Privacy notice
Draft. A lawyer reviews this text before the public launch. Parts marked in yellow are still to be filled in.
1. Who is responsible?
The controller is [name or company, address of the operator], e-mail [contact address]. All details are in the imprint. For privacy questions, write to [privacy contact].
2. In short
- StorySpark turns your photos and details into an illustrated children's story. Text and pictures are made with AI services of other companies, also in the USA. That happens only with your consent.
- We delete your photos after 7 days at the latest, usually sooner.
- We use no analytics, tracking or advertising cookies and load nothing from other servers into your browser.
- Your data is stored in Germany (servers at Strato).
3. What we process, why, and on which legal basis
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: e-mail address, name, sign-in methods (password as a hash, passkeys, linked Google account), sign-ins | Your account and secure sign-in | Contract, Art. 6(1)(b) |
| Family space: members and their roles | Sharing stories within the family | Contract, Art. 6(1)(b) |
| Story details: names, ages and traits of the characters, values, style, notes | Writing the story and planning the pictures | Contract, Art. 6(1)(b); sending them to AI services: consent, Art. 6(1)(a) (section 5) |
| Photos you upload | Having the photos described and painting new pictures from them | Contract, Art. 6(1)(b); sending them to AI services: consent, Art. 6(1)(a) (section 5) |
| Finished stories, photo descriptions, pictures, your feedback | Showing you the stories | Contract, Art. 6(1)(b) |
| Agreements and consents with text version and time, including withdrawals | Proving what you agreed to and when | Legal obligation, Art. 7(1) and Art. 6(1)(c) |
| Technical data: IP address, time, requested address, outcome; security events | Running the service and protecting it from misuse | Legitimate interest, Art. 6(1)(f) |
People in the photos who have no account themselves (for example your children): we process their pictures because you assure us that you may use the photos and that the people, or their parents or guardians, agree (terms of use § 4). They can contact us at any time (section 11).
Please do not upload photos that reveal health, religion, ethnic origin, sex life or other special categories of personal data (Art. 9 GDPR).
4. Account and sign-in
Sign-in runs through our own sign-in service at auth.wonderfultimes.life, on our server in Germany. If you sign in with Google, Google receives the technical data of that sign-in and is responsible for it itself (Google's privacy policy). From Google we receive your name, your e-mail address and an identifier of your Google account.
5. AI services
Stories, photo descriptions and pictures are made with AI models that other companies run. We reach them through OpenRouter, Inc. (USA), which passes our requests on to the company concerned. This happens only if you consented in the app (consent 1 for details and drafts, consent 2 for photos).
What the AI services receive
The photos of a story (consent 2), your story details and the drafts of the story (consent 1). They do not receive your account name, e-mail address or other account data, unless you type them into the story details yourself.
Who receives it
| Recipient | Role | Location |
|---|---|---|
| OpenRouter, Inc. | Processor: passes requests on to the model hosts | USA |
| Hosts of the AI models, currently: Amazon Web Services (Anthropic models), Parasail (Qwen models), Venice (Mistral models), Black Forest Labs (image models). The list changes when a host is unavailable; we keep it up to date here. [Check whether to fix the hosts] | Sub-processors of OpenRouter | USA, EU |
What they may do with the data
- Every request asks for providers that do not store requests and do not train on them (OpenRouter settings “data_collection: deny” and “zero data retention”). A model without such a provider is not used.
- OpenRouter commits to deleting requests and responses right after the response and not training on them.
- OpenRouter's data processing agreement (Art. 28 GDPR) applies, with the European Commission's standard contractual clauses (module 2) for the transfer to the USA. [Check contract status and signature]
Transfers outside the EU
OpenRouter and some model hosts process data in the USA. For the USA there is an adequacy decision only for companies certified under the EU-US Data Privacy Framework; for OpenRouter we base the transfer on the standard contractual clauses (Art. 46(2)(c) GDPR) and in addition on your explicit consent (Art. 49(1)(a) GDPR). Risks: authorities in the USA may be able to access data without you knowing, and your rights are harder to enforce there than in the EU.
Labelling
In the app we label stories and pictures made by AI as “made by AI”. In addition, every picture file states in machine-readable form that AI made it (the IPTC value “trainedAlgorithmicMedia”, or the image model's signed C2PA provenance data). Please do not remove this information when you pass pictures on. If StorySpark uses your own photo as a picture because no image model is available, it is not marked as made by AI.
6. Photos
- We delete your photos as soon as you accept the book, when you delete them yourself, when you withdraw consent 2, and at the latest 7 days after upload. You can choose a shorter period in the settings. The 7-day limit is fixed in our database.
- With the photo we also delete every copy made while creating the story (for example thumbnails).
- After every deletion the app shows a deletion receipt.
- The pictures in the story are newly painted; they may resemble the people in your photos.
7. Cookies and storage on your device
We store on your device only what is strictly necessary for the service you use, or what you set yourself. That needs no consent (§ 25(2) no. 2 TDDDG), which is why there is no cookie banner. There are no analytics, tracking or advertising cookies, and the pages load nothing from other servers (no fonts either).
| Name | Type, where | Why | Duration |
|---|---|---|---|
__Host-ap_session | Cookie, wonderfultimes.life | Keeps you signed in (a random identifier; the sign-in data stays on the server) | until you sign out, at most 30 days |
__Host-ap_oidc | Cookie, wonderfultimes.life | Protects the sign-in from forgery | 5 minutes |
__Host-ap_link | Cookie, wonderfultimes.life | Protects linking a Google account from forgery | 5 minutes |
sessions | Cookie, auth.wonderfultimes.life | Remembers the sign-in on the sign-in page | until the browser closes |
__Host-zitadel.useragent, fingerprintId | Cookies, auth.wonderfultimes.life | Recognise the device to secure sign-ins (for example to spot unusual sign-ins) | 1 year [Check necessity and duration] |
ss-lang, ss-text-size, ss-scene | Local storage, wonderfultimes.life | Your language, text size and background picture, only when you choose them | until you clear them in the browser |
8. Other recipients
- Strato GmbH (Berlin): runs our server and sends our e-mails (processor, Germany). [Conclude or document the processing agreement with Strato]
- StorySpark's administrators can see family spaces to fix problems, stop misuse and answer legal requests. Every such access is logged.
- Authorities only where the law obliges us.
We do not sell data and do not pass it on for advertising.
9. How long we keep data
| Data | Kept |
|---|---|
| Photos | at most 7 days (section 6) |
| At AI services | not beyond the single request (section 5) |
| Stories and pictures | until you delete them or your account |
| Account and family space | until the account is deleted; then within [30] days, in backups after at most 8 more days |
| Backups | encrypted, 7 days; photos are never in them |
| Agreements and consents | while the account exists, then as long as we need them as proof, at most [3 years] |
| Technical logs | [Set the period]; security events up to 2 years |
10. Security
Encrypted connections (HTTPS), storage in Germany, sign-in with passkeys or security keys possible, administrator access only with a security key. The key for the AI services is stored encrypted on the server and used only by a separate component.
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)), most easily in the app under “Settings”. Processing up to the withdrawal stays lawful. To delete your account or exercise your rights, write to [contact address].
You can complain to a data protection supervisory authority, for example the one responsible for us: [authority of the operator's federal state].
12. No automated decisions
We make no decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Art. 22 GDPR). The AI only makes content.
13. Changes
When this notice changes, the new text gets a new version. If a change concerns a consent, we ask you again in the app.