Translation of the Spanish version. In case of divergence between versions, the Spanish version prevails.
Storyfeel is operated by Laura Flores Ramírez, Querétaro, Mexico. We believe your reading life belongs to you. Here's a plain-spoken look at what we store and why.
What you write is encrypted on your device before it leaves it, with a key derived from your password that never reaches us. In our database those fields are unreadable text: we cannot read them, and neither can anyone with access to the server. Encrypted: the contents of your diary; the text and the note of every highlight and every quote; each book's summary and best part; a series comment, a collection description and the note on an anticipated release; your story maps; and your profile picture.
Not encrypted is what the app needs in order to search, sort and display without your key: title, author, cover, rating, spice, genre, format, pages, dates, tropes, content warnings and the names of series and collections; for each highlight, its page, mood and tone; and for each diary entry, its date, font and stickers — not what you wrote in it. Your email, your username and your preferences also stay readable. None of those fields says on its own what you thought.
Encryption has a consequence worth knowing: if you forget your password and did not save your recovery key, nobody can give your writing back, us included. That is not a policy, it is an impossibility.
Your backup follows the same rule: the JSON file you download from Settings is encrypted with your password, field by field, exactly as in the database. It opens with the password you had when you downloaded it — if you change it later, that backup will still ask for the previous one, so it is worth downloading a fresh copy. The CSV export is the exception, on purpose: it is a table of books meant to be opened in a spreadsheet, so it is not encrypted.
Only to give you the service: showing your journal, syncing it across your devices, managing your subscription and saving your progress. Nothing else.
These providers may process data outside your country; where it leaves the EU/EEA we rely on the safeguards the law requires.
We never sell or share your information with third parties, whether for advertising or anything else. Full stop.
If a book isn’t in the catalogues and you type its details yourself, we keep the book record only — title, author, ISBN, cover, pages, publication and series — so the next reader looking for it finds it. Nothing of yours is ever shared: not your rating, status, dates, notes, summary, best part, spice level, tropes or content warnings. Nor is who added the book.
When you use the contact form we keep your name, your email and your message, and we use them only to answer you. They are not used for marketing, they feed no profile, and they are not shared. We do not store your IP address.
We don't keep them indefinitely either. A one-off question that needs no follow-up is deleted: a case with no activity for 60 days closes itself, and 30 days after it is closed or answered it is deleted — message and details together. There is no archive; the row stops existing. The database does this nightly, not a person who remembers to.
Payments are handled by Paddle, our Merchant of Record. We never see or store your card details.
If you choose to sign in with Google, Google shares your name and email with us to create your account. That's all.
We only use Supabase Auth session cookies, needed to keep you signed in. No tracking or advertising cookies.
We keep your data while your account is active. If an account shows no meaningful activity for 12 months, we delete it and its data after sending advance warnings that include a link to export your information. If you cancel or stop paying, your content is retained (hidden above the free-plan limits) so you can restore it by resubscribing.
You can delete your account at any time from Profile → Delete account. It deletes your account and your data right away, and cancels any active subscription. Copies may remain in our encrypted backups for up to 6 months, until they are rotated out. Paddle, as Merchant of Record, keeps its own record of your purchases (such as your name, email, country and transactions) as required by tax law; that record is governed by Paddle’s privacy policy and is not removed when you delete your Storyfeel account.
Questions? Write to us at hello (at) storyfeel.app.