Privacy Policy

1. Who controls your information

StoryViewer is the service operator and the controller or business responsible for customer account information. Privacy questions and formal privacy requests can be sent to [email protected]. The same address is the approved electronic legal-notice channel.

2. Information collected

• Google account data: verified email address, Google subject identifier, name, profile image URL, and sign-in timestamps. StoryViewer does not receive your Google password.
• Account and subscription data: internal account ID, role, time zone, plan, subscription status and dates, Stripe customer, subscription, Checkout, and invoice-related references. Stripe receives and processes payment method details; StoryViewer does not store full card numbers.
• Monitoring and archive data: creator usernames, monitoring start and stop history, scan and download status, archive grants, hidden-item choices, captions, public creator metadata, and downloaded public Story and Post media.
• Operational and security data: session and CSRF tokens, request timing, limited network metadata handled by infrastructure providers, worker health, API usage, errors reduced to safe categories, and anti-abuse trial identifiers derived from Google identity and normalized email data.
• Support data: messages, request details, attachments, and verification information you choose to provide.

StoryViewer uses essential secure session cookies. The current application does not include advertising cookies or a third-party analytics script.

3. Sources

We receive customer identity data from Google, subscription status and references from Stripe, instructions and support content directly from you, and public creator content and metadata through a third-party TikTok data API and network proxy service. StoryViewer does not ask for a TikTok password or access private TikTok accounts.

4. Why information is used

Information is used to authenticate users, create and secure accounts, provide trials and subscriptions, prevent repeated trial abuse, start and stop creator monitoring, capture and serve authorized archive items, process account exports and deletion, operate and protect the service, troubleshoot failures, comply with valid legal obligations, and handle privacy or content-rights requests.

5. Legal bases for EEA and UK users

If the GDPR or UK GDPR applies, StoryViewer relies on performance of the requested service for account, monitoring, archive, and billing operations; legitimate interests in security, service reliability, fraud prevention, and enforcing service rules; compliance with legal obligations for required records and requests; and consent where a feature or applicable law specifically requires it. You may object to processing based on legitimate interests.

6. How information is disclosed

Information is disclosed only as needed to operate the service, follow your instructions, protect users and the service, complete a business transaction subject to appropriate safeguards, or respond to a binding legal request. Service relationships include Google for sign-in, Stripe for billing, Cloudflare for DNS, edge delivery, and private object storage, an external TikTok data API, a rotating proxy provider, and self-hosted application and PostgreSQL infrastructure. StoryViewer does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.

7. Public creator content and creator rights

Creator usernames, captions, identifiers, and media are obtained from publicly accessible sources and stored for private customer archives. Public availability does not remove copyright, privacy, publicity, or other rights. Creators and authorized rights holders may submit a request through the Contact page. StoryViewer may verify authority, restrict access during review, request more information, and remove or restore access based on the evidence and applicable law.

8. International transfers

The service may involve providers or infrastructure outside your country. Where European transfer rules apply, StoryViewer relies on an applicable adequacy decision, approved contractual safeguards used by the relevant provider, or another transfer mechanism permitted by law. You may contact us for information about safeguards relevant to your data.

9. Retention

StoryViewer uses a criteria-based retention policy. Active account and subscription data is retained while the account or subscription exists. Granted archives and access records currently have no automatic age-based expiry and are retained while needed to provide archive access, preserve monitoring entitlements, resolve rights requests, prevent duplicate downloads, or meet legal and security obligations. Account deletion cancels the subscription, stops monitoring, and anonymizes the profile. Hashed anti-abuse identifiers, immutable grant records, necessary billing and legal records, shared deduplicated media, security logs, and backups may remain for the period reasonably necessary for those purposes. Data is deleted or anonymized when it is no longer needed, subject to technical backup cycles and legal requirements. Stripe retains its records under its own policy.

10. Security

Controls include Google OpenID Connect verification, short-lived secure HTTP-only sessions, CSRF and origin checks, server-side account and grant authorization, restricted media paths, non-public storage, database constraints, rate limits, and reduced error logging. No system is perfectly secure. StoryViewer investigates suspected incidents and provides notices within the time and manner required by applicable law.

11. Your choices and rights

You can export account, monitoring, subscription, and grant metadata or request account deletion from the dashboard. Depending on where you live, you may also have rights to access, correct, delete, receive, restrict, object to, or complain about processing, and to withdraw consent without affecting earlier lawful processing. Contact [email protected]. We may verify identity and may retain or refuse data where law permits or requires. EEA and UK users may complain to their local supervisory authority.

12. United States state privacy notices

Where a US state privacy law applies, residents may have rights such as knowing, accessing, correcting, deleting, and obtaining a portable copy of covered personal data, plus opting out of sale, targeted advertising, profiling, or certain sensitive-data uses. StoryViewer does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. Applicable requests and appeals can be submitted through the Contact page. We verify and respond to requests within the period required by applicable law and do not discriminate against a person for exercising a protected privacy right.

13. Children

You must be at least 18 years old, or the age of legal majority where you live if higher, to create an account. StoryViewer is not directed to children and does not knowingly collect a child’s customer-account data.

14. Policy changes

Changes are dated on this page. StoryViewer will provide notice through the service or account email before a material change takes effect when required by law. Earlier versions are retained where required.