Privacy Policy
Effective date: August 10, 2026
Last updated: August 10, 2026
Who operates the service
AI Story Now is operated by an individual.
Scope
This policy explains how AI Story Now processes information when you visit the site, generate a story, submit predefined feedback, or contact us. The Phase 0 service does not require or provide user accounts.
Information AI Story Now stores
AI Story Now stores limited operational records using Cloudflare-hosted services. It does not intentionally persist the full story prompt or generated story in its own application database, Analytics Engine datasets, or custom business logs.
Anonymous session and usage records
The service sets a random anonymous session identifier in a first-party session cookie. For rate limits and abuse prevention, it derives protected hashes from that session identifier, a truncated network prefix, and a broad browser family. Durable Object records can include protected actor hashes, request and reservation identifiers, timestamps, status, provider-call counts, and content-free budget or cost values.
Operational logs and generation metrics
Content-free operational records can include request identifiers, timestamps, request status, provider and model labels, prompt version, selected genre, tone, length and audience, input-size and word-count buckets, token totals, latency, cost estimates, finish-reason categories, and grouped moderation outcomes. AI Story Now's custom logs and Analytics Engine datasets do not intentionally include full IP addresses, raw browser strings, Turnstile tokens, API keys, story prompts, generated stories, or raw provider response bodies.
Product events and feedback
First-party product events can include a generated event identifier, event name and time, approved page path, a protected session hash, coarse device and referrer groups, selected story options, request identifiers, and content-free performance buckets. Feedback is limited to a positive or negative choice and, for negative feedback, one predefined reason. The feedback endpoint does not accept free-text comments or story content. A content-free receipt is stored to prevent duplicate feedback.
Messages sent to support
If you email the support address, AI Story Now receives the email address, message, and other information you choose to include. Do not send story prompts, generated stories, passwords, API keys, or authentication tokens in a support message. AI Story Now does not state a fixed mailbox retention period.
Information temporarily processed
To provide a story, the Worker temporarily processes your story idea, selected genre, tone, length and audience, an anonymous session identifier, request identifiers, a Turnstile token, safety-check results, and the generated title and story. The request flow validates the input, checks abuse and budget limits, verifies Turnstile, moderates the idea, asks the story provider to generate a result, validates that result, moderates the output, and returns an approved result to your browser.
AI Story Now does not intentionally write the full story prompt or generated story to its own persistent application records during this flow. This application-storage limit does not mean that third-party services never process or retain the content sent to them. Their role is described below.
Third-party processing
Configured story generation and moderation path
The approved Phase 0 production configuration permits only direct requests to OpenAI's official APIs. It uses the OpenAI Responses API for story generation and the OpenAI Moderations API for input and output safety checks. It does not enable a relay or a fallback story provider. The deployed configuration is verified as part of the Production release process.
AI Story Now sends the story idea to OpenAI for input moderation. If the idea passes, OpenAI receives the instructions and settings needed to generate the story. The generated title and story are then sent to OpenAI for output moderation before anything is shown as a successful result.
Story-generation requests use the OpenAI Responses API with store: false. This tells the Responses API not to create application state for that response, but it does not disable OpenAI's separate abuse-monitoring processing. OpenAI's current API data-control documentation says abuse-monitoring logs may contain prompts, responses, and derived metadata and are retained for up to 30 days by default, subject to stated legal and safety exceptions. The same documentation currently lists no abuse-monitoring or application-state retention for the Moderations endpoint. These are OpenAI's current documented practices, not an AI Story Now guarantee that provider handling or retention will never change.
Cloudflare Turnstile
Turnstile processes browser and device signals to help distinguish legitimate requests from automated abuse. For server-side verification, AI Story Now sends Cloudflare the Turnstile token, the request's network address when available, and a request identifier used for idempotency. AI Story Now does not intentionally persist the Turnstile token in its own application database, custom business logs, or Analytics Engine datasets. Cloudflare's handling of Turnstile data is governed by Cloudflare's own documentation and policies; this policy does not state an unverified Turnstile retention period.
Cloudflare infrastructure
Cloudflare provides DNS and site delivery, Workers, Durable Objects, rate limiting, Workers Logs, and Workers Analytics Engine. Cloudflare processes network, browser, request, response, security, and operational information needed to deliver, protect, and operate those services. AI Story Now chooses the content-free custom log and analytics fields described above, while Cloudflare separately handles infrastructure-level data under its own services and policies.
Phase 0 does not use a third-party product analytics SDK, advertising service, payment provider, or public user-story hosting service.
Retention
- AI Story Now does not intentionally persist full story prompts or generated stories in its own application database or custom business logs. The Worker holds them only as needed to complete the current request. OpenAI processes the content separately as described above.
- OpenAI story requests use
store: false, so the Responses API is not asked to create application state for the response. OpenAI's current documentation nevertheless allows default abuse-monitoring logs containing customer content for up to 30 days, subject to its stated legal and safety exceptions. It currently lists no abuse-monitoring or application-state retention for the Moderations endpoint. - Anonymous request-attempt records are removed after 10 minutes, and successful-use records are removed after 24 hours. Actor hashes are removed when a reservation is completed or released, or within 24 hours after an abandoned reservation expires.
- Content-free budget reservations, request receipts, and feedback receipts are removed after seven days by scheduled Durable Object cleanup. Daily budget totals are cleared after seven complete UTC days; because each total covers a full UTC date, cleanup may occur during the following calendar day.
- The Cloudflare account used for Phase 0 is configured for the Standard usage model associated with Workers Paid, for which Cloudflare documents Workers Logs retention of up to seven days. The Production release process rechecks the deployed Worker against that plan. Cloudflare's current Analytics Engine documentation states that Analytics Engine data is stored for three months.
- Cloudflare's SQLite-backed Durable Object platform provides point-in-time recovery for up to 30 days. As a result, rows deleted from the active application tables may remain recoverable by the platform during that recovery window.
The anonymous session cookie remains in your browser for up to 30 days. You can remove it sooner by clearing site data in your browser.
Support emails and provider-side data are not assigned an invented retention period here. Provider handling is subject to the provider's current services, documentation, and applicable requirements.
Security
AI Story Now uses server-side request validation, Turnstile, rate and budget limits, restricted secrets, protected identifiers, content-free structured logging, and input and output moderation. These controls are designed to reduce misuse and unnecessary exposure, but no internet service can guarantee absolute security.
Privacy and data requests
To submit a privacy or data request, email support@aistorynow.com and describe your request. Because Phase 0 has no accounts and uses anonymous or protected identifiers, AI Story Now may not be able to link every operational record to an email address or person. If your request concerns a generation, you may include its request identifier. Do not include the story prompt, generated story, password, API key, or authentication token. This section provides a contact channel and does not claim privacy rights that have not been determined to apply.
Children
AI Story Now is a general-audience service and is not directed to children under 13. The Kids setting describes the intended tone and subject matter of generated content; it does not mean the service is designed for or offered directly to children. A parent or guardian should supervise use by children. Do not submit a child's full name, contact information, school details, precise location, or other identifying information. Contact us if you believe a child submitted personal information through the service.
Changes
We may update this policy when the service, providers, or data practices change. We will post the revised policy here and update the date at the top of the page. If a change materially affects how AI Story Now handles information, we will place a prominent notice on the site before or when the change takes effect. Because Phase 0 has no user accounts or subscriber list, AI Story Now does not ordinarily send individual policy-change notices by email.
Contact
For privacy questions, contact us at support@aistorynow.com.