Privacy policy

Bizzupps is the operator name supplied for this preview. Its full legal identity and contact details must be finalized before the service is offered publicly.

Providing information is voluntary; we are not asking you to supply it under a statutory obligation. You can browse the public pages without an age declaration. Before generating stories or pictures, you must confirm that you are 18 or older and accept the Terms. Without the account information needed to authenticate you cannot create or retrieve private stories. Without story choices we cannot generate a story. You can read our legal pages without an account.

• Age declaration: your confirmation that you are 18 or older is recorded with your account’s Terms acceptance. A legacy session cookie may remain in browsers that used the earlier entry screen. We do not ask for your date of birth.
• Account: email, account ID and authentication/session information. Supabase handles email/password authentication. Google sign-in passes identity/profile information to Supabase; the app uses your verified account ID and email. Google sign-in does not give the app access to your Gmail inbox. Passwords submitted to the app are forwarded to Supabase and are not saved by StorySpark.
• Story choices and content: target age group, fictional character name, theme, setting, lesson, length, language, rhyming preference and model selection are used to write a story. An unfinished draft is kept in this browser with a 24-hour expiry, checked on the next form visit, to preserve your choices through sign-in; drafts are cleared on logout or successful generation. A pending request identifier is retained for recovery until resolved or dismissed. Generated text, scene descriptions, illustration prompts, pictures, historical review status, timestamps and your account ID are stored in your private Supabase library to provide your library. Use fictional inputs; do not provide identifying or sensitive information about a child.
• Preferences and records: essential-cookie preference, terms version and acceptance time, and the category, optional details and status of requests you submit. These support your choices, requests and agreement records.
• Technical information: providers may process IP addresses, device/network information and security or service logs. The app checks request origin and authentication for security. For hosted story and picture generation, it records your account ID, operation type, result, fixed failure category, model, language, duration, server status, and related story ID to diagnose failures and service performance. It does not record story text, prompts, provider response bodies, IP addresses, user agents, or click paths in this operations table. Vercel Speed Insights receives browser performance measurements; Vercel Web Analytics receives aggregate page views and basic browser, device, location and referrer information. Both receive only known page types with story IDs and URL query strings removed before sending. Neither adds advertising or analytics cookies.

Supabase processes account and authentication data to sign you in and verify sessions. It also stores private stories, images, login sessions, agreement records and privacy requests. Vercel hosts the website and processes requests to it. Story and image generation are available subject to Google’s quotas. Generation attempt records and usage counters are stored privately in Supabase to prevent duplicate work. Google handles Google sign-in when chosen. Google’s Gemini API receives your story choices and generated content for writing and Google’s built-in protections; image generation also receives scene descriptions and, when available, a previous generated picture for visual consistency. Login passwords and session tokens are not included in story prompts.

Google’s treatment of AI inputs depends on the project’s service and billing status. Under its Gemini API terms, unpaid-service content can be used for product improvement and human review; paid-service prompts and responses are not used for product improvement, but limited security and legal retention can still apply. This app has not verified the operator’s billing tier. Avoid personal and confidential information in prompts.

The current hosted test uses Supabase storage in Tokyo, Japan. Vercel and authentication services may process requests in other regions. Authentication and AI processing use external providers and may take place outside Israel or your country, including the United States. Provider regions, contracts and lawful transfer arrangements must be confirmed before launch. We may also disclose information when legally required or necessary to protect rights or security; we do not publish your library or offer public story sharing.

The current app uses essential cookies for login, Google sign-in security and remembering your cookie preference. See Cookie preferences for names and lifetimes. Vercel Speed Insights measures loading and interaction performance; Vercel Web Analytics counts aggregate page visits. Neither uses an analytics cookie. There are no advertising cookies, targeted ads, sales of personal information or sharing for cross-context behavioral advertising in this implementation.

Advertising stays off for everyone. Optional product journey measurement stays off unless you allow it in Cookie preferences, and stays off when your browser sends Global Privacy Control (GPC) or Do Not Track (DNT). The app does not change its essential processing in response to DNT. Optional measurement records known page types, creation and reading steps, fixed error categories, language, broad screen-size category, durations and a random 30-minute journey identifier in Supabase. A generated story ID may link a step to server-confirmed completion. It excludes entered text, emails, passwords, raw URLs, story content and error messages. You can withdraw permission in Cookie preferences without affecting the service. Raw measurement records remain accessible only to authorized operators; retention and deletion requests are handled through the privacy request process. Visiting Google or Supabase sign-in pages is subject to those providers’ own cookie practices.

Account information remains in Supabase until removed through an operator-managed account deletion process, subject to the provider’s backup and legal retention practices. Stories, pictures, terms receipts and submitted requests remain in private cloud storage until manually removed; this preview does not yet have automatic retention or deletion jobs. The operator must establish documented retention limits before launch.

The app’s login session lasts up to 24 hours; its Google sign-in flow expires after 10 minutes. Expired login sessions and sign-in flows are rejected immediately; their stored records are cleaned during later sign-in activity. Expired records can remain stored until cleanup. Logging out ends the app session; it does not delete your account or stories.

Server-only API keys, account ownership checks and database access rules and private image storage are used. No system is perfectly secure. Production storage, backups, access management, incident response and vendor retention must be reviewed before public use.

Depending on applicable law, you may have rights to access or obtain a copy of data, correct it, request deletion, object to or limit certain processing, or appeal a decision. Israeli law provides rights of access and correction subject to its conditions. Some US state laws provide additional rights when their scope and thresholds are met. We do not condition privacy requests on accepting the Terms, and we do not penalize you for exercising applicable rights.

Use Privacy requests after signing in. We use your authenticated account to associate the request with your data; additional proportionate verification may be needed. Do not send passwords, government ID numbers or children’s private information in the request. Submitting a deletion request does not immediately delete anything.

The preview saves requests for the operator’s manual review, displays a receipt and does not send an email. A monitored contact channel, response workflow and applicable statutory deadlines must be implemented before launch, including a route for people unable to log in and authorized agents. You may also contact the relevant regulator, including Israel’s Privacy Protection Authority or your US state authority.

This service is intended to be operated by adults creating stories to read with children. We do not offer children accounts or knowingly solicit their personal information. If identifying information about a child has been submitted, request its removal. An age gate alone does not determine whether children’s privacy laws apply; the audience and actual use must be assessed before launch.

We will update the date on this policy when practices change and provide additional notice or obtain permission when required. A policy update does not itself supply consent for a new use of personal data.