statistics and marketing emails can be changed only in a StoryHop app or by email. The website does not currently offer a self-service data download. Requests for a copy of your data, access, correction, restriction, objection, or deletion are handled manually by email, free of charge, within one month; for complex requests this can be extended by up to two further months, and we will tell you within the first month.

If you live in Armenia, we answer requests for access to your data within 5 days and requests for correction or deletion within 3 working days. If you live in Georgia, we answer requests within 10 working days; we may extend this by up to 10 working days and will tell you if we do. If you live in Armenia or Georgia and the law there requires the consent of a child's parent or legal guardian, the parent confirmation you give when you create a child profile (section 7) is that consent; you can withdraw it at any time by deleting the child profile.

To make a privacy request, contact privacy@storyhop.io. We may need to verify that you are the parent or account holder before fulfilling a request, for example by replying to the email address of the account.

For data that Stripe and Link hold about your purchases on the website, you can also contact Link directly through its privacy center at https://link.com/privacy-center. We will help if you ask us.

Right to object: where we process your or your child's data on the basis of legitimate interests (section 10), you can object at any time on grounds relating to your particular situation. Contact privacy@storyhop.io.

Right to complain: you can lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA country where you live or work. The authority responsible for StoryHop is Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany (https://www.lda.brandenburg.de). In Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC, https://www.edoeb.admin.ch). If you live in Armenia, Georgia, Moldova, Serbia or Ukraine, you can lodge a complaint with the authority responsible for StoryHop named above or with the data protection authority of your country. The data protection authorities of these countries are: in Armenia, the Personal Data Protection Agency (https://dataprotection.moj.gov.am); in Georgia, the State Audit Office (https://sao.ge); in Moldova, the National Centre for Personal Data Protection (https://datepersonale.md); in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (https://www.poverenik.rs); in Ukraine, the Ukrainian Parliament Commissioner for Human Rights (https://ombudsman.gov.ua).

Pages a signed-in child uses on the website contain no links to other websites or apps. Links to outside services, such as Stripe's customer portal, Link, the subscription settings of Apple or Google Play, or email, appear only in parent-only parts and on public pages of the website.

We may update this policy as StoryHop changes. Each version is identified by its date, and a published version is never changed afterwards.

When we publish a new version, the website shows it to you the next time you use the signed-in parts of the website and asks you to confirm that you have read it. On a device signed in with a child sign-in link, this happens only in the parent area, after the parent PIN has been entered. Before we use personal data for a new purpose, we will inform you, and where the law requires consent, we will ask for it separately.

The current and all earlier versions of this policy are available at https://storyhop.io/en/legal/web/privacy.

Privacy requests: privacy@storyhop.io

Support: support@storyhop.io

Contact form: https://storyhop.io/contact

Controller: Aleksandr Gorin, StoryHop, Käthe-Kollwitz-Str. 10b, 14943 Luckenwalde, Germany

Further legal provider information is available in the Impressum.