Privacy Policy

Last Updated: August 16, 2025

1. INTRODUCTION

RabbitNook AB ("we," "us," "our") operates the StoryNook mobile application ("the App" or "Service"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service.

Our Contact Information:

• Company: RabbitNook AB
• Address: Kaninvägen 23, 31141 Falkenberg, Sweden
• Country: Sweden
• Email: [email protected]

By using StoryNook, you agree to the collection and use of information in accordance with this Privacy Policy.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

Account Information (via Google OAuth2):

• Email address
• Full name
• Profile picture
• Google Account ID

User-Generated Content:

• Stories you create using the App
• Choices you make within stories
• Custom story choices (premium users)

2.2 Information We Collect Automatically

Usage Data:

• Stories created and choices made
• App usage patterns and interactions
• Server logs containing IP addresses
• Device and browser information for security purposes

No Additional Technical Data: We do not currently collect crash reports, device specifications, or detailed analytics beyond basic usage patterns.

2.3 Information from Third Parties

Google OAuth2: When you create an account, Google provides us with your basic profile information (email, name, profile picture) as authorized by you.

RevenueCat (Subscription Management): For users who make purchases, RevenueCat processes:

• Purchase transaction data
• Subscription status and history
• User identifiers for subscription management
• Payment verification data

For detailed information about RevenueCat's data handling, please refer to RevenueCat's Privacy Policy.

Google AdMob (Advertising): For users who consent to personalized ads, AdMob may collect:

• Advertising identifiers
• Device information
• Location data (if permitted)
• Ad interaction data

3. HOW WE USE YOUR INFORMATION

3.1 Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

Contract Performance:

• Creating and managing your account
• Providing core App functionality
• Processing subscriptions and purchases
• Storing and managing your created stories

Consent:

• Displaying personalized advertisements (you can withdraw consent anytime)

Legitimate Interest:

• Security monitoring and fraud prevention
• Server logs and IP address logging for security
• Service improvement and development
• Analyzing usage patterns to enhance user experience

3.2 Specific Uses

Core Service Delivery:

• Authenticate your account via Google OAuth2
• Store and manage your created stories
• Process story creation and AI-generated content
• Manage your story credits and subscription status
• Provide customer support

AI Content Generation:

• Your story content is sent to Google's Gemini API to generate AI responses
• Google processes this data according to their privacy policies
• We retain the generated stories in our database

Marketing and Promotion:

• Use your created stories (without personal information) for marketing purposes
• Display your stories in promotional materials anonymously
• Improve our AI and service offerings

Security and Legal Compliance:

• Monitor for fraud, abuse, and security threats
• Maintain server logs for security purposes
• Comply with legal obligations

4. DATA SHARING AND DISCLOSURE

4.1 Third-Party Services

Google Services:

• OAuth2: For account authentication
• Gemini API: For AI story generation (your story content is processed)
• AdMob: For advertising services (with consent)

RevenueCat:

• Subscription and purchase management
• Transaction processing and verification

4.2 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

4.3 Legal Disclosures

We may disclose your information if required by law, court order, or to:

• Protect our legal rights
• Investigate fraud or security issues
• Comply with legal processes
• Protect user safety

5. INTERNATIONAL DATA TRANSFERS

Primary Storage: Your data is stored on servers located in Sweden.

Third-Party Processing: Some of our service providers may process data outside the European Union:

• Google services (OAuth2, Gemini API, AdMob) may process data globally
• RevenueCat may process subscription data in the United States

These transfers are protected by:

• Google's compliance with EU-US Data Privacy Framework
• Standard Contractual Clauses approved by the European Commission
• Adequate security measures and safeguards

6. DATA RETENTION

6.1 Active Accounts

• Account information: Retained while your account is active
• Stories and choices: Retained while your account is active
• Server logs: Retained for 1 year from creation

6.2 Account Deletion

When you request account deletion:

• Personal data (email, name, profile picture): Deleted within 30 days
• Stories you created: Retained indefinitely in anonymized form for marketing and operational purposes
• Server logs containing IP addresses: Deleted after 1 year

6.3 Inactive Accounts

Accounts with no story generation activity for 12 months are automatically deleted following the same retention schedule above.

7. DATA SECURITY

We implement appropriate security measures to protect your personal information:

Technical Safeguards:

• Encrypted data transmission (HTTPS/TLS)
• Secure server infrastructure in Sweden
• Access controls and authentication systems
• Regular security monitoring

Organizational Measures:

• Limited access to personal data on a need-to-know basis
• Staff training on data protection
• Regular security assessments

Note: While we strive to protect your information, no method of transmission over the internet is 100% secure.

8. YOUR PRIVACY RIGHTS

8.1 Rights Under GDPR (EU Users)

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate or incomplete personal data
• Erasure ("Right to be Forgotten"): Request deletion of your personal data
• Restriction: Limit how we process your personal data
• Data Portability: Receive your personal data in a structured, machine-readable format
• Object: Object to processing based on legitimate interest
• Withdraw Consent: Withdraw consent for advertising or other consent-based processing

8.2 Rights Under CCPA (California Users)

• Know: What personal information we collect and how it's used
• Delete: Request deletion of your personal information
• Opt-Out: Opt out of the sale of personal information (we don't sell data)
• Non-Discrimination: Equal service regardless of exercising your privacy rights

8.3 How to Exercise Your Rights

To exercise any of these rights:

• Email us: [email protected]
• Include: Your name, email address, and specific request
• Response time: We will respond within 30 days
• Verification: We may ask for verification of your identity

9. ADVERTISING AND COOKIES

9.1 Advertising Consent

• We request explicit consent before displaying personalized ads
• You can withdraw consent anytime in app settings
• Non-personalized ads may still be shown to support free features
• Premium subscribers receive an ad-free experience

9.2 Cookies and Tracking

• Our mobile app does not use cookies
• We do not use tracking technologies beyond basic app functionality
• Third-party services (Google, RevenueCat) may use their own tracking as described in their privacy policies

10. CHILDREN'S PRIVACY

10.1 Age Requirements

• StoryNook is intended for users 13 years and older
• Users under 18 must have parental permission
• We do not knowingly collect data from children under 13

10.2 Parental Rights

If you believe we have collected information from a child under 13:

• Contact us immediately at [email protected]
• We will delete the information promptly
• Parents can request access to or deletion of their child's information

11. CHANGES TO THIS PRIVACY POLICY

11.1 Updates

• We may update this Privacy Policy periodically
• Material changes will be communicated with 30 days advance notice
• Notice will be provided via email or in-app notification
• Continued use after changes indicates acceptance

11.2 Version History

• Current version effective: August 16, 2025
• Check the "Last Updated" date at the top for the most recent version

12. CONTACT US

For privacy-related questions, concerns, or requests:

Email: [email protected]

Mail:
RabbitNook AB
Kaninvägen 23, 31141 Falkenberg, Sweden
Sweden

Response Time: We aim to respond to privacy inquiries within 30 days.

Data Protection Officer: For GDPR-related inquiries, contact us at the email above with "DPO" in the subject line.

13. SUPERVISORY AUTHORITY

EU users have the right to lodge a complaint with their local data protection supervisory authority if they believe we have not complied with privacy laws.

Sweden's Data Protection Authority:

• Website: https://www.imy.se
• For other EU countries, find your local authority at: https://edpb.europa.eu/about-edpb/board/members_en

This Privacy Policy is effective as of August 16, 2025 and applies to all users of the StoryNook application.