Privacy
Storygarden holds a family's photographs, recordings, and the small things a child said. This page says exactly what is stored, who can reach it, how long it stays, and how to take it back.
Last updated: 1 September 2026.
The short version
- There is no public feed. Nothing you save is visible to anyone unless you create a share yourself.
- There are no adverts, and we do not sell or rent your data to anybody.
- We do not build advertising profiles, and we do not track you across other apps or websites.
- A child's photograph or recording is never sent to an AI provider.
- You can export everything, and you can delete everything.
What we store
Your account
Your email address, a display name if you set one, your timezone, and the date you confirmed you are an adult. If you sign in with Apple using Hide My Email, we only ever see the relay address Apple gives us.
What you put in
The children you add — a name you choose, an optional birth year, an optional photograph. The memories you save: their text, dates, tags, and the photographs, videos, and voice recordings attached to them. Family calendar entries, if you create a family.
A birth year, not a date of birth. It is the least the app needs to show an age beside a memory, and a full date is a piece of identity information the product has no use for.
Your phone number, if you use Text Capture
Text Capture lets you save a memory by sending a text message. If you turn it on, we store your number in two forms: a one-way hash used to recognise incoming messages, and the number itself, which the messaging network requires in order to reply to you. The last four digits are stored separately so the app can show you which number is connected without displaying the whole thing.
The text of an incoming message is deleted after 30 days. The memory it created is yours and is not touched.
People you share with
If you invite someone by email, we store the address you typed, because an invitation has to be delivered to it, along with a one-way hash used to recognise the same person invited twice. If they accept and leave a comment or a reaction, we store that too.
Things the app records about itself
A log of significant account events — an export requested, a share revoked, an account deletion — kept so that you and we can tell what happened. Counters for how much storage an account is using. Device tokens, if you turn notifications on.
What we do not store
- Your location. The app never asks for it. Location permissions are explicitly blocked in the Android build. A place on an event is a line you typed, never something read from your phone.
- Your contacts. Never read.
- Your password for any other service. Storygarden never asks for the password to your email, and cannot read your mailbox. Inviting somebody sends them a message; it does not give us access to anything of theirs.
- Payment card details. Purchases go through Apple, Google, or Stripe. We are told that a payment succeeded, not what it was made with.
Who can see what you save
By default: you. Every record in the database is checked against the account asking for it, at the database itself rather than in the app — so an app with a bug still cannot read another family's memories. Media files are held in private storage and reached only through short-lived links generated for you at the moment you open them.
Other people see something only when you decide they should:
- A share link shows exactly what you selected, to anybody holding the link. You can add a passcode, and you can turn the link off at any time.
- An invited person sees what you granted them and nothing else. Comments and reactions are off unless you turn them on.
- A family shares a calendar and nothing more. Being in someone's family does not show you their children's timelines.
- A calendar subscription link shows your view of one family calendar to anybody holding it, until you turn it off.
Our staff do not browse your memories. Access to production systems is limited to what is needed to operate the service and to respond to a support request you make.
Artificial intelligence
One feature uses a model, and only one. When you text a message to Text Capture, the text may be sent to Anthropic to suggest a title, a date, or a child's name when the app cannot work them out itself. The rules are enforced in code:
- Text only. A photograph, video, or voice recording is never sent to any AI provider.
- The suggestion never rewrites what you wrote.
- It never chooses a child on your behalf; it can only suggest a name, which the app then matches exactly or not at all.
- Nothing you save is used to train any model.
Who else is involved
Running the service means other companies handle some of it. Each one is given the least it needs.
| Company | What it does | What it sees |
|---|---|---|
| Supabase | Database, file storage, sign-in | Everything you save, held on its infrastructure |
| Twilio | Text Capture messages | Your number and the message you sent, only if you turn it on |
| Anthropic | Suggests details from a texted message | The text of that message. Never a photograph or a recording |
| Resend | Sends invitation email | The recipient's address and the invitation |
| Expo | Delivers notifications | A device token and the words on the notification |
| Apple, Google, RevenueCat, Stripe | Purchases | That a purchase happened, and its status |
| Cloudflare | Serves the website | Ordinary web request information |
Notifications deliberately carry no detail — never a child's name, never the text of a message, never a picture — because a notification appears on a locked screen where anyone nearby can read it. The one exception is a calendar reminder, which carries the title of the event you asked to be reminded about.
How long things are kept
| What | How long |
|---|---|
| Your memories, children, and media | Until you delete them, or your account |
| The text of an incoming Text Capture message | 30 days |
| An upload you started but never saved | 24 hours |
| A data export you requested | 7 days, then deleted |
| Record of a calendar reminder having been sent | 90 days |
| Account event log | Kept, including the record that an account was deleted |
These windows are enforced by a job that runs on a schedule, not by intention. A retention policy nobody executes is not a policy.
Getting your data out, and getting rid of it
Export. Settings → Export my data produces an archive of your memories and media, delivered by a private link that expires.
Deletion. Settings → Delete my account and all data, or ask us here without installing anything. Deletion removes database records, stored files, thumbnails, exports, and the phone number mapping. A record that a deletion happened is kept, because being unable to show that we deleted something is its own problem.
Backups roll off on their own schedule, so a deleted item may persist in a backup for a short period before it is overwritten. It is not restored into the service.
Depending on where you live, you may also have the right to correct your data, object to or restrict how it is handled, or complain to a regulator. Write to us and we will help.
Children
Storygarden is for adults. You confirm you are an adult when you create an account, and children do not have accounts.
The whole point of the product is that it holds information about a child — that is what a parent is saving. It is entered by the parent, held privately, and shared only when the parent chooses. We do not collect anything from a child directly, and a child cannot sign in.
Sharing a timeline with the child themselves, years later, is something we intend to build carefully rather than quickly. It does not exist yet.
Security
Every table is protected at the database level so a request can only reach the rows it belongs to. Media is stored privately and served by short-lived links. Share and invitation links are long random tokens, and only a one-way hash of each is stored — which is why a lost link is replaced rather than looked up. Passcodes on share links are hashed. Sessions are held in the phone's secure keychain. Your phone number, and the email address of anyone you invite, are hashed with a secret value before being used for lookups.
No system is perfect. If something goes wrong that affects you, we will tell you.
Where your data lives
Our infrastructure providers operate globally, and your data may be stored or processed in a country other than your own, including the United States.
Changes
If this page changes in a way that matters, we will say so in the app before the change takes effect. The date at the top is always current.
Contact
Write to support@story-garden.app. A real person reads it.