Privacy Policy

SinStories is an adult (18+) AI service that generates fictional stories. This Privacy Policy explains, in plain language, what personal data we collect, how and why we use it, who we share it with, and the rights you have. It applies to sinstories.app and the SinStories app.

Information you give us. To create an account you provide your email address; we sign you in with a one-time code we email to that address, so we never ask for or store a password. When you use the service you provide prompts, choices, notes and the moves you type in an interactive story, and we store them together with the resulting stories so they appear in your library. If you create a character, we store the description you give it and the profile, portrait and voice made from it. If you have something read aloud, we store the generated audio alongside it so you can play it again. If you upload a file — a document or a screenshot — to fill in a character, we read it once to fill in the form and do not keep it.

Sensitive information. What you write here — prompts, notes, characters — and the stories written from it can reveal your sexual preferences and fantasies, which the GDPR and similar laws treat as sensitive data. We use it only to write, save, read aloud and tailor your stories, to keep the service safe and, in a form that no longer identifies you, to improve our writing. Where the law requires it, we rely on your explicit consent, which you give at the age check and when you create your account. You can withdraw it at any time by asking us to delete your account; without it we cannot write stories for you.

Information we collect automatically. We record account and usage data needed to run the service, such as your remaining credits, plan and activity. For security and analytics we process technical data — your IP address (kept only as a one-way hash), the approximate country and city it maps to, and general device and browser information.

Payments. If you buy a paid plan, the payment is processed by our payment provider, Stripe, under its own privacy policy. Stripe handles your card details directly; we receive only limited information such as your subscription status and the last four digits — we never see or store full card numbers.

How we use your data. We use it to provide the service (generate and save your stories, produce read-aloud audio, run your account and credits), process payments and manage subscriptions, keep the service safe (moderation, preventing abuse and fraud), understand and improve the product, and send essential service messages. We never sell your prompts or stories, and we never hand them to anyone else to train their own AI models. We may use them ourselves — together with the ratings you leave on a story — to measure and improve the quality of our own writing, and only in a form stripped of anything that identifies you.

Tailoring your stories. To keep a long story or session consistent, we keep a running summary of its earlier parts and use it when writing the next ones. To keep it to your taste, we may also read the words you write — your premise, your notes and the moves you type, never the AI's own prose — and note the themes and preferences you ask for, such as a kind of story or a kink. These are saved with that story or session (and, if you add words of your own to the list, with your account), shown to you in its settings and used for its later parts. You can remove any of them, and one you have removed is not added back for you.

Emails. We email you sign-in codes and messages about your account and payments. We also send account holders news about the service — new features and offers — whether or not they have bought anything. Every such email carries a one-click unsubscribe link; unsubscribing stops them and never affects sign-in codes or service messages.

Legal bases (EEA/UK). Where the GDPR applies, we rely on performance of our contract with you (running your account, writing and storing your stories, billing); your explicit consent for the sensitive information described above; our legitimate interests — keeping the service secure, preventing abuse and fraud, measuring how the site is used and which visits lead to a sign-up, improving the product and telling account holders about our service, any of which you can object to; and compliance with legal obligations.

Cookies and analytics. We use cookies and similar browser storage that the site needs to work: to keep you signed in; to remember that you confirmed your age, your language and the settings you chose, such as a read-aloud voice; to keep a story you started before signing up and bring you back to the page you were on after signing in; and to credit a sign-up to the partner who referred you. We also keep in your browser a random visitor ID, the page and source through which you first arrived, and which version of the site you were shown while we test a change, so that our own analytics can count visits and compare versions without knowing who you are. In addition we load Google Analytics and Google Ads on every visit; they set their own cookies and tell us how the site is used and which visits lead to a sign-up or a purchase. They load as soon as the site opens, before the age check, which tells you about them; you can block or clear them in your browser settings or with an ad blocker, and the service works fully without them.

Sharing. We never sell your personal data and we don't share it with third parties for their own marketing. To run the service we pass data to providers working on our behalf, each receiving only what its job requires: OpenRouter, which passes what a model needs in order to write — your prompt, notes and the moves you type, the story so far and its summary, your characters' profiles and any file you upload to make one — to the companies that host the AI models, such as xAI and the hosts of DeepSeek models; besides the model you chose, your text also goes to our standard model for safety moderation, the running summary, titles, reading your preferences and writing characters' profiles; ElevenLabs, which turns finished text into read-aloud audio; Runware, which paints character portraits from a short description of their looks, never from your stories; Stripe for payments; Amazon Web Services for email delivery; Cloudflare, which sits in front of the site, protects it and tells us which country a visit comes from; Hostwinds, which hosts our servers and database; Google for analytics and advertising; and Telegram, which carries internal notices to our team, such as a message you send us through the site together with the email address it came from. The company behind each model processes your text under its own terms. We also disclose data where the law requires it, such as a valid legal request.

Community. If you create an author profile, the pen name you choose is public: it appears on everything you publish, and because the Community can be read without an account, anyone with the link can see it — not only signed-in members. Choose the anonymous option if you would rather it did not. Everything submitted to the Community is reviewed by us before it appears. A published story can be read by anyone with the link and copied into the library of any signed-in member; taking it down removes it from the Community but not from copies made before that. Your email address is never shown. We also record which Community posts you open, which you heart and which you copy, tied to your account, so an author can be told how their story is doing; that record is kept for 100 days and your email is never shown to them.

Retention. We keep your account, your stories and their audio for as long as your account is active. You can delete your account and its data at any time by writing to [email protected]; we delete it promptly, except for the minimum records we are legally required to keep, such as billing records. Beyond your account: detailed analytics events are kept for no more than 100 days and are then reduced to aggregate statistics that are no longer tied to an individual visitor; stories generated on the landing page without an account have their text deleted after about five weeks, though the prompt itself is kept in an anonymised form that carries no link to the person who wrote it; and the prompt stored with a generation attempt is removed after 60 days. Where a request is blocked by our safety rules we keep a record of that decision indefinitely, because the card networks require it, and the blocked text itself for one year.

Backups. Anything deleted — at your request or on the schedules above — can remain in our nightly backups for up to 14 days before it is gone for good.

Security. We protect your data with encryption in transit, hashed IP addresses and access controls. No online service can be completely secure, so we also encourage you to keep access to your email secure and your library off shared devices.

Your rights. Depending on where you live, you may have the right to access, correct, delete, export or restrict the processing of your data, to object to certain processing and to withdraw consent. California residents have the right to know about and delete their personal information and not to be discriminated against for exercising these rights; note that we do not sell personal information. To exercise any right, email [email protected].

Children. SinStories is strictly for adults. It is not directed to anyone under 18 and we do not knowingly collect data from minors. If you believe a minor has used the service, contact us and we will remove the account.

Changes and contact. We may process data in countries other than your own: several of our providers are in the United States, and some AI models are hosted elsewhere, including China. We may also update this policy; the date above shows the latest version, and when a change is material we tell account holders by email or on the site. For any privacy question or request, contact [email protected].