Privacy Policy

1. Introduction

StoryHebrew ("we," "us," or "our") operates the website at storyhebrew.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit or use our Service. By using the Service, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: When you sign in with Google, we receive your name, email address, and profile picture from Google OAuth.
• Payment Information: Subscription payments are processed by Lemon Squeezy. We do not store your credit card number, bank account details, or other financial payment information on our servers. We receive a subscription status, customer ID, and billing-related metadata from Lemon Squeezy.

2.2 Information Collected Automatically

• Usage Data: We collect information about how you use the Service, including stories read, vocabulary interactions, reading progress, streak data, and feature usage.
• Device and Log Data: We may collect your IP address, browser type, operating system, referring URLs, and access timestamps through standard server logs.
• Analytics: We use analytics tools to understand usage patterns, improve product performance, and improve the Service.

2.3 Cookies and Local Storage

We use cookies and browser local storage to maintain your authentication session and store user preferences. We may also use analytics cookies or similar technologies to measure and improve the Service. We do not use these technologies for third-party advertising or cross-site ad targeting.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Authenticate your identity and manage your account.
• Process subscriptions and manage billing through our payment processor.
• Track your learning progress, vocabulary, streaks, and reading history.
• Improve and optimize the Service, including content recommendations.
• Send you transactional emails related to your account (e.g., subscription confirmations). We may also send periodic educational or product emails, from which you can unsubscribe at any time.
• Detect, prevent, and address security issues, fraud, or abuse.
• Comply with legal obligations.

4. How We Share Your Information

We do not sell your personal information. We may share your information only in the following circumstances:

• Service Providers: We share data with third-party providers who help us operate the Service, including Supabase (database and authentication hosting), Lemon Squeezy (payment processing), Vercel (hosting and analytics), analytics providers, ElevenLabs (text-to-speech audio generation), and Resend (transactional email). These providers access your data only to perform services on our behalf and are obligated to protect it.
• Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., resolving disputes, enforcing agreements).

6. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information, including encryption in transit (TLS/HTTPS), secure authentication through OAuth, and access controls on our database and infrastructure. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal exceptions).
• Portability: Request a machine-readable copy of your data.
• Objection: Object to processing of your data in certain circumstances.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at support@storyhebrew.com. We will respond within 30 days.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. By using the Service you consent to the transfer of your data to jurisdictions that may have different data protection laws than your country of residence.

9. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover that we have inadvertently collected data from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at support@storyhebrew.com.

10. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR). Our legal basis for processing your personal data includes:

• Contract: Processing necessary to provide the Service under our Terms of Service.
• Legitimate Interests: Processing for analytics, security, and service improvement, balanced against your privacy rights.
• Consent: Processing based on your explicit consent (e.g., optional marketing emails).

Where required by applicable law, we rely on consent for non-essential analytics technologies.

You may lodge a complaint with your local data protection authority if you believe your rights have been infringed.

11. California Users (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights, including the right to know what personal data is collected, the right to request deletion, and the right to opt out of the sale of personal data. We do not sell personal information. To exercise your CCPA rights, contact us at support@storyhebrew.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page with a new "Last updated" date. Your continued use of the Service after any changes indicates acceptance of the revised policy.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at support@storyhebrew.com.