Privacy Policy

1. What Data We Collect

Your email is the only personal data of your account. When you sign in with Yandex ID, VK ID or Google, we keep neither your name nor your profile picture.

The ideas and settings you enter when creating stories.

Generated scene text, choices, and images.

Operational metadata: IP address, browser type, request timings — strictly for security and abuse prevention.

2. How We Use the Data

To generate stories and illustrations from your prompts.

To display your stories in your personal library and (optionally) the public feed.

To enforce security, moderation, and handle payments.

We do NOT use your content to train AI models.

3. Third Parties

Anthropic (Claude) — for scene text generation.

OpenAI (gpt-image-1, Whisper) — for image generation and voice recognition.

Supabase — for account and story storage.

Resend — for sending emails; it receives the recipient’s email address.

PostHog and Yandex Metrica — for visit analytics. PostHog receives an internal user id, without your email or name.

MyTracker (a VK service) — in the Android app: counts installs and in-app actions and shows which ad led to an install or purchase. It receives technical device data (model, OS version, advertising ID) and an internal user id — without your email, name or story text; for in-app purchases, the amount and currency.

ЮKassa (Russian NCO YooMoney) and Lava.top — for credit pack payment processing. Only the minimum needed to complete a payment (user id, amount, currency) is shared.

We do not sell your data to third parties.

4. Your Rights

You can delete any story you created. Account settings will include an option to delete your entire account, cascading all data.

You can request a data export by emailing support.

If you are in a jurisdiction that grants additional rights (GDPR, CCPA, etc.), you may exercise them by contacting us.

5. Data Retention

Your stories are retained until you delete them or your account exists.

Security logs are retained for 30 days and then automatically purged.

After account deletion, all related data is removed within 30 days, except where law requires longer retention.

6. Cookies

We use cookies for sign-in, preferences (theme, language), remembering where you came from, and analytics. See the Cookies Policy for details.

7. Minors

The Service is not intended for children under 13. If we learn that data from a child under 13 has been collected without parental consent, we will delete it.

8. Changes to this Policy

We may update this policy. Material changes will be announced in the Service. The last update date is shown at the top of this document.

9. Contact

Privacy questions — support@narralis.app.