Privacy Policy
Last updated: 12 October 2026
Story Thread is in a closed alpha. This policy describes what the game actually does with your data today; if that changes, this page changes with it.
The short version
- We store your email address, the stories you play, and the prompts and replies that produced them.
- We use that to run the game, to fix it when it breaks, and to make it better -- including training our own models on game data.
- Your writing is sent to AWS and Google to generate the story and its pictures. Neither of them trains their models on it.
- There are no analytics, no trackers and no advertising on this site, and we don't sell anything about you to anyone.
- You can download your saves from your account page, and ask us to delete everything by email.
Who runs Story Thread
Story Thread is an independent project, run by the developer who built it. For anything in this policy -- a question, a copy of your data, a deletion request -- write to support@story-thread.link.
What we collect
Your account
Your email address, and an identifier from the sign-in service. Your password is held by Amazon Cognito, the service that signs you in; it never reaches our servers and we can't read it. We also keep a record of each signed-in browser -- when it signed in, when it was last used, and the browser's self-reported name and version (its "user agent"), which is what lets you see and end your own sessions.
What you write, and what the game writes back
The settings and characters you create, what you type on your turn, the narration the game produces, and the record it keeps of your story -- places, people, factions, relationships, injuries, events and the images generated for scenes. This is the game's save data: it exists so your story can continue and stay consistent.
The prompts behind it
Every call the game makes to an AI model is logged with the request we sent and the reply we got, along with the model used, how long it took and how many tokens it cost. Those requests contain what you wrote and the story context around it. This is how we diagnose a bad turn, and how we measure whether a change to the game made it better or worse.
If you email us
Your message and address, kept in an ordinary mailbox so we can reply.
What we don't collect
- No analytics or trackers. This website and the game load no analytics scripts, no advertising tags and no third-party cookies. Nobody is profiling you across the web on our behalf.
- No payment details. Story Thread doesn't charge for anything yet. When it does, a payment provider will handle cards and we won't see the numbers.
- No web access logs of our own. We don't keep request logs tied to your IP address. Our hosting provider sees your IP address to route and protect the traffic, as any host must.
- Nothing we don't need. No phone number, no real name, no address, no contacts, no location.
How your writing reaches the AI models
Story Thread doesn't run its own models. To produce a turn, we send your prompt and the relevant story context to:
- Amazon Bedrock (Anthropic's Claude models), for the narration and the game's reasoning. AWS states that Bedrock does not store model inputs or outputs by default, that its operators can't read them, and that the model providers have no access to them.
- Google Cloud Vertex AI (Gemini), for the images. Google states that it won't use your data to train or fine-tune its models without permission, and caches requests briefly in memory to speed up responses.
Both providers run automated abuse detection over traffic, and may keep flagged content for a short period to check it -- see our Acceptable Use Policy for what they refuse. Their filters can also cut a reply short; that's them, not a bug in the game.
How we use your data
- To run the game -- sign you in, keep your saves, continue your story, show your images. We need this to provide Story Thread at all.
- To keep it working and secure -- diagnose errors, investigate abuse, understand what a bad turn did.
- To make it better -- read through prompts and replies to improve how the game writes, and use game data (including your prompts and the model's replies) to train and fine-tune our own models. If you'd rather your stories weren't used this way, email us and we'll exclude your account.
Where the law requires a legal basis for this, we rely on performing our contract with you for the first, our legitimate interests in a working and improving game for the others, and your consent where consent is required.
Cookies
Two, both strictly necessary, both set by us:
st_session-- the signed-in session. It holds a random token (we store only its hash), lasts 30 days, and is readable only by our servers.st_login-- a short-lived cookie, about ten minutes, used to complete a sign-in safely.
No others. There is nothing here to opt out of.
Where your data is held
On Amazon Web Services in the United States (the us-east-1
region), and with Google Cloud for image generation. If you're writing
from outside the United States, your data is processed there.
How long we keep it
Your account, your saves and the prompt logs behind them are kept while your account exists, because that's what makes a story resumable. Prompt and reply logs from the alpha are kept while the alpha runs -- they're how the game gets better. Sessions expire 30 days after you sign in, sooner if you sign out. When you ask us to delete your account, we delete your account, your settings, your saves and your images; backups age out afterwards.
Your choices
- Export. Each save downloads as a ZIP -- story text, images and an index -- from your account page.
- Deletion. Email support@story-thread.link and we'll delete your account and its data. During the alpha this is done by hand, so give us a few days.
- Correction and access. Ask us, and we'll tell you what we hold about you or fix what's wrong.
- Opting out of model training. Ask, and your data stays out of it.
Depending on where you live -- in the European Economic Area, the United Kingdom, or California, for example -- you may have further rights over your data, including to object to some of this processing or to complain to a regulator. Write to us and we'll honour them.
How we protect it
Everything travels over HTTPS. Passwords live with the sign-in service, not with us. Session cookies are HttpOnly and Secure, and the database stores only a hash of the session token, so a database read can't be replayed as a login. Each account's data is separated at the database level, and a generated image is served only to the account whose story it belongs to.
Please don't put real secrets into the game: card numbers, passwords, medical details, or other people's personal information have no place in a prompt, and the fiction doesn't need them.
Age
While Story Thread is in its closed alpha it's for adults: you must be 18 or older, and we don't knowingly collect anything from children. If you believe a child has an account, tell us and we'll remove it. That flat limit is expected to become a mature-content setting rather than a bar on the whole game; if the rule changes, this page changes with it.
Changes
When this policy changes, the date at the top changes and the new version is posted here. If a change materially affects what we do with your data, we'll tell you before it takes effect.