Privacy notice
Draft. A lawyer reviews this text before the public launch. Parts marked in yellow are still to be filled in.
1. Who is responsible?
The controller is [name or company, address of the operator], e-mail [contact address]. All details are in the imprint. For privacy questions, write to [privacy contact].
2. In short
- StorySpark turns your photos and details into an illustrated children's story. Text and pictures are made with AI services of other companies, also in the USA. That happens only with your consent.
- We delete your photos after 7 days at the latest, usually sooner.
- If you agree (optional, consent 3), our Editors read your stories to make StorySpark better. Without that consent they see them only without names, photos and your own words.
- We use no analytics, tracking or advertising cookies and load nothing from other servers into your browser.
- Your data is stored in Germany (servers at Strato).
3. What we process, why, and on which legal basis
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: e-mail address, name, sign-in methods (password as a hash, passkeys, linked Google account), sign-ins | Your account and secure sign-in | Contract, Art. 6(1)(b) |
| Family space: members and their roles | Sharing stories within the family | Contract, Art. 6(1)(b) |
| Story details: names, ages and traits of the characters, values, style, notes | Writing the story and planning the pictures | Contract, Art. 6(1)(b); sending them to AI services: consent, Art. 6(1)(a) (section 5) |
| Photos you upload | Having the photos described and painting new pictures from them | Contract, Art. 6(1)(b); sending them to AI services: consent, Art. 6(1)(a) (section 5) |
| Finished stories, photo descriptions, pictures, your feedback | Showing you the stories | Contract, Art. 6(1)(b) |
| How a story was made: settings, drafts, scores, which AI models ran, review notes, your feedback | Checking and improving the quality of the stories (Editors, section 8) | With consent 3: consent, Art. 6(1)(a). Without it, only without names, photos and your own words: legitimate interest in the quality of our service, Art. 6(1)(f) [Lawyer to confirm] |
| Agreements and consents with text version and time, including withdrawals | Proving what you agreed to and when | Legal obligation, Art. 7(1) and Art. 6(1)(c) |
| Technical data: IP address, time, requested address, outcome; security events | Running the service and protecting it from misuse | Legitimate interest, Art. 6(1)(f) |
People in the photos who have no account themselves (for example your children): we process their pictures because you assure us that you may use the photos and that the people, or their parents or guardians, agree (terms of use § 4). They can contact us at any time (section 11).
Please do not upload photos that reveal health, religion, ethnic origin, sex life or other special categories of personal data (Art. 9 GDPR).
4. Account and sign-in
Sign-in runs through our own sign-in service at auth.wonderfultimes.life, on our server in Germany. If you sign in with Google, Google receives the technical data of that sign-in and is responsible for it itself (Google's privacy policy). From Google we receive your name, your e-mail address and an identifier of your Google account.
5. AI services
Stories, photo descriptions and pictures are made with AI models that other companies run. We reach them through OpenRouter, Inc. (USA), which passes our requests on to the company concerned. This happens only if you consented in the app (consent 1 for details and drafts, consent 2 for photos).
What the AI services receive
The photos of a story (consent 2), your story details and the drafts of the story (consent 1). They do not receive your account name, e-mail address or other account data, unless you type them into the story details yourself.
Who receives it
| Recipient | Role | Location |
|---|---|---|
| OpenRouter, Inc. | Processor: passes requests on to the model hosts | USA |
| Hosts of the AI models, currently: Amazon Web Services (Anthropic models), Parasail (Qwen models), Venice (Mistral models), Black Forest Labs (image models). The list changes when a host is unavailable; we keep it up to date here. [Check whether to fix the hosts] | Sub-processors of OpenRouter | USA, EU |
What they may do with the data
- Every request asks for providers that do not store requests and do not train on them (OpenRouter settings “data_collection: deny” and “zero data retention”). A model without such a provider is not used.
- OpenRouter commits to deleting requests and responses right after the response and not training on them.
- OpenRouter's data processing agreement (Art. 28 GDPR) applies, with the European Commission's standard contractual clauses (module 2) for the transfer to the USA. [Check contract status and signature]
Transfers outside the EU
OpenRouter and some model hosts process data in the USA. For the USA there is an adequacy decision only for companies certified under the EU-US Data Privacy Framework; for OpenRouter we base the transfer on the standard contractual clauses (Art. 46(2)(c) GDPR) and in addition on your explicit consent (Art. 49(1)(a) GDPR). Risks: authorities in the USA may be able to access data without you knowing, and your rights are harder to enforce there than in the EU.
Labelling
In the app we label stories and pictures made by AI as “made by AI”. In addition, every picture file states in machine-readable form that AI made it (the IPTC value “trainedAlgorithmicMedia”, or the image model's signed C2PA provenance data). Please do not remove this information when you pass pictures on. If StorySpark uses your own photo as a picture because no image model is available, it is not marked as made by AI.
6. Photos
- We delete your photos as soon as you accept the book, when you delete them yourself, when you withdraw consent 2, and at the latest 7 days after upload. You can choose a shorter period in the settings. The 7-day limit is fixed in our database.
- With the photo we also delete every copy made while creating the story (for example thumbnails).
- After every deletion the app shows a deletion receipt.
- The pictures in the story are newly painted; they may resemble the people in your photos.
- With consent 3, our Editors may look at your photos while they exist (at most 7 days), to check the pictures made from them. They cannot download or keep them.
- For a book you choose, per book, whether pictures made directly from a photo may stay in it. If you say yes, those pictures are part of the book and are kept with it (section 9); otherwise the book has only newly painted pictures.
7. Cookies and storage on your device
We store on your device only what is strictly necessary for the service you use, or what you set yourself. That needs no consent (§ 25(2) no. 2 TDDDG), which is why there is no cookie banner. There are no analytics, tracking or advertising cookies, and the pages load nothing from other servers (no fonts either).
| Name | Type, where | Why | Duration |
|---|---|---|---|
__Host-ap_session | Cookie, wonderfultimes.life | Keeps you signed in (a random identifier; the sign-in data stays on the server) | until you sign out, at most 30 days |
__Host-ap_oidc | Cookie, wonderfultimes.life | Protects the sign-in from forgery | 5 minutes |
__Host-ap_link | Cookie, wonderfultimes.life | Protects linking a Google account from forgery | 5 minutes |
sessions | Cookie, auth.wonderfultimes.life | Remembers the sign-in on the sign-in page | until the browser closes |
__Host-zitadel.useragent, fingerprintId | Cookies, auth.wonderfultimes.life | Recognise the device to secure sign-ins (for example to spot unusual sign-ins) | 1 year [Check necessity and duration] |
ss-lang, ss-text-size, ss-scene | Local storage, wonderfultimes.life | Your language, text size and background picture, only when you choose them | until you clear them in the browser |
8. Other recipients
- Strato GmbH (Berlin): runs our server and sends our e-mails (processor, Germany). [Conclude or document the processing agreement with Strato]
- StorySpark's Editors (our staff, or people working for us under a duty of confidentiality) check how stories turn out and improve the instructions our AI follows. With consent 3 they see a story in full, including the photos while they exist; without it, names are replaced (“Character A”), and your photos and your own words are hidden. They cannot change your stories or contact you. Every view is logged.
- StorySpark's administrators can see family spaces to fix problems, stop misuse and answer legal requests. Every such access is logged.
- Authorities only where the law obliges us.
We do not sell data and do not pass it on for advertising.
9. How long we keep data
| Data | Kept |
|---|---|
| Photos | at most 7 days (section 6) |
| At AI services | not beyond the single request (section 5) |
| Stories, pictures and books | until you delete them or your account. A deleted story stays in the bin for 30 days, where you can restore it; then it is deleted |
| How a story was made (drafts, scores, review notes) | 30 days after the story is finished; for a check, Editors can keep it (never photos) for 90 days at a time |
| Account and family space | until the account is deleted; its stories then go to the bin for 30 days (an administrator can restore them in that time), then they are deleted; in backups after at most 12 more months |
| Backups | encrypted: daily copies for 7 days, weekly for 12 weeks, monthly for 12 months. Photos are never in them, except pictures made from a photo that you chose to keep in a book. After restoring a backup we delete again what was deleted since |
| Agreements and consents | while the account exists, then as long as we need them as proof, at most [3 years] |
| Technical logs | [Set the period]; security events up to 2 years |
10. Security
Encrypted connections (HTTPS), storage in Germany, sign-in with passkeys or security keys possible, administrator access only with a security key. The key for the AI services is stored encrypted on the server and used only by a separate component.
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)), most easily in the app under “Settings”. Processing up to the withdrawal stays lawful. To delete your account or exercise your rights, write to [contact address].
You can complain to a data protection supervisory authority, for example the one responsible for us: [authority of the operator's federal state].
12. No automated decisions
We make no decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Art. 22 GDPR). The AI only makes content.
13. Changes
When this notice changes, the new text gets a new version. If a change concerns a consent, we ask you again in the app.