Privacy: what is stored, where and for how long

Where it is kept

Books, questions, answers, drafts and suggestions are kept in one Cloudflare D1 database that belongs to this site. Cloudflare chooses where the database lives; the region is not pinned, so it may be outside your country. The pages themselves are static files served by Cloudflare Pages.

What is stored for the person who keeps the book

• A random account id, the account name you chose for your passkey manager, and when the account was made.
• For each passkey: its public key, its id, a signature counter, the name you gave it and when it was added and last used. Never a fingerprint, a face or any biometric data: those stay on your device.
• A scrambled form (SHA-256) of your recovery code. The code itself is shown to you once and not kept.
• For each signed in device: a scrambled form of its session id, and when it was made, last used and when it expires (90 days after the last use).
• Your email address, only if you add one, with the date you confirmed it and when you last changed it (at most two confirmation emails a day). It is used only for your own question-day notices and the confirmation emails, and it is the only place an email address is ever stored.
• A record of each email sent to you (its kind and when) and the notices themselves, kept 30 days. The confirmation email's link is not kept once it is sent.

What is stored in each book

• The storyteller label: what the family calls them, such as Grandma. It refuses email addresses and phone numbers.
• The time zone, the question day, how often, and when each question was sent and answered.
• The questions: their words, their life stage, where they came from (a house question, yours, or a family suggestion) and their place in the list.
• The answers: the words, when each was first saved and last changed, and how many times it was changed.
• Drafts: what the storyteller had typed but not finished, so they can carry on from another device. Drafts are never shown on the family link.
• Suggestions from the family: the question, who is asking if they chose from the fixed list (a grandchild, a child, a niece or nephew, a friend, family), and whether it was approved. No name, email address or account.
• For each of the book's 3 links (the storyteller link, the family link and the calendar feed): a scrambled form (SHA-256) of its secret, plus a sealed copy that only this server can open with its own secret key, so you can see the link again. The secret itself is never stored as it is. Replaced links are kept only as a scramble with the day they were replaced, so an old link can say it was replaced and the new link's page can say when.

Nothing about the storyteller is stored beyond the label and what they choose to write. No photos and no recordings are stored.

Limits on how fast requests come

To stop a link being flooded, the server counts writes per link and per network address in hourly buckets. The address is stored only as a keyed scramble that cannot be turned back into the address, and each bucket is deleted after 2 hours. Network addresses are never written to logs.

How long it is kept

• Your account, books, questions, answers, drafts and suggestions: until you delete them.
• A deleted book: 7 days, while it can be restored, then deleted for good with everything in it.
• A deleted account and everything in it: 7 days, while you can sign in and cancel, then deleted for good.
• Sessions: until 90 days after the last visit on that device, or until you sign out.
• Passkey sign in requests: 5 minutes. Rate limit buckets: 2 hours. Email records: 30 days.

What stays on your device

What anyone is typing (an answer, a question, a suggestion) is also kept in that browser's local storage under keys beginning with storyquestions, so a dropped connection loses nothing. The secret part of a link sits after the # sign, which browsers do not send to any server in the address.

How to export and delete it

On your account page, Download everything gives one file with every book, question, answer and suggestion (unfinished drafts stay the storyteller's own and are left out). Delete the book, at the end of a book's page, removes one book after the 7 days above; Delete my account removes everything. Requests by email go to [email protected].

Cookies

One cookie, and only for the person who keeps the book: a session cookie that keeps you signed in. It cannot be read by page scripts and is never sent to another site. The storyteller and the family get no cookie.

Page counts

Visits may be counted by Cloudflare's own page counter, which sets no cookie and records that a page was opened, never what you typed. There is no other analytics.

Payments

No paid plan is offered at present; if one is added, this page will describe it.

Email

Only the person who keeps the book can receive email, only at an address they added and confirmed, and only for their own notices. The storyteller and the family are never emailed. Emails carry no tracking images and no link that opens a book.

Children

Grandchildren may read the stories and suggest questions with the family link. The site asks for no names: suggestions refuse email addresses, web addresses and phone numbers, and who is asking is chosen from a fixed list, never typed.

Typeface

Headings are set in Newsreader by Production Type, under the SIL Open Font License 1.1, served from this site. The licence is at /fonts/OFL.txt.

Changes and contact

If this policy changes in a way that affects what is stored, the change will appear on this page. Questions go to [email protected].