Legal
Privacy Policy
This Privacy Policy explains what personal data we collect when you use the uStory mobile app and the ustory.app website (together, the "Service"), why we collect it, who we share it with and what choices you have. It is written to meet the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the EU and UK General Data Protection Regulation ("GDPR") and the app store privacy requirements.
In short
- We do not sell your personal data.
- Ads are personalized only if you allow it.
- To write the next page of a story, our AI providers receive the story's text and the choice you made, not your name, email address or payment details.
- You can delete your account at any time in the app: Profile › Settings › Help › Delete Account.
1. Who We Are
uStory ("uStory", "we", "us") is based in Türkiye and is the data controller for the personal data described in this policy. You can reach us at info@ustory.app about anything in this policy, including requests to exercise your rights.
This policy does not cover third-party websites or services that the Service links to; their own privacy policies apply.
2. The Data We Collect
Account data
You need an account to read stories. When you create one, we collect:
- Email sign-in: your email address and the one-time verification codes we send you.
- Sign in with Apple or Google: the account identifier, your name and the email address that Apple or Google shares with us (with Apple, this can be a private relay address). We never receive your Apple or Google password.
- Profile: your name, username, biography and profile photo, your app language and preferred story language.
Content you create
Stories you write (title, description, backstory, pages, choices, labels, language and cover image), comments and replies, likes, the writers you follow, your library, the reports you submit and the accounts you block.
Reading activity
The stories you start and finish, the choices you make, your progress, endings reached, scores, badges and contest participation. We use this to save your place, show your achievements and count reads.
Purchases
Payments are processed by Apple (App Store) or Google (Google Play). We never see or store your card details. We receive and keep your subscription status, the product you bought, purchase and renewal dates, store transaction identifiers, your uMoney balance and the history of uMoney you earned and spent.
Device and usage data
- A device identifier (Android ID or Apple's identifier for vendor), device model, operating system and app version, language and time zone offset.
- A push notification token, if you allow notifications.
- Usage events such as screens viewed, sign-ins and shares; crash reports and performance diagnostics.
- Your IP address and request details, recorded in server logs when the app or website contacts our servers.
Advertising identifiers
The advertising identifier of your device (IDFA on iOS, Google advertising ID on Android). On iOS, apps can access the IDFA only after you allow tracking in the App Tracking Transparency prompt.
Messages to us
When you email us or use the contact form on ustory.app, we receive your name, email address, the topic and your message. The contact form also records the page, your IP address and browser type to prevent abuse.
We do not ask for sensitive personal data, such as health, religion or ethnicity. Please do not include it in your stories, profile or messages.
3. How We Use Your Data and Our Legal Bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and securing your account, signing you in | Account data, device data | Performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)) |
| Providing the Service: reading, choices, writing and publishing stories, comments, follows, library | Account data, content, reading activity | Performance of a contract |
| Generating story pages with AI | Story content and the choices made (see section 4) | Performance of a contract |
| Subscriptions and uMoney: granting, restoring and refunding access | Purchase data, account identifier | Performance of a contract; legal obligation for records we must keep |
| Safety and moderation: reviewing reports, removing content, preventing fraud and abuse | Content, reports, blocks, device data, IP address | Legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)); legal obligation |
| Fixing errors and keeping the app stable | Crash reports, diagnostics, device data | Legitimate interest |
| Understanding how the Service is used and improving it | Usage events, device data | Legitimate interest; consent where the law requires it, such as website analytics cookies |
| Showing ads that support free reading, including rewarded ads | Device data, IP address; advertising identifier only with permission | Legitimate interest for contextual ads; consent for personalized ads and tracking |
| Measuring our own ad campaigns and app installs | Device data, advertising identifier, app events | Consent |
| Push notifications about replies, follows and new stories | Push token, account data | Consent (you can turn notifications off at any time) |
| Service emails, such as verification codes and important changes | Email address | Performance of a contract |
| Answering your messages and requests | Messages, contact details | Legitimate interest; legal obligation for rights requests |
| Complying with the law and defending legal claims | Any relevant data | Legal obligation; establishment, exercise or defense of a right (KVKK Art. 5/2-e) |
Where we rely on consent, you can withdraw it at any time without affecting processing that happened before. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
4. AI Story Generation
uStory stories continue with the help of artificial intelligence. A writer sets up the beginning of a story; when a reader picks a choice whose page has not been written yet, our servers ask an AI model to write the next page and its choices.
- What the AI receives: the story's title, description, backstory and language, the previous pages of the path and the choice made. If you are a writer, this includes the content you wrote for that story.
- What it does not receive: your name, username, email address, photo or payment details.
- Who processes it: third-party AI model providers that we access through their APIs, and an AI monitoring service that stores the request, the generated page and a numeric account identifier so we can check quality, safety and costs.
- Generated pages become part of the story and can be shown to other readers who make the same choices.
AI-generated text can be unexpected or wrong. If a page breaks our rules, please report it in the app.
5. Advertising and Tracking
uStory shows interstitial ads, and rewarded ads that let you unlock some options for free. Ads are delivered by an ad mediation provider and the ad networks it works with. These partners may receive your device data, IP address and, only if you allow it, your advertising identifier.
- iOS: you can allow or refuse tracking in the App Tracking Transparency prompt and change your choice later in Settings › Privacy & Security › Tracking.
- Android: you can reset or delete your advertising ID in your device's Google or privacy settings.
- EEA, UK and some US states: the ads SDK shows a consent form where the law requires one. Without consent, you see non-personalized ads.
We also use Meta's app events and a deep linking provider to measure installs from our own campaigns and to make shared links open the right story. These tools use your advertising identifier only if you allowed tracking.
6. Who We Share Data With
Other users. Your profile (name, username, photo, biography), the stories you publish, your comments, your followers and the writers you follow, and your badges are visible to other users and, for public stories and profiles, on ustory.app and in search engines.
Service providers. We use the following providers, who process data on our behalf or as independent controllers under their own terms:
| Provider | Purpose |
|---|---|
| Google Firebase (Analytics, Crashlytics, Cloud Messaging) | Usage analytics, crash reports, push notifications |
| Apple and Google | Sign-in, app distribution, in-app payments |
| Ad mediation provider and its ad network partners | Serving and measuring ads |
| Meta Platforms (Facebook app events) | Measuring our ad campaigns |
| AI model providers and our AI monitoring service | Generating story pages and checking their quality (see section 4) |
| Google Analytics | Website visitor statistics |
| Server and database hosting providers | Running the uStory API and database |
| Cloud storage provider | Storing profile photos and story covers |
| Email service provider | Sending verification codes and service emails, receiving contact form messages |
| Website hosting and security provider | Hosting and protecting the ustory.app website |
| Subscription management provider | Managing subscriptions and purchases (receives your account identifier, email address and purchase history) |
| Deep linking provider | Share links, deep links and install attribution |
Authorities. We disclose data when the law requires it, for example in response to a court order or a lawful request from a public authority, or to protect the rights, property and safety of our users and others.
Business transfers. If uStory is merged, acquired or sold, user data may transfer to the new owner, who will remain bound by this policy until it is changed with notice.
We do not sell your personal data and do not share it for cross-context behavioral advertising, except through the ad partners described above when you allow it.
7. International Transfers
Several of our providers store or process data outside Türkiye and your country, including in the European Union and the United States. When we transfer personal data abroad, we rely on the safeguards available under KVKK Article 9 and GDPR Chapter V, such as adequacy decisions and standard contractual clauses, or, where applicable, your explicit consent.
8. How Long We Keep Data
- Account data and content: for as long as your account is active.
- Deleted accounts: your profile, stories and comments are removed from public view immediately. We delete or anonymize your personal data within 30 days, except for the records described below.
- Purchase and uMoney records: for as long as tax and commercial law requires.
- Safety records: reports and data about rule violations for as long as needed to prevent repeated abuse, and no longer than two years after the account is closed, unless a legal dispute requires longer.
- Verification codes: until used or expired.
- Messages to us: up to two years after the conversation ends.
- Server logs, analytics and crash data: for limited periods set in our providers' tools, after which they are deleted or aggregated.
AI-generated pages and the stories other users wrote are not your personal data and remain in the Service after your account is deleted.
9. Your Choices and Rights
In the app
- Edit your name, username, biography, photo and email address in your profile settings.
- Delete your account: Profile › Settings › Help › Delete Account.
- Turn push notifications off in your device settings.
- Block other users and manage blocked accounts.
- Manage or cancel your subscription in your App Store or Google Play account.
Your legal rights
Under KVKK Article 11 and, where it applies, the GDPR, you have the right to:
- learn whether we process your personal data and request information about it;
- learn the purpose of processing and whether data is used for that purpose;
- know the third parties in Türkiye or abroad to whom your data is transferred;
- request correction of incomplete or inaccurate data;
- request deletion or destruction of your data, and notification of these actions to the third parties who received it;
- object to a result against you that arises solely from automated analysis;
- claim compensation for damage caused by unlawful processing;
- receive your data in a portable format, restrict processing and object to processing based on legitimate interests (GDPR);
- withdraw consent at any time.
Send your request to info@ustory.app from the email address on your account, or tell us your username. We may ask you to verify your identity. We answer free of charge within 30 days at the latest. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (KVKK) or to the data protection authority in your country.
10. Children
You must be at least 13 years old to create a uStory account. If you are under 18, you need the permission of a parent or legal guardian. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, contact us and we will delete it.
11. Security
We protect your data with encrypted connections (HTTPS), access controls, signed sign-in tokens, verification codes instead of passwords, and limited staff access. No system is completely secure; if a breach affects your personal data, we will notify you and the competent authority as required by law.
12. Website and Cookies
ustory.app uses the following cookies and similar technologies:
| Name | Purpose | Duration |
|---|---|---|
NEXT_LOCALE | Remembers the language you chose | 1 year |
ustory_ui_lang | Keeps story and writer pages in the language you are browsing in | Session |
ustory-theme, ustory-locale-banner, ustory-demo-endings (local storage) | Remember light or dark mode, a dismissed language suggestion and the endings you found in the demo story | Until you clear them |
ustory-consent (local storage) | Remembers your cookie choice | 6 months |
_ga, _ga_* | Google Analytics visitor statistics, only if you accept analytics cookies | Up to 2 years |
All but the Google Analytics cookies are strictly necessary for the site to work as you set it, so they do not need your consent. Google Analytics is loaded only after you accept it in the cookie banner; if you reject it, no analytics cookies are set and the site works the same. You can change your choice at any time with Cookie settings at the bottom of every page; when you withdraw consent, we stop Google Analytics and delete its cookies. You can also block or delete cookies in your browser settings.
13. Changes to This Policy
We update this policy when the Service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your personal data, we will tell you in the app or by email before it takes effect, and ask for your consent where the law requires it.
14. Contact
For questions about this policy or your personal data, write to info@ustory.app.
Questions about this document? Write to info@ustory.app.