Last updated 8 October 2026

Privacy Policy

StorySpark (storyspark.nrdblm.se) creates personalized, AI-written reading adventures for children aged 7–13. Parents and teachers set it up; children read and answer questions. This page explains what we collect, why, and the choices you have.

StorySpark is run by Bjorn Nordblom, who is responsible for your data (the “data controller”). Questions or requests: bjorn@nerdblom.se.

What we collect

Grown-up accounts

Your email address, your name, and the display name you choose.
Your password, stored only as a salted hash. We never see or store the password itself.
If you sign in with Google: your Google account ID, name, email address, and profile picture link. We ask Google only for the basic openid, email, and profile permissions. We cannot see your Gmail, Drive, contacts, calendar, or anything else in your Google account.
Weekly class prompts you write for your students.
If you subscribe to StorySpark Family: your plan, and the customer and subscription IDs that Stripe gives us. Card details go straight to Stripe and never reach our servers.

Student profiles

A grown-up creates each student profile. Children never give us an email address or create an account themselves. A profile holds:

A first name or nickname, an optional age, and reading settings (reading level, story language, and story length).
The stories the student makes: characters, settings, the choices they pick, and the chapters written for them.
Their answers to reflection questions, the feedback and scores on those answers, vocabulary words, reading streaks, and badges.

Technical data

Sign-in sessions: a random session token, IP address, browser type, and timestamps.
Server logs: request details (IP address, page, time, internal record IDs) used for security, abuse prevention, and fixing bugs. We don’t log story text or students’ answers.
Usage counters that enforce daily limits.

Cookies

We use only the cookies needed to keep you signed in. They contain random tokens. We don’t use advertising cookies, analytics services, or third-party trackers.

How we use it

To run StorySpark: sign you in, write stories and questions, give feedback on answers, and show progress to the grown-up who manages a student.
To send service emails: a welcome message, sign-in links, password resets, and subscription confirmations (started, cancelled, ended). No marketing emails.
To take payment for StorySpark Family, when you subscribe (performing our contract with you).
To keep StorySpark safe and available, for example with rate limits and abuse detection.

We don’t sell personal data, show ads, or build advertising profiles. We don’t use your data or your students’ data to train AI models.

Why we use your data (legal basis)

Purposes and legal basis (GDPR Art. 6)
Purpose	Data	Legal basis
Run your account and sign you in	Email, name, password hash, Google ID, sessions	Contract (Art. 6(1)(b))
Student profiles, stories, answers and progress	First name, reading settings, stories, answers, vocabulary	Contract with the grown-up (Art. 6(1)(b)); the grown-up confirms they may create the profile (parental responsibility or consent)
Write stories and feedback with AI	Story inputs and answers, no profile names	Contract (Art. 6(1)(b))
Service emails	Email address, name	Contract (Art. 6(1)(b))
Payment for StorySpark Family	Plan, Stripe customer and subscription IDs	Contract (Art. 6(1)(b)); bookkeeping law (Art. 6(1)(c))
Security, abuse prevention, bug fixing	IP address, logs, usage counters	Legitimate interests (Art. 6(1)(f)): keeping the service safe and available
Answering your requests and legal duties	Request records, data the law requires	Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests you may object (see Your rights).

Transfers outside the EU/EEA

Our own servers are in Finland. Some providers are US companies, so data can reach the US:

OpenRouter (AI intermediary): story inputs and answers, as described above. The model providers themselves are EU-located.
Stripe (payments): email address, payment details and billing country, only if you subscribe.
Google (sign-in): only if you choose “Sign in with Google”.

These transfers rely on the EU-US Data Privacy Framework where the company is certified, and otherwise on the European Commission’s Standard Contractual Clauses. Ask us for a copy of the safeguards at bjorn@nerdblom.se.

Google user data

If you sign in with Google, we use your Google name, email address, and profile picture only to create and sign in to your StorySpark account. We don’t share this data with anyone else. We don’t use it for advertising and don’t pass it to AI services. StorySpark’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

AI story generation

Stories, questions, and answer feedback are written by AI models that we reach through OpenRouter, a US company that acts as an intermediary. We pin every request to model providers located in the EU/EEA, deny data collection and require zero data retention, so prompts are not kept or used for training. See How we use AI. For each request we send only what the model needs: the character names and descriptions, the setting, story style, and choices; the reading level and language; the story so far; and, for feedback, the student’s answer. We never send a student’s profile name, age, or your email address. Made-up names for story characters are a good idea.

Who else handles data

Hosting: StorySpark and its database run on our own hardware in a Hetzner data centre in Helsinki, Finland (EU). Hetzner Online GmbH provides the facility.
AI providers: OpenRouter (US intermediary) and the EU-located model providers it routes to, as described above.
Email delivery: our email delivery provider sends sign-in, password-reset and subscription messages.
Google: only if you choose “Sign in with Google”.
Payments: Stripe processes subscription payments. Stripe receives your email address, payment details, and billing country, and keeps payment records as bookkeeping law requires. We never send Stripe anything about your students.
Share links: if a grown-up shares a story, anyone with the link can read it, together with the story hero’s name (the character, not the student’s profile name). You can turn a share link off at any time.

We may disclose information if the law requires it.

Children’s privacy

StorySpark accounts are for adults. A parent, guardian, or teacher who creates a student profile confirms that they are allowed to do so, for example as the child’s parent or with the parent’s consent. We collect as little about children as possible. The grown-up can view a student’s stories and answers, change the profile, reset the student’s private sign-in link, or delete the profile whenever they like.

How long we keep data

Account and story data stays until you delete it or ask us to delete your account.
Deleting a student profile removes that student’s answers, vocabulary, and progress. Their stories stay in your account until you delete them.
If you ask us to delete your account, we delete it and everything linked to it within 30 days, and an active subscription stops renewing. Stripe keeps its own payment records for as long as bookkeeping law requires (seven years in Sweden).
Server logs are kept for a limited time for security and debugging, then deleted.

Your rights

You can ask to access, correct, export, or delete your personal data, or object to how we use it. Email bjorn@nerdblom.se and we will reply within one month. If you are in the EU/EEA, you can also complain to your data protection authority. In Sweden that is IMY.

Security

We encrypt all traffic with HTTPS. Passwords are hashed, sessions are stored on the server, and sign-in links expire. No system is perfectly secure, but we work to protect your data and will tell affected users about any breach as the law requires.

Changes

If this policy changes, we will update the date at the top. For significant changes, we will tell account holders by email before the change takes effect.