Privacy Policy

Effective September 27, 2026

This Privacy Policy explains how Hatrack Digital LLC, a Maine limited liability company (“we,” “us,” or “our”), handles information when you use Story Brags at storybrags.com. We are responsible for deciding how personal information is used for this service.

1. Information we handle

Accounts and sign-in

When you request a sign-in code, we process your email address, account identifier, verification status, account and sign-in timestamps, and session information through Supabase. Authentication requests also generate technical and security information such as IP addresses, request details, and error or activity logs. We use passwordless email verification; we do not ask you to create a Story Brags password.

Stories and background images

Your story title, accomplishments, emojis, date, appearance choices, and selected background photos are processed locally while you edit. Choosing “Save to my stories” sends that story, including its background photo and settings, to your private account library in Supabase. We also store your display name, time zone, and days when you save stories to calculate streaks. Browser drafts remain on your device until you clear or replace them.

When you request an AI wrap-up and select the consent checkbox, we send the selected period’s accomplishment text, emojis, dates, and story identifiers through Vercel AI Gateway to the configured language-model provider. We do not include your email or background photos in the AI request. Generated wrap-ups, generation status, model identifiers, and token usage are stored in your account. Review AI results before sharing.

PNG images are generated in your browser. When you download an image, save it to Photos, or use your device’s share sheet, the image is passed to the destination you select. Your device, cloud photo backup provider, or receiving app may then store or process it under its own policies. We do not automatically post your stories.

Website and security information

Our hosting and infrastructure providers process information needed to deliver and protect the service, which can include IP address, browser and device information, requested URLs, referring page, timestamps, and request or error details. This information supports delivery, troubleshooting, security, and abuse prevention.

Optional analytics

If you accept analytics, Google Analytics measures visits and interactions to help us understand and improve the site. It can process cookie identifiers, page and referral information, browser and device details, approximate location, and usage events. Requests to Google also expose your IP address for processing. We do not send your account email, sign-in codes, story text, or selected photos as analytics event parameters. We remove query strings and fragments from the page URL supplied to Analytics and reduce referral URLs to their origin.

Communications

If you contact us, we receive the contact details and information you choose to provide, along with related correspondence. Please do not send sign-in codes, passwords, or unnecessary sensitive information in support requests.

2. How we use information

• Provide the website, create and verify accounts, and maintain sign-in sessions.
• Send requested authentication emails and necessary service or security notices.
• Respond to support, privacy, and account requests.
• Diagnose problems, prevent abuse, protect accounts, and meet legal obligations.
• Understand site usage and improve the service through optional, consent-based analytics.

The current app sends authentication and service-related emails, not a marketing newsletter. Creating an account does not subscribe you to promotional emails. We do not use your locally edited stories to train AI models.

3. Service providers and disclosures

We use the following services in the current product:

• Vercel — website hosting and delivery. Vercel serves the site and its assets and processes technical request and security information. See Vercel’s Privacy Notice.
• Supabase — accounts and authentication. Supabase stores account information and processes sign-in, session, and authentication-security records on our behalf. Our current project is hosted in the US East region. Supabase also stores profile information, saved stories and photos, streak activity, generated wrap-ups, and billing-customer identifiers. See Supabase’s Privacy Policy.
• Stripe — subscription payments. Stripe processes checkout, billing, payment details, and subscription management. See Stripe’s Privacy Policy.
• Vercel AI Gateway and the configured model provider — optional AI wrap-ups. They process the story data described above to generate your requested recap. The default model provider is OpenAI. See Vercel’s Privacy Notice and OpenAI’s Privacy Policy.
• Resend — authentication email delivery. Resend processes recipient email addresses, verification email contents (including the one-time code), and delivery records such as send, delivery, bounce, or complaint status. Verification emails are sent as Story Brags from login@storybrags.com. See Resend’s Privacy Policy.
• Google Analytics — optional usage measurement. With your permission, Google processes usage information and cookies for analytics. Our tag disables Google signals and advertising personalization and does not grant advertising consent. See How Google uses information from sites that use its services.
• Google Fonts — typography. The editor requests font files and styles from Google. These requests disclose your IP address and technical request information, such as browser headers and potentially the referring website, to Google. See Google’s Privacy Policy and Google Fonts information.

Our providers may use their own infrastructure providers to perform these services. We may also disclose information where reasonably necessary to comply with law or valid legal process, protect rights and safety, investigate abuse, or carry out a merger, acquisition, or transfer of the business with appropriate privacy safeguards. We may disclose information at your direction.

We do not sell personal information or share it for cross-context behavioral advertising, and we do not run advertising pixels or targeted ads in the current service. Google Analytics loads only after you accept optional analytics. Declining does not limit the editor or your account. Stripe processes optional Premium payments. We store a Stripe customer identifier and event-delivery identifiers, and retrieve subscription status to determine access. Stripe handles payment details; our application does not receive full card numbers.

4. Browser storage and tracking choices

• Draft storage: the story-brags localStorage entry stores your current story, background image, and editor settings. It remains after signing out.
• Sign-in storage: Supabase uses localStorage to retain authentication tokens and session information so you can stay signed in. Signing out clears the current browser’s sign-in session.
• Emoji picker: the picker uses browser IndexedDB for its emoji catalog and preferences, such as frequently used emojis and skin-tone selection. The emoji data is served from Story Brags rather than an external emoji service.

The app uses this storage for its features rather than advertising. You can clear Story Brags site data in your browser settings to remove local drafts and preferences and sign out locally. This may permanently remove unsaved work. Clearing browser data does not delete your server-side account, and deleting an account does not clear site data on your devices. To remove a selected background photo from the current draft, use “Remove uploaded background.”

Our analytics choice is stored in localStorage for up to 180 days. If you accept, Google Analytics may set first-party cookies such as _ga and _ga_74T4C3RCGW, configured to expire after 180 days without extending that expiry on every visit. Use Privacy choices in the footer at any time to accept or decline. Declining stops future analytics collection and removes accessible Analytics cookies; it does not erase data already received by Google. We keep analytics off when your browser sends Global Privacy Control or Do Not Track. Before consent, our site does not load the Google Analytics tag or send Analytics measurement requests. Hosting and security providers may use technical storage or cookies where needed to deliver and protect the service.

5. How long information is kept

Local drafts and preferences remain until you replace or remove them, clear site data, or your browser removes them. We cannot recover or remotely erase those local copies.

Account information is kept while your account remains open and as needed to provide authentication. You may request deletion at any time. Some records may need to be kept for legal obligations, security investigations, or resolving disputes; we limit any such retention to its purpose.

Saved stories, wrap-ups, profile information, and streak activity remain while your account is open. You can delete saved stories from your dashboard and request deletion of other account data using the contact information below. Ending Premium does not automatically delete your library. Billing providers may retain transaction records for their legal and operational requirements.

Analytics: browser consent preferences and Analytics cookies have the lifetimes described above. Data already received by Google follows the Analytics property’s retention settings and Google’s applicable terms; withdrawing permission stops future collection but does not automatically delete earlier records. You can contact us about deletion requests.

Email records: Resend currently documents a 30-day retention period for email and log data on our plan. Backups and records retained for security or legal purposes may follow separate schedules. See Resend’s retention information.

Technical logs and support correspondence are kept for the period needed to operate and secure the service, resolve your request, and satisfy applicable obligations. Retention depends on the record’s purpose, provider settings, and any legal or security need. Deletion from backups may occur through their normal rotation rather than immediately. Copies in your email inbox, photo library, or apps you share with are controlled by you and those services.

6. Your choices and privacy requests

You can edit or remove content in your local draft, clear your browser’s site data, sign out through Account, or decide not to share an image. Contact us below to request access to, correction of, or deletion of account information. There is currently no self-service account-deletion button. Use your account email if possible; we may need reasonable information to verify that a request is yours. Never send us your sign-in code.

Depending on your location and applicable law, you may also have rights to receive a portable copy of your information, restrict or object to processing, withdraw consent where processing relies on consent, appeal a denied request, or complain to a privacy regulator. To request a review of our response, reply to us using the contact details below. We will respond within applicable legal timeframes and will not discriminate against you for exercising applicable privacy rights.

7. International processing and legal bases

We operate from Maine, United States. Our service providers may process information in the United States and other countries where they or their infrastructure providers operate. Those countries may have different data-protection laws. Where required, we rely on appropriate contractual or other lawful safeguards for transfers; you may contact us for information about applicable safeguards.

Where data-protection law requires a legal basis, we process account and authentication information to provide the service you request; technical and security information for our legitimate interests in running a reliable, secure service; and certain information to meet legal obligations. We rely on consent for optional Google Analytics and wherever else consent is required, and allow it to be withdrawn. We do not make automated decisions that produce legal or similarly significant effects about you.

8. Children

Story Brags is intended for people 13 and older. Users under 18 or the age of legal majority where they live must have parent or guardian permission. We do not knowingly collect personal information from children under 13. If you believe a child has provided account information in violation of this policy, contact us so we can investigate and take appropriate action.

9. Security

We use HTTPS and managed authentication and restrict administrative access to help protect information. No online service or device storage is completely secure. Keep your device and email account secure, do not share sign-in codes, and sign out and clear local site data when using a shared device.

10. Policy changes

We will update this policy when our practices change and revise the effective date. For material changes, we will provide additional notice through the service or by email where appropriate, and obtain consent where required. This policy describes Story Brags; other websites and apps have their own privacy practices.

11. Contact us