Privacy Policy
Effective date: August 10, 2026
Last updated: August 29, 2026
Who operates the service
AI Story Now is operated by an individual.
Scope
This policy explains how AI Story Now processes information when you visit the site, generate a story, submit predefined feedback, or contact us. The service does not require or provide user accounts. The Bedtime flow is designed for a parent or caregiver to operate, not for a child to use independently.
Information AI Story Now stores
AI Story Now stores limited operational records using Cloudflare-hosted services. It does not intentionally persist the full story prompt or generated story in server-side application storage, Analytics Engine datasets, or custom business logs.
Story Studio data on this device
When you explicitly choose Save to Story Studio, the browser can store the story title and text, controlled settings, local version history, and one already-generated Bedtime cover in IndexedDB on that browser and device. This local data is not an account, cloud backup, sync service, public story, or server-side story record. Clearing site data can remove it, and Story Studio provides a delete-from-this-device action.
Anonymous session and usage records
The service sets a random anonymous session identifier in a first-party session cookie. For rate limits and abuse prevention, it derives protected hashes from that session identifier, a truncated network prefix, and a broad browser family. Durable Object records can include protected actor hashes, request and reservation identifiers, timestamps, status, provider-call counts, and content-free budget or cost values.
Operational logs and generation metrics
Content-free operational records can include request identifiers, timestamps, request status, provider and model labels, prompt version, selected genre, tone, length and audience, input-size and word-count buckets, token totals, latency, cost estimates, finish-reason categories, and grouped moderation outcomes. AI Story Now's custom logs and Analytics Engine datasets do not intentionally include full IP addresses, raw browser strings, Turnstile tokens, API keys, story prompts, generated stories, or raw provider response bodies.
Product events and feedback
First-party product events can include a generated event identifier, event name and time, approved page path, a protected session hash, coarse device and referrer groups, selected story options, request identifiers, and content-free performance buckets. Feedback is limited to a positive or negative choice and, for negative feedback, one predefined reason. The feedback endpoint does not accept free-text comments or story content. A content-free receipt is stored to prevent duplicate feedback.
Bedtime product events use controlled values such as age band, theme, mood, reading time, whether a cover was requested, and the number of selected interests. They do not record the selected interests, a fictional hero name, story text, cover brief, project or asset identifiers, or image bytes. Cloudflare currently retains Analytics Engine data for three months.
Story Studio product events use controlled event names, story mode, boolean return classification, controlled save or error categories, and, where a save event is linked to the generated result being saved, the existing generation request identifier. They do not include local project identifiers, story or version text, settings values, cover bytes, or a stable hash derived from a local project.
Messages sent to support
If you email the support address, AI Story Now receives the email address, message, and other information you choose to include. Do not send story prompts, generated stories, passwords, API keys, or authentication tokens in a support message. AI Story Now does not state a fixed mailbox retention period.
Information temporarily processed
To provide a story, the Worker temporarily processes your story idea, selected genre, tone, length and audience, an anonymous session identifier, request identifiers, a Turnstile token, safety-check results, and the generated title and story. The request flow validates the input, checks abuse and budget limits, verifies Turnstile, moderates the idea, asks the story provider to generate a result, validates that result, moderates the output, and returns an approved result to your browser.
Bedtime stories, revisions, and covers
A parent or caregiver can choose a controlled age band, hero type, interests, theme, mood, reading time, and cover preference for the current story. A fictional hero name is optional; do not use a child's real name. The service does not ask for a child's birthday, school, address, contact details, or photo, and it does not build a child profile from these choices.
The current story text is temporarily processed again when a parent or caregiver selects one of the fixed revision actions. If a cover is requested, a temporary cover brief is sent to the configured image provider. The returned image is displayed through a browser object URL. The generated result remains temporary unless you explicitly save it to Story Studio. An explicit local save can include one already-generated Bedtime cover with its original story-version provenance; it does not make another image request.
AI Story Now does not intentionally write the full story prompt or generated story to server-side persistent application records during this flow. An explicit Story Studio save is local browser storage as described above. This server-storage limit does not mean that third-party services never process or retain the content sent to them. Their role is described below.
Third-party processing
Configured story generation and moderation path
The approved production configuration permits only direct requests to OpenAI's official APIs. It uses the OpenAI Responses API for story generation and the OpenAI Moderations API for input and output safety checks. It does not enable a relay or a fallback story provider. The deployed configuration is verified as part of the Production release process.
AI Story Now sends the story idea to OpenAI for input moderation. If the idea passes, OpenAI receives the instructions and settings needed to generate the story. The generated title and story are then sent to OpenAI for output moderation before anything is shown as a successful result.
Story-generation requests use the OpenAI Responses API with store: false. This tells the Responses API not to create application state for that response, but it does not disable OpenAI's separate abuse-monitoring processing. OpenAI's current API data-control documentation says abuse-monitoring logs may contain prompts, responses, and derived metadata and are retained for up to 30 days by default, subject to stated legal and safety exceptions. The same documentation currently lists no abuse-monitoring or application-state retention for the Moderations endpoint. These are OpenAI's current documented practices, not an AI Story Now guarantee that provider handling or retention will never change.
OpenAI states that API Platform inputs and outputs are not used to train its models by default unless an organization explicitly opts in to share data. OpenAI also describes eligible customer controls, including Zero Data Retention, but AI Story Now has not established that Zero Data Retention is enabled for this service. These provider facts were checked against OpenAI's official documentation on August 23, 2026.
Configured image generation path
When a Bedtime cover is requested, AI Story Now sends a server-created cover brief to OpenAI's image API and receives an image for the temporary browser display. The application does not send a child photo or likeness and does not intentionally store the generated image. Image usage, cost, latency, size, and grouped failure metrics are content-free.
Cloudflare Turnstile
Turnstile processes browser and device signals to help distinguish legitimate requests from automated abuse. For server-side verification, AI Story Now sends Cloudflare the Turnstile token, the request's network address when available, and a request identifier used for idempotency. AI Story Now does not intentionally persist the Turnstile token in its own application database, custom business logs, or Analytics Engine datasets. Cloudflare's handling of Turnstile data is governed by Cloudflare's own documentation and policies; this policy does not state an unverified Turnstile retention period.
Cloudflare infrastructure
Cloudflare provides DNS and site delivery, Workers, Durable Objects, rate limiting, Workers Logs, and Workers Analytics Engine. Cloudflare processes network, browser, request, response, security, and operational information needed to deliver, protect, and operate those services. AI Story Now chooses the content-free custom log and analytics fields described above, while Cloudflare separately handles infrastructure-level data under its own services and policies.
The service does not use a third-party product analytics SDK, advertising service, payment provider, or public user-story hosting service.
Retention
- AI Story Now does not intentionally persist full story prompts or generated stories in server-side application storage or custom business logs. The Worker holds them only as needed to complete the current request. OpenAI processes the content separately as described above.
- Stories explicitly saved to Story Studio remain in that browser's local IndexedDB until you delete them, clear site data, or the browser removes site storage. AI Story Now does not promise a fixed local retention period, permanent storage, recovery, backup, or synchronization.
- OpenAI story requests use
store: false, so the Responses API is not asked to create application state for the response. OpenAI's current documentation nevertheless allows default abuse-monitoring logs containing customer content for up to 30 days, subject to its stated legal and safety exceptions. It currently lists no abuse-monitoring or application-state retention for the Moderations endpoint. - Anonymous request-attempt records are removed after 10 minutes, and successful-use records are removed after 24 hours. Actor hashes are removed when a reservation is completed or released, or within 24 hours after an abandoned reservation expires.
- Content-free budget reservations, request receipts, and feedback receipts are removed after seven days by scheduled Durable Object cleanup. Daily budget totals are cleared after seven complete UTC days; because each total covers a full UTC date, cleanup may occur during the following calendar day.
- The Cloudflare account used by the current service is configured for the Standard usage model associated with Workers Paid, for which Cloudflare documents Workers Logs retention of up to seven days. The Production release process rechecks the deployed Worker against that plan. Cloudflare's current Analytics Engine documentation states that Analytics Engine data is stored for three months.
- Cloudflare's SQLite-backed Durable Object platform provides point-in-time recovery for up to 30 days. As a result, rows deleted from the active application tables may remain recoverable by the platform during that recovery window.
The anonymous session cookie remains in your browser for up to 30 days. You can remove it sooner by clearing site data in your browser.
Support emails and provider-side data are not assigned an invented retention period here. Provider handling is subject to the provider's current services, documentation, and applicable requirements.
Security
AI Story Now uses server-side request validation, Turnstile, rate and budget limits, restricted secrets, protected identifiers, content-free structured logging, and input and output moderation. These controls are designed to reduce misuse and unnecessary exposure, but no internet service can guarantee absolute security.
Privacy and data requests
To submit a privacy or data request, email support@aistorynow.com and describe your request. Because the current service has no accounts and uses anonymous or protected identifiers, AI Story Now may not be able to link every operational record to an email address or person. If your request concerns a generation, you may include its request identifier. Do not include the story prompt, generated story, password, API key, or authentication token. This section provides a contact channel and does not claim privacy rights that have not been determined to apply.
Children
AI Story Now is a general-audience service and is not directed to children under 13. The Kids setting describes the intended tone and subject matter of generated content; it does not mean the service is designed for or offered directly to children. A parent or guardian should supervise use by children. Do not submit a child's full name, contact information, school details, precise location, photo, likeness, or other identifying information. For the Bedtime flow, use a made-up character name and have a parent or caregiver review the story and cover before reading them to a child. Contact us if you believe a child submitted personal information through the service.
Changes
We may update this policy when the service, providers, or data practices change. We will post the revised policy here and update the date at the top of the page. If a change materially affects how AI Story Now handles information, we will place a prominent notice on the site before or when the change takes effect. Because the current service has no user accounts or subscriber list, AI Story Now does not ordinarily send individual policy-change notices by email.
Contact
For privacy questions, contact us at support@aistorynow.com.