Privacy policy

Our commitment to your privacy

At StoryBox, we take your privacy seriously. This Privacy Policy explains how we collect, use, and protect your personal information when you use our service to create audio stories.

We do not sell your data. Your information is used solely to provide and improve our services.

Your child's name, photos and voice

• Names and details you type (in a story idea, a recurring character or a classroom roster) go through OpenRouter to the models that write stories, draw pictures and generate stock voices. Custom voices use ElevenLabs. They stay in your account until you delete them.
• Photos you turn into a cartoon go through OpenRouter to OpenAI models. We don't keep the photo. If you save the character, we keep only the cartoon.
• Recordings you upload or record to clone a voice go to ElevenLabs, which keeps the cloned voice until you delete it or your account. Direct voice-cloning uploads are not retained by StoryBox. We keep a record of the permission you gave and may keep a short preview.
• Loved ones’ recording projects keep private recordings and the speaker’s permission in StoryBox so the account owner can review, download and use them for a voice. An invitation needs no sign-in, expires after 1–14 days, and can be turned off early. Anyone with an active link can submit audio; the link does not give access to saved recordings or account details. Basic voice creation sends the selected recording to ElevenLabs only when the account owner chooses to create the voice. For professional cloning, the account owner chooses when StoryBox sends the collected recordings to ElevenLabs. The speaker reads an ElevenLabs verification challenge inside StoryBox; the verification audio is forwarded for that check and is not kept in StoryBox recording storage. ElevenLabs trains the voice after successful verification. Provider request receipts and progress are kept for support and cost reconciliation.
• When a child says a story idea into the microphone, the recording goes through OpenRouter to a Microsoft speech model to turn it into text. We keep the words, not the recording.
• Stories are private unless you share a link, and you can turn sharing off at any time.

Information we collect

Account information

When you create an account, we collect:

• Email address
• Password (stored only as a secure hash, never in plain text)
• If you sign in with Google, the name and email address on your Google account
• Account preferences

Story content

When you create stories, we collect:

• Story ideas, prompts and descriptions you provide, typed or spoken
• Age range preferences
• Recurring characters you save, and their pictures
• Voice selections for characters
• Voices you design or clone, with a short preview of each
• Generated audio files and pictures

Photos and recordings

Photos you turn into cartoon characters, voice recordings you upload to clone a voice, and spoken story ideas are sent to our providers to do the job you asked for. See Your child's name, photos and voice for what we keep.

Classrooms

Teachers can add a class roster of up to 25 students, with each student's name and, optionally, their personality and interests. When someone chips in to a classroom, we collect their name, email address, their child's name (optional) and the amount contributed.

Payment information

Web payments are processed by Stripe; iPhone in-app purchases are processed by Apple. We do not store your credit card information on our servers. We only receive confirmation of successful payments and basic transaction details needed for your account. Apple receives an account identifier to associate purchases with your StoryBox account. We store verified product, transaction, subscription-period and refund details to deliver credits and prevent duplicate grants.

Usage data

We automatically collect certain information when you use our service:

• Device type and browser information
• IP address
• Pages visited and features used, such as when a story is played or downloaded
• Time and date of access

How we use your information

We use the information we collect exclusively to provide and improve our services:

• To create and deliver your audio stories
• To manage your account and process payments
• To communicate with you about your account and our services
• To improve our story generation and audio quality
• To ensure the security of our platform
• To comply with legal obligations

AI-generated content

StoryBox uses artificial intelligence (AI) to write story scripts, voice characters and draw pictures. While we use safety filters and age-appropriate guidelines, AI-generated content may occasionally produce unexpected results.

Parents, guardians, and caretakers should review all generated content before sharing it with children. We recommend listening to stories before allowing unsupervised playback.

If a story says something it shouldn't, email hello@audiobox.cc with the story's title so we can improve our safety measures.

Data sharing

We do not sell, rent, or trade your personal information to third parties.

We may share your information only in the following circumstances:

• Service providers: We use the third-party services listed below to operate StoryBox. They process data only as needed to provide their services.
• Share links: Anyone with a link you share can listen to that story until the link expires or you turn it off.
• Private voice sharing: With the speaker’s permission, you can invite specific email addresses to use a saved voice. Recipients must verify that email and accept the invitation. They can see the voice’s name, description and, while access is active, a short preview, and use it in their own stories. Sharing does not give them your recordings, account access or permission to reshare the voice. Both accounts need active paid plans. You can revoke access, and recipients can leave; stories already made keep their audio. We store the recipient address, sharing status and permission record with the original voice until that voice or its owner’s account is deleted. Accepted access is also removed when the recipient deletes their account.
• Classroom contributions: When someone chips in to a classroom, the teacher can see their name, email address, child's name and the amount contributed.
• Legal requirements: We may disclose information if required by law, court order, or government request.
• Safety: We may share information to protect the safety of our users, the public, or our company.

Third-party services

To provide our services, we use the following third-party providers:

• Supabase: stores your account, stories, characters and files
• OpenRouter: routes requests to AI providers. Our defaults use OpenAI models for stories, images and photo interpretation, ElevenLabs for stock voices, Alibaba (WAN) for optional videos, OpenAI for supporting text tasks, and Microsoft for transcription
• ElevenLabs: generates music and custom-voice speech, and creates and stores any voice you clone or design. To clone a voice, the recordings you upload or record are sent to ElevenLabs; we don't keep a copy of them. When you delete a voice, we ask ElevenLabs to delete it too.
• Stripe: takes web payments for plans, credit packs, classroom contributions and printed books
• Apple: processes iPhone subscriptions and credit packs and sends signed purchase, renewal and refund notifications to StoryBox.
• Lulu: when you prepare an edition for professional printing, receives the book PDFs for file validation. If you order a printed copy, Lulu and its delivery partners also receive the recipient’s name, address, email and phone number to print and deliver it.
• Cloudflare: sends our emails, such as sign-in links and story-ready notices
• Sentry: receives error reports so we can fix problems. We don't record your screen.
• Vercel: hosts the website

Each of these providers has its own privacy policy governing how it handles data.

Data security

We implement industry-standard security measures to protect your data:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing
• Private storage for story audio and pictures, reached only through links that expire
• Regular security audits
• Limited employee access to personal data
• Secure cloud infrastructure

Data retention and deletion

Your stories, characters and voices stay in your account until you delete them. You can delete a single story, character or voice at any time.

Recordings in Loved ones’ voices stay private until the account owner deletes their project or account. Expiring or turning off an invitation prevents new recordings; it does not delete recordings already sent. Deleting a project does not delete a voice already created from it; delete that separately in Voice studio. Invited speakers can ask the account owner or contact us to remove their recordings and voice.

You can delete your whole account at any time from Settings > Delete account. We then cancel subscriptions billed by Stripe, remove any cloned or designed voices from ElevenLabs, and delete your stories, pictures and account details straight away. Cancel Apple subscriptions separately in Apple subscription settings; deleting your account does not stop Apple billing. Apple and Stripe retain their own payment records under their retention policies. If a printed book is in progress, wait for shipment or contact support to cancel it before deleting the associated story or account. Deletion from StoryBox does not withdraw files already submitted to a printer.

Your rights

You have the following rights regarding your personal data:

• Access and correction: See and edit your stories, characters, voices and classrooms in your account, or ask us for a copy of your data
• Deletion: Delete any story, character or voice from its own page, or your whole account from Settings > Delete account
• Export: Download any finished story as an MP3
• Email: We only email you about your account and your stories. We don't send marketing email.

For anything you can't do yourself in the app, email hello@audiobox.cc.

Children's privacy

StoryBox is for parents, guardians and teachers making stories for children. Children can't have their own StoryBox account. A child may use StoryBox through an adult's account, for example by saying a story idea into the microphone; what happens to that recording is described in Your child's name, photos and voice.

If you think a child has given us information without a parent, email hello@audiobox.cc and we'll delete it.

Cookies

We use essential cookies to:

• Keep you signed in to your account
• Remember your preferences
• Ensure security of your session

We do not use cookies for advertising or tracking purposes.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by email or by posting a notice on our website. Your continued use of StoryBox after changes are posted constitutes acceptance of the updated policy.