Privacy

Accounts and age

Signup asks for an email, a display name, a password, and a date of birth. The date of birth sets an age band: under 13 is refused, 13 to 17 is teen, and 18 and over is adult. Teen accounts do not see mature-rated worlds. A new account also needs an approved waitlist email or an access code. Passwords are held by the account provider and are not read by the story runtime.

Waitlist and invites

The waitlist stores the email you submit and whether Studio has approved it. Invite links store the code, the world they open, and whether the code is still valid.

Likeness

Before a sheet is painted, you confirm likeness consent. We store the photos you capture or upload, the notes you add, and the 9:16 green-screen avatar sheet made from them. Worlds then dress that sheet into a scene. They do not replace your face, hair, skin, or body. We do not sell face photos, and we do not use them to identify you outside Superstar Storyworld. The separate likeness notice is at /legal/biometric.

Stories, gallery, and crystals

A story stores the thread, the beats you choose, plates, still-to-still transitions, the stitched video, and the dialogue and music generated for that thread. A gallery post starts as pending. The public feed shows approved posts only. Studio can approve, reject, or take a post down.

Crystals are a product credit for generation. One crystal is accounted as $0.01, and a new account starts with 1,000 introductory crystals. We store the balance, grants, and spend so Studio can pair cost with play. Those records are not sold as an advertising profile.

Product events

Studio keeps first-party events such as avatar creation, beats, rewinds, shares, and crystal spend. They are used to see how a world is playing. Share records that a plate was offered; the shared still stays in the plate’s 16:9 frame and carries a watermark.

Google Drive, Studio only

Guests do not connect Google. A Studio admin can connect a Google account to copy story folders into a Drive folder they paste. The sign-in asks for Google Drive access so Studio can create that folder tree and upload files into it, including a folder on a shared drive. The tree is world, then the author’s email, then the story, with plates, transitions, and the stitched video inside.

For that job we look up a folder or file by name inside the destination, create a missing folder, and upload a file that is not already there under the same name. We do not use the connection to change or delete the rest of that Drive. The refresh token stays in an httpOnly cookie on the admin’s browser for 30 days.

Who processes it

Supabase holds accounts, the database, and stored media. Vercel hosts the app and, in production, records aggregate site analytics. Image, video, and music providers receive the prompt and the media needed to paint a plate, a transition, or a score. Google receives a Drive request only when a Studio admin starts a sync.

How long it stays

Account, story, and likeness files stay while the account is active. From My stories you can delete your likeness. A published post that used that sheet can be unpublished or taken down in Studio. A waitlist email stays until the entry is removed.

Contact

Questions about this notice: patrickneiler@gmail.com. When this notice changes, the date at the top changes with it.