Privacy Policy

Stogenai is operated by halaSpace, a sole proprietorship of Ahmed Almurtadha,Mevlana Cd. No: 135, Altındağ, Ankara, Türkiye (“we”, “us”). We are the data controller for the personal data described here. This policy explains what we collect, why, and what rights you have over it.

Stogenai is a story app. We never ask for anyone's real name: the display names of your family's profiles and the characters in your stories can be anything you like, and we recommend using made-up names. The only things we need to run your account are an email address and a password.

From the parent/account holder:

• Email address and a hashed password (we never store your password in plain text — see /security).
• Preferred language and timezone.
• Subscription status. Payment is handled entirely by our payment processor (Lemon Squeezy) — we never see or store your card number.

From child profiles (created by a parent, under the parent's account):

• A display name of your choice and a birth year only — no full birthdate and no other identifying information.
• Content created in the app: stories, characters, drawings.

Generated automatically:

• Stories, character descriptions, and illustrations you ask us to generate.
• Sign-in records (time, IP address, device/browser type), used for security and abuse prevention.
• A push-notification device token, if you enable notifications on the mobile app.

• To provide the service you signed up for: your account, your stories and drawings, the gallery if you choose to share, and emails about your account (performance of our contract with you).
• To keep the service safe: sign-in security, abuse and fraud prevention, and checking generated content for children (our legitimate interest, and our legal obligations).
• To meet legal obligations, such as keeping billing records.
• For optional emails, only when you turn them on (your consent, which you can withdraw at any time).

We do not sell your data, there are no ads in Stogenai, and we never use your data or your children's data for advertising or to train AI models.

Stogenai is a family product. Accounts are for adults (18+); children use profiles their parent or guardian creates in that account, so the parent is the one who gives consent and stays in control. We treat everyone under 18 with extra care:

• Under 13 (Safe Mode): everything is private to the family. No public sharing, no private story links, no photo uploads. A drawing can be entered in a contest only after the parent approves that entry, and other families then see the child’s first initial only, never a name or photo.
• Ages 13–17: public sharing, private story links and photo uploads stay off until the parent switches them on for that profile. Switching it off again makes the profile’s public items private.
• Only the parent can change a child’s birth year. We never show a child’s contact details, and there is no chat or messaging between families.

Parents can review, edit or delete their child's content and profile from the parent account at any time. Accounts created before October 2026 by a child with a parent's email keep working under the same Safe Mode rules.

Character photos: if a parent uploads a photo to show what a character looks like, we use it once to draw an illustrated portrait of the character, then delete the photo right away. Only the drawing is kept, and uploaded photos are never shown to other families. Please don't upload photos that show anything identifying, such as a school uniform or a street sign.

When you create a story or drawing remix, the text you provide (title, character descriptions, your written beginning and ending) is sent to an AI provider to write the rest of the story and draw its pictures. Depending on our configuration this is OpenAI, Anthropic or Google (Gemini), directly or through OpenRouter. These providers process the content only to generate the response, under their API terms, which do not allow them to train their models on it. Requests through OpenRouter are set to go only to providers that neither store nor train on them. Generated content passes through an automated safety check before it is shown to you.

Your account data, stories, drawings and generated pictures are stored on our own servers, hosted by HostLAB in Türkiye. We use these services, each only for the purpose listed:

• AI providers (OpenAI, Anthropic, Google Gemini, OpenRouter) — writing stories, drawing pictures, and checking content safety.
• Lemon Squeezy — subscription billing (they hold your payment details, not us).
• Namecheap Private Email — sending the emails described below.
• Google Firebase Cloud Messaging — mobile push notifications, if you turn them on.

Some of these providers are located outside Türkiye (for example in the United States or the European Union), so using Stogenai involves transferring the data they need abroad. We only send them what the task requires — for AI generation that is your story text, never your email address. When you create an account you give your explicit consent to these transfers; you can withdraw it by writing to us or deleting your account (stories and pictures can't be made without it).

The owner of a story can create a private link to it. Anyone who has that link can read the story's released chapters (title, description, pictures, text and the author profile's display name) on our website, without an account; nothing else about your family is shown. The link isn't listed or indexed anywhere, we count how often it's opened, and turning it off makes it stop working at once. Children's (Safe Mode) profiles can't create links.

Emails only ever go to the adult account holder (for a child under 13, to the parent's address), never to a child.

• Account and security emails: verifying your email, welcome, password reset and change, account deletion, and moderation notices (when something of your family’s is taken down, with the reason and how to appeal). These are needed to run your account, so they can’t be turned off.
• Plan notices: payment problems and plan changes.
• Optional emails: a new chapter is ready, and event results when someone in your family wins. Turn these off any time in Account → Settings or with the unsubscribe link in each email.

Emails contain the story or event title and the profile's display name at most, never story text. We keep a record of what was sent (not the email itself) for up to 90 days to make sure emails are delivered, and stop optional emails to addresses that bounce or report spam.

We keep account data for as long as your account is active. When you delete your account, your personal information, child profiles and content are permanently deleted within 30 days (signing back in during that time cancels the deletion). You can also ask us to delete it right away by writing to us. Some records, such as billing history, may be kept longer where we're legally required to. Email delivery records are kept for up to 90 days, and website visits (see Cookies) only as daily counts.

You can download a copy of everything tied to your account at any time from Account → Your data and account → Download my data, and permanently delete your account from Account → Your data and account → Delete my account. You can also ask us to correct your data, tell you how it is processed, or object to processing — write to us (below) and we will answer within 30 days.

For users in Türkiye, our information notice under Article 10 of KVKK is the KVKK Aydınlatma Metni (in Turkish); this section summarises it. The data controller is halaSpace (Ahmed Almurtadha). We process the data listed above for the purposes and on the legal grounds described in “Why we use it” (KVKK Article 5: performance of a contract, legal obligations, legitimate interests, and explicit consent where we ask for it), and transfer it abroad only as described in “Where your data is stored” (KVKK Article 9).

Under KVKK Article 11 you may ask us whether we process your data, request information about it, learn the purpose and whether it is used for that purpose, learn who it is transferred to in Türkiye or abroad, ask for correction or deletion, ask that third parties it was transferred to be told about this, object to a result based solely on automated processing, and claim compensation for damage caused by unlawful processing. Send requests to support@stogenai.com; we answer within 30 days, free of charge. If you are not satisfied with our answer, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

We only use strictly-necessary cookies, to keep you signed in. We don't use analytics or advertising cookies. We count visits to our public web pages without cookies: we record the page and the website you came from, and turn your IP address and browser type into a code that changes every day and can't be traced back to you; the IP address itself is never stored. If that ever changes, we will ask for your consent first through the cookie banner, and you can change your choice at any time from the cookie preferences link in the site footer.

We will update this page when what we collect or who we share it with changes, and tell you by email about significant changes.

Questions about this policy or your data: support@stogenai.com.