Privacy Policy

Who is responsible

Nubri GmbH, Liebenowzeile 22, 12167 Berlin, Germany, runs FamilyStory (familystory.site) and is the controller for the personal data described here. Contact: info@nubri.co.

What we process

• Your account: email address, a bcrypt hash of your password, and when you confirmed your email address.
• Your family content: the family history you write, child profiles (a first name, age and interests), and the photos and letters you upload. Uploads are stored in Amazon S3.
• Your stories: the text, illustrations and narration we make for you, stored in Amazon S3 and our database so you can come back to them.
• AI processing: your prompts and the family details a story needs (and a few of your photos and letters, when you choose to weave them in) are sent to Anthropic's Claude Sonnet 4.6 on Amazon Bedrock to write the story; illustrations are drawn by Stability AI's Stable Image Core on Amazon Bedrock and narration is spoken by Amazon Polly. Amazon Bedrock doesn't use your data to train models.
• Free stories: each is recorded with a one-way hash of your email inbox, so that deleting and re-creating an account doesn't restart the free stories.
• Billing: your plan and Stripe customer and subscription ids (we never see card details).
• The "try it" story on our home page: what you type is sent to Claude on Amazon Bedrock to write a preview and isn't stored on our server; your browser keeps the preview until you sign up.
• Site analytics: our pages keep a random visitor id and where you first came from (source, campaign, referring site, page) in your browser's local storage and send page events to our own server; an email address you leave for updates is stored with them. No third-party analytics or advertising tools.
• Your IP address, used to limit requests against abuse; it isn't stored with your account.
• Messages you send through the contact form, which reach us by email.

Children

FamilyStory is for parents and guardians, not for children to use directly. Information about a child is provided by the adult account holder and is used only to write that family's stories. You can edit or delete child profiles at any time.

Sharing your stories

Stories are private by default. A share link lets anyone who has it read the story. If you also make a story public, it is listed on our site and in our sitemap and may be indexed by search engines; you can make it private again at any time, though search engines may take time to drop it.

Why, and on what legal basis

To provide the service you signed up for (Art. 6(1)(b) GDPR); to keep it secure and free of abuse, and to know which channels bring visitors (Art. 6(1)(f) GDPR, our legitimate interests); and to keep records the law requires (Art. 6(1)(c) GDPR). We don't sell personal data.

Processors

• Amazon Web Services: hosting, storage, Claude and Stable Image Core on Amazon Bedrock, Amazon Polly, and email delivery (United States).
• Stripe: payments (United States).

Transfers to the United States rely on the EU Standard Contractual Clauses.

How long we keep it

Your account, family content and stories are kept until you delete them. You can delete uploads, child profiles and stories at any time, and your whole account on your profile page: that deletes your account, stories, child profiles, photos, letters, illustrations and narration at once and cancels a Family Plan. The inbox hashes of a deleted account's free stories are kept until the end of that month. Records we must keep by law (for example invoices) are kept as long as the law requires.

Cookies and local storage

Signing in stores your session in your browser's local storage and in one cookie, auth_token, for up to 7 days; both are needed for the service to work. Local storage also holds the visitor id and first-visit source described above, and session storage a flag so a visit is counted once.

Server logs

When you open any page, our web server records your IP address, the time, the address requested, the response and your browser's user agent. We use these logs only to keep the service secure and to find faults (Art. 6(1)(f) GDPR). They are deleted automatically after at most 8 days.

Your rights

You can ask for access to your data, its correction or deletion, restriction of processing, a copy in a portable format, and you can object to processing based on legitimate interests. Email info@nubri.co. You may also complain to a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.