YOUR DATA AND YOUR RIGHTS

Privacy Policy

Last updated: 10 November 2026

This Privacy Policy explains how STORYFLICKS processes personal data when you visit the website, create an account, read stories, take part in reader discussions or use Creator Studio. It is intended to describe the platform as currently implemented. Features and service providers may change; this notice will be updated when our processing changes.

1. Who is responsible for your data?

The controller is Francis Koine, operating STORYFLICKS as an individual.

Schleusenstr 50, 15569 Woltersdorf, Germany
Email: exec@frankkoine.com

You can use this email address to contact the controller about privacy questions or to exercise your data-protection rights.

2. Personal data we process

• Account and authentication data: email address, account identifier, authentication status and account-related settings.
• Reader activity: reading progress, saved stories and bookmarks, reactions, review-room activity and notification preferences.
• Community contributions: public reviews, private feedback, author replies, reports and information needed to moderate reported content. Public reviews may be displayed with your platform profile name; private feedback is not displayed as a public review.
• Creator content: creator profile details, story and episode metadata, manuscripts, revisions, notes, uploaded covers and other materials you submit to Creator Studio.
• Support checkout information: checkout-session identifiers, contribution amount and currency, story and account references, payment status and payment-intent identifiers. Card details are handled by Stripe, not stored by STORYFLICKS.
• Technical and security information: information that may be present in hosting, infrastructure and security logs, such as IP address, request time, browser/device information and error details.

3. Why we use personal data and our legal bases

• To create and operate accounts, authenticate users and provide reading, library and Creator Studio features. Legal basis: performance of a contract or steps requested before entering a contract (GDPR Article 6(1)(b)).
• To save reading progress, bookmarks, reactions, reviews and creator submissions and make public content available as requested. Legal basis: Article 6(1)(b), and where appropriate our legitimate interests in operating a community publishing platform (Article 6(1)(f)).
• To protect the service, prevent abuse, investigate reports and maintain security. Legal basis: our legitimate interests in protecting users, content and the platform (Article 6(1)(f)).
• To process support checkout and maintain payment records. Legal basis, where applicable, includes performance of the requested transaction (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c)).
• To comply with legal obligations and establish, exercise or defend legal claims. Legal basis: Article 6(1)(c) or Article 6(1)(f), as applicable.

4. Service providers and recipients

STORYFLICKS uses specialist providers to host and operate the platform. Depending on the feature used, relevant data may be processed by:

• Supabase: account authentication, database services and file storage.
• Vercel: hosting and delivery of the website frontend.
• Render: hosting of the application API and related backend processes.
• Stripe: hosted checkout and payment processing for reader support. The production integration is currently configured for Stripe test mode; it is not intended to collect real customer payments at this time.
• Google Fonts: delivery of typefaces used by the website. When the browser requests these fonts, Google may receive technical connection data such as your IP address.
• Google Gemini API: when a creator actively uses the manuscript-analysis or AI-assisted editing feature, the relevant text and instructions are sent to Google's AI service to provide the requested result.

These providers process data under their own applicable privacy terms and, where they act as processors, the relevant contractual data-processing arrangements. Data may also be disclosed where required by law or where necessary to protect the rights and security of users or the platform.

5. International data transfers

Some service providers or their subprocessors may process data outside the European Economic Area, depending on their infrastructure and configuration. Where a transfer is subject to GDPR Chapter V, it must rely on an applicable transfer mechanism, such as an adequacy decision or appropriate safeguards (for example, Standard Contractual Clauses). You can contact us for further information about the safeguards applicable to a particular transfer.

6. Public content and storage

Stories, episodes, public reviews, creator notes and artwork that you choose to publish may be visible to visitors and readers. STORYFLICKS uses a public-read storage area for assets intended for public display. Do not upload confidential or private material to a public story asset or publish content unless you have the necessary rights and intend it to be public. Private feedback is treated separately from public reviews.

7. Browser storage and cookies

The website uses browser storage needed for core functionality. Supabase authentication keeps the signed-in session in browser storage so that you remain signed in, and STORYFLICKS stores your light/dark theme preference in local storage. These functions support features you request. The inspected frontend does not currently include an advertising or analytics SDK. Third-party font requests are described above.

8. How long we keep data

We keep personal data only for as long as reasonably necessary for the purposes described in this notice. Account and activity data are generally retained while the account is active and until a valid deletion request is completed, subject to technical backup cycles and legal exceptions. Published content may remain visible while it is lawfully hosted or where continued retention is justified by the rights of others or another legal basis. Payment and accounting records may have to be retained for statutory periods. Security and infrastructure logs are retained according to the relevant provider's operational and security retention settings.

9. Your data-protection rights

Subject to the conditions and exceptions in the GDPR, you may request access, correction, erasure, restriction of processing and data portability. You may also object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting processing carried out before withdrawal.

To make a request, email exec@frankkoine.com. We may ask for information reasonably necessary to verify your identity. The GDPR right to erasure is not absolute: some information may need to be retained to comply with law or to establish, exercise or defend legal claims.

STORYFLICKS does not currently provide an automatic in-app account-deletion control. Account deletion and other rights requests must therefore be submitted by email for manual handling.

You also have the right to lodge a complaint with a supervisory authority. In Brandenburg, the competent authority is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany
www.lda.brandenburg.de

10. Security

We use technical and organisational measures intended to protect personal data, including access controls and provider security features. No internet transmission or storage system can be guaranteed to be completely secure.

11. Changes to this notice

We may update this Privacy Policy when the platform, its providers or applicable legal requirements change. The current version and its update date will be published on this page.