Privacy Policy
We process only the data needed to provide the writing service
This policy explains what StoryForge processes when you register, write, use AI, manage a knowledge base, use credits or pay, and how you can manage that information.
Version: October 21, 2026, applicable after public publication. Do not place unnecessary identity documents, account passwords, or another person's sensitive data in prompts, manuscripts, or the knowledge base.
1. This policy and information we collect
This policy explains how StoryForge processes information directly handled by this site. Privacy and support contact: [email protected].
Account information
Registration email, display name, a secure password digest, and login and session records.
Creative content
Synopses, story bibles, outlines, chapters, prompts, knowledge-base documents, and related revisions that you enter or upload.
Usage and billing records
Feature calls, task states, model usage, credit movements, order numbers, amounts and currencies, payment and benefit states, subscription periods, renewal consent, cancellation and refund review records, and diagnostic logs.
Device and security information
IP address, browser and device type, access time, visitor and session identifiers, security events, and error reports. Visitor identifiers can link activity before and after sign-in; they do not necessarily make records unidentifiable.
2. How we use information
We use this information to authenticate accounts, save projects, run AI tasks you request, provide retrieval and export, reconcile credits and membership, prevent abuse, troubleshoot failures, and improve reliability. Providing your requested service and processing payments or refunds are the relevant grounds for that processing. Security and diagnostics protect the service and users; where consent is legally required, the relevant processing must rely on that consent.
Cloudflare IP country or region results set initial language defaults. New purchases use domestic card codes regardless of IP region; IP does not route new payment options. We do not infer location from interface language or request precise device GPS location. A VPN or proxy can change the result, and users can change the interface language themselves.
We do not make an unpublished manuscript public merely because you use the writing tools, and we do not automatically turn a private prompt into public content.
3. AI models and international third-party processing
When you start a generation, review, or analysis task, relevant prompts and necessary context may be transmitted to the model endpoint you select or a provider configured by the platform so that the request can be completed. Do not submit sensitive information unrelated to the writing task.
If you use your own API key or custom base URL, that provider also processes data under its own terms and privacy policy. Available models and providers are shown by the current model configuration.
Depending on the model, payment and analytics services used, necessary information may be processed by providers abroad. We do not imply that using these services keeps all data in your home country. Contact us for the provider used by a particular operation or to exercise relevant rights.
4. Cookies, local storage and analytics
We use necessary cookies or browser storage to maintain sessions, remember language and theme preferences, and restore client state. Pending payment request identifiers may be stored in the current browser tab to recover the original order after a reload, not payment private keys or card security codes.
The site uses its own behavioral analytics and Google Analytics to record page visits, key operations, device and session details, and errors to reconcile workflows and improve usability. Our own tracking does not collect manuscript text, full prompts, passwords or API keys. Some records can be linked to an account and should not all be described as fully anonymous. Google privacy information is at https://policies.google.com/privacy.
You can manage cookies and local storage or restrict third-party analytics through browser settings. Blocking necessary storage may affect sign-in or recovery.
5. Payment, sharing, publishing and legal disclosure
Historical international payments and related order handling use Waffo Pancake; new purchases use domestic card codes. Card data is processed by its checkout and payment processors; StoryForge does not store full card numbers or security codes. We transmit product, amount, currency, our order number and a buyer-association identifier, and receive actual payment, period, cancellation and refund states for reconciliation, benefits and dispute handling. Service information is at https://docs.waffo.ai.
We may provide the minimum information required for a function to cloud hosting, storage, email, payment, analytics, security and AI providers under applicable law. Domestic code sellers handle payment on their own pages; this site records redemption and benefits. We do not sell your personal information.
Content is shown to other users only when you choose a public prompt, create an authorization link, or use another sharing feature. We may disclose necessary information to comply with law or a court order, or to protect users and the service.
6. Retention, deletion and backups
Account and project data is retained while needed to provide the service. Billing, security and legal records may be retained for statutory or reasonable risk-management periods. Cancellation does not itself delete an account or manuscript. Deleted data may remain for a limited backup cycle before it is overwritten or removed.
Deletion or account-closure requests require identity verification and review of transaction or security records that must still be lawfully retained, before eligible data is deleted. For requests not available in the interface, email [email protected]. You can ask for the record scope and applicable retention periods; membership duration is not a data retention period.
7. Security, data rights and minors
We use reasonable controls such as access restrictions, credential protection, logs and backups to reduce loss, misuse and unauthorized access. No online service guarantees absolute security. Use a unique password, never share API keys and keep local manuscript backups.
Under applicable law, you may request access, correction, deletion or export; restrict or object to relevant processing; withdraw consent-based authorization; and complain to your local data protection authority. Email [email protected] to exercise these rights. We handle requests within applicable statutory time limits; withdrawal does not affect previous lawful processing or obligations still required by law.
Users below the locally applicable age for independent consent or contracting should obtain guardian consent. A guardian who believes a child supplied information without consent can use the contact email to request investigation and deletion.
8. Changes and contact
Material changes to data types, purposes or providers will update this version date and receive notice or any consent required by applicable law. Privacy, access, correction, export and deletion enquiries can be sent to [email protected].