Privacy Policy

Who we are

StoryRoom is operated by WisGen AI (ABN 27 484 579 859), Sydney, Australia. Privacy questions and requests go to info@wisgen.ai. This page says what we collect, who else touches it, and what you can ask us to do about it.

What we collect

• Sign-in details. Your name, your email address and a unique id from your sign-in provider. Early accounts use a username and a password, which we store only as a hash.
• The content you add. Your recordings, the text they are transcribed into, what you type, and your edits. (Accounts that used StoryRoom before 20 October 2026 may also hold photographs of pages and their readings; photo uploads are switched off.)
• Your age confirmation. That you confirmed you are 18 or older, and when.
• Usage records. How many minutes of recording were transcribed, and when — and, for older accounts, which readings ran and what each one cost.
• Reports. If you report something, or something in your account is reported: the reason, the reporter's own words, which item it was about, and what we did about it.
• Payment records from Stripe. The amount, the card brand and the last four digits. We never see or store the full card number.
• Technical logs. IP address, browser and timestamps, kept for 30 days.

Why we use it

To provide the service, to bill for it accurately, to keep it secure, and to fix it when it breaks — and to improve the reader, only if you have said we may. We do not sell your data, we do not pass it to data brokers, and there is no advertising on StoryRoom.

Who processes it

Four companies handle part of it. Each receives what it needs and nothing else.

• Amazon Web Services. Stores your recordings and text and runs the database and the application.
• Deepgram. Transcribes your recordings; it receives the audio and processes it in the United States, on Deepgram's own hosted API. Every recording is sent with Deepgram's opt-out from model training, so Deepgram keeps the audio only for as long as it takes to transcribe it and does not use it to train its models.
• Google. Sign-in. It tells us your name, your email address and a unique id. Your Google password is never sent to us and we could not read it.
• Stripe. Card payment. Your card details go straight to Stripe; we receive the amount, the card brand and the last four digits, never the full number.

Where it is stored

Your content is stored and processed on Amazon Web Services and may be processed in more than one AWS region. We do not promise a fixed country or region: there is no requirement for one here, and naming a place would turn an operational choice into a promise we would then have to keep.

How accounts are kept apart

We would rather be exact than reassuring, so this section says exactly what keeps accounts apart, and where that stops.

Anyone can now open a StoryRoom account, so this section is a statement to every account holder. All three of the layers we wanted are built and tested.

• Every row of writing records the account it belongs to, and the database refuses to file one account's work under another.
• The application filters every request by the account you signed in as. A request for another account's writing is answered as though that writing were not there — the same answer a request for something that genuinely does not exist receives, because any other answer would itself disclose that it exists.
• And now the database enforces this itself, underneath the application. If our own code ever asked for a row without saying which account it was acting for, the database does not hand back somebody else's writing and does not quietly return nothing: the request fails outright and we get an error we can find. That is the point of doing it this way round — a mistake of ours becomes a fault we have to fix, rather than a disclosure you would never hear about.

Every release is checked by tests that try each of those doors as the wrong account and require all of them to be shut, and that check the database's own rules are still switched on. We said we would state each layer here when it was finished and tested and not before; this is the last of the three.

Nobody at StoryRoom reads your stories, and nothing scans them. There is no application back door and no staff screen for reading what you write. That is a design commitment rather than a policy, and it is built and tested: the operator's console shows who has an account, when it was opened and its balance, never what anybody wrote. When something is reported, the item is hidden without anyone reading it, and staff see only the report's details — the reason, the reporter's words, the account and the item's number. If the police lawfully ask for a reported item, we give it to them; see the Safety page. It is a weaker claim than saying no human being could ever reach what is stored — an engineer holding the database owner credential could, and that is precisely why that credential is used for migrations and for nothing else, and why the running application is no longer able to read that credential at all.

Training the reader

Two boxes are shown when an account is created. Both start unticked, and if you leave them that way we do not train anything on your content.

• Improve my own reader. Your corrections are used to train a reader for your own hand, and for nothing else.
• Contribute to the shared reader. Your pages and corrections may be used to improve the reader that everyone uses.

Neither of these happens today: no model is trained on anyone's content yet. We ask now so that, if we ever build one, it learns only from people who said yes.

You can change either choice at any time under Account, at the top of every page once you are signed in. Each change is recorded with its date. Withdrawing consent is forward-looking: it stops any further use of your content from that moment. It cannot remove what a model has already learned, and we will not pretend otherwise.

How long we keep it

• Your content: until you delete it or close your account.
• A reported item: kept, hidden and unread, for as long as the police may need it, then removed.
• Reports and what we did about them: at least two years — online-safety rules require us to keep that record.
• Technical logs: 30 days.
• Payment records: as long as financial and tax law requires us to keep them.

Your rights

Download everything, in the app, gives you all your stories and recordings at any time. You can also ask for a copy of what we hold, ask us to correct it, or ask us to delete it. Write to info@wisgen.ai from the account's email address and we will act within a reasonable time — usually days, not weeks.

The Australian Privacy Act 1988 applies to us. If you are in the United Kingdom or the European Economic Area, the GDPR rights of access, rectification, erasure, portability and objection apply to you as well. If we get something wrong, tell us first; if we do not put it right, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Cookies

One cookie, and it is essential: the session cookie that keeps you signed in. No analytics, no advertising, no third-party trackers.

Children

StoryRoom is for adults: you must be 18 or older to have an account, and we do not knowingly collect children's details. A story about a child may of course be recorded by the adult whose account it is.

Changes to this policy

We post changes here with the date at the top, and we tell account holders directly about any change to how their content is used.