Privacy Policy

1. Information We Collect

We collect the following information when you use StoryEngine:

• Account information: Name, email address, and Google profile data when you sign in with Google.
• API keys: Third-party API keys you provide (stored encrypted in our secure vault).
• Content data: Video titles, scripts, prompts, and generated assets created through the pipeline.
• Usage data: Pipeline usage, feature interactions, and performance metrics.
• YouTube data: When you connect a YouTube channel, the channel ID and name, your channel's video list and public video statistics (views, likes, comments), and the analytics you authorize, read through YouTube API Services. See section 3.

2. How We Use Your Information

• To provide and operate the video production pipeline.
• To authenticate your identity and manage your account.
• To execute API calls to third-party services using your provided keys.
• To display analytics and performance data for your videos.
• To improve the Service based on aggregate usage patterns.
• To send important account notifications (billing, security, service updates).

3. Google & YouTube Data

StoryEngine uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.

When you connect Google, StoryEngine asks for these permissions and uses them only for these features:

• Upload videos to YouTube (youtube.upload): to upload the videos you produce in StoryEngine to your channel. Uploads are unlisted unless you choose another setting, and use the title, description, tags and thumbnail you approve. StoryEngine never makes a video public on its own.
• View your YouTube account (youtube.readonly): to confirm which channel is connected, check that each upload landed on that channel, and read your videos and their statistics to show performance and suggest titles and topics.
• Google Drive files created by StoryEngine (drive.file): to save the scripts, images, audio and videos StoryEngine makes for you. StoryEngine cannot see any other files in your Drive.

How it is stored: the Google access key (refresh token) is stored in our database, which is encrypted at rest, and is used only by our servers. Channel details and video statistics are stored with your workspace, isolated from other workspaces.

How it is shared: we do not sell Google user data, use it for advertising, or give it to data brokers. To produce your features (for example, suggesting titles based on how your past videos performed), video statistics may be sent to the AI providers listed in section 6, only to produce results for you. Google user data is never used to train general AI or machine-learning models.

StoryEngine's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How to remove access: disconnect YouTube or Google Drive on the StoryEngine Settings page, which deletes the stored access key at once, or remove StoryEngine at Google security settings. To delete the YouTube data we stored, delete your account or email us (section 11); we delete it within 30 days.

4. API Key Security

Your API keys are encrypted at rest and in transit. We never share your keys with other users or third parties beyond the services they are intended for. Keys are only used to execute pipeline operations you initiate. You can delete your keys at any time from the Settings page.

5. Data Storage & Retention

Your data is stored in Supabase PostgreSQL with row-level security. Each tenant's data is isolated. Generated assets (images, videos, audio) are stored in Google Drive under your account. We retain your data for as long as your account is active. Upon account deletion, all associated data is permanently removed within 30 days.

6. Third-Party Services

StoryEngine integrates with the following third-party services, each with their own privacy policies:

• Google (Authentication, YouTube Data API, Google Drive)
• Stripe (Payment processing)
• Anthropic (AI script generation)
• ElevenLabs (Voice synthesis)
• OpenAI (Audio transcription)

We recommend reviewing each provider's privacy policy. We are not responsible for the data practices of these third-party services.

7. Cookies & Tracking

We use essential cookies for authentication (session tokens). We do not use third-party tracking cookies or advertising trackers. We may use anonymous analytics to understand usage patterns.

8. Your Rights

• Access: You can view all your data through the StoryEngine dashboard.
• Deletion: You can delete your account and all associated data at any time.
• Export: You can export your video data, scripts, and assets.
• Correction: You can update your profile and settings at any time.

9. Children's Privacy

StoryEngine is not intended for users under 18 years of age. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes via email or in-app notification. Continued use of the Service after changes constitutes acceptance.

11. Contact

For privacy-related questions or data requests, contact us at ryan@nativestates.ai.