Privacy Policy

1. Overview & Compliance Framework

Welcome to StoryK.in ("StoryK", "We", "Us", or "Our"). We are dedicated to maintaining the highest standards of privacy, data protection, and transparency for our creators and users. This Privacy Policy governs our data collection, processing, storage, sharing, and data subject rights in strict compliance with:

• The Digital Personal Data Protection Act, 2023 (DPDP Act) of India;
• The Information Technology Act, 2000 (IT Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
• The YouTube API Services Developer Policies governing access to YouTube Data API v3;
• The Google API Services User Data Policy, including the Limited Use requirements;
• The Meta Platform Terms and Developer Data Policy governing access to Facebook Graph API and Instagram Graph API; and
• Applicable global data protection frameworks, including the General Data Protection Regulation (GDPR) for international creators.

2. Information We Collect

We collect only the minimum necessary personal, operational, and technical information required to deliver our AI video generation, automated scheduling, social publishing, and performance analytics tools:

• Account & Profile Information: Full name, email address, encrypted authentication credentials, selected interface language, and user workspace preferences.
• Billing & Subscription Details: Subscription plan tier, transaction status, billing dates, order numbers, and invoice records. Note: All online payments are handled securely by authorized, PCI-DSS compliant payment gateways (such as Cashfree and Razorpay). StoryK NEVER collects, processes, or stores sensitive credit/debit card numbers, CVVs, or net banking credentials on our infrastructure.
• AI Video Generation Inputs: Video prompts, topics, custom narration scripts, chosen neural voice models, language selections, subtitle formatting styles, and visual scene search queries created within your Creator Dashboard.
• Social Media Connection & Token Data: OAuth user access tokens, refresh tokens, connected channel/account identifiers (such as YouTube Channel ID, Instagram Business Account ID, Facebook Page ID), account display names, and public profile avatars.
• Technical, Device & Analytics Data: IP address, browser type and version, device operating system, access timestamps, feature usage interactions, and system diagnostic logs to maintain platform stability and protect against malicious cyber activity.

3. Meta (Instagram & Facebook) Platform Data Handling & Privacy Disclosures

StoryK offers optional social media publishing and performance analysis tools powered by the official Meta Graph API. When you connect your Facebook Page or Instagram Business/Creator Account to StoryK, the following specific terms apply:

3.1. Instagram Direct Content Publishing & Account Management

• Permissions Requested: instagram_business_basic, instagram_business_content_publish.
• Data Accessed: Connected Instagram Business/Creator Account ID, username, public profile photo, media container creation identifiers, publishing status, and OAuth access tokens.
• Purpose of Use: To enable you to create, schedule, format, and automatically publish short-form video Reels, video posts, custom thumbnails, captions, and hashtags directly to your authorized Instagram accounts at times you configure.
• User Control: Content is published to Instagram strictly upon your explicit instruction or according to automated schedules and niches configured by you in your Creator Dashboard. StoryK never publishes unauthorized or unsolicited posts to your account.

3.2. Facebook Page Content Publishing & Scheduling

• Permissions Requested: pages_show_list, pages_manage_posts.
• Data Accessed: List of Facebook Pages you manage (Page ID, Page name, Page category, Page profile picture), Page access tokens, published post IDs, and post publication statuses.
• Purpose of Use: To display your authorized Facebook Pages for selection, and to schedule, format, and publish video Reels, short videos, video titles, and descriptions to your chosen Facebook Pages.

3.3. Strict Scope Limitation (Publishing Only)

In accordance with the principle of least privilege, StoryK restricts its Meta API requests strictly to post creation and page listing. StoryK does NOT request or access page read analytics, user private messages, personal profile feeds, ad accounts, or user friend lists.

3.4. Meta Token Security, Storage & Encryption

All Meta OAuth access tokens, refresh tokens, and account keys are transmitted exclusively over encrypted HTTPS/TLS 1.3 channels and are stored at rest using AES-256 encryption with isolated key management. Tokens are never exposed in client-side source code, public logs, or unauthorized endpoints.

3.5. Prohibition on Data Sale, Profiling & Advertising Exploitation

In strict compliance with Meta Developer Policies, StoryK affirms that:

• We do NOT sell, rent, lease, trade, or transfer Facebook or Instagram user data or access tokens to data brokers, ad networks, search engines, or third-party marketers.
• We do NOT use Facebook or Instagram data for surveillance, user tracking, credit assessment, or profiling purposes.
• We do NOT use Meta user content or social analytics to train public AI foundational models without explicit user consent.

4. YouTube API Services & Google User Data Disclosures

StoryK provides automated video publishing, short-form scheduling, and channel management features powered by the official YouTube API Services (YouTube Data API v3). By connecting your YouTube channel to StoryK, you acknowledge and agree to the following dedicated policies:

4.1. Google OAuth Permissions Requested & Scope

• https://www.googleapis.com/auth/youtube.upload: Used strictly to upload user-created vertical video Shorts and videos directly to your authorized YouTube channel at your scheduled posting times or on demand.
• https://www.googleapis.com/auth/youtube.readonly: Used to display your channel identity (channel name, channel ID, custom handle, and profile avatar) inside your StoryK dashboard, and to verify publication execution and view counts.
• https://www.googleapis.com/auth/youtube.force-ssl: Used to attach video titles, AI-generated descriptions, tags, category IDs, and privacy states (Public, Unlisted, Private) configured by you.

4.2. YouTube Data Accessed, Collected & Stored

• Channel Identification: YouTube Channel ID, channel title, channel handle, and profile thumbnail image.
• Video Upload Metadata: Video titles, descriptions, tags, category IDs, privacy visibility status (Public, Unlisted, Private), upload timestamps, and YouTube video IDs.
• Publication & Status Data: Upload processing state and basic public view counts to confirm successful delivery on your Content Planner and Social Automation Studio.
• OAuth Security Tokens: Encrypted Google OAuth 2.0 access and refresh tokens.

4.3. Google API Services User Data Policy & Limited Use Statement

StoryK's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.4. Strict Prohibition on Sale of YouTube Data & AI Training

• StoryK does NOT sell, rent, lease, trade, or transfer YouTube user data or access credentials to data brokers, ad networks, or external entities.
• StoryK does NOT use YouTube user data or channel content for surveillance, credit assessment, or profiling.
• StoryK does NOT use YouTube user content to train, fine-tune, or develop public or commercial AI/ML foundational models without your express written consent.
• StoryK does NOT serve targeted advertisements using your YouTube account information.

4.5. YouTube Token Security, Retention & 30-Day Limits

• All communications with Google/YouTube APIs occur over encrypted TLS 1.3 / HTTPS channels.
• Google OAuth tokens are stored encrypted at rest using AES-256 encryption.
• In compliance with YouTube API Services Developer Policies, cached non-persistent YouTube API data is refreshed regularly and is not retained longer than 30 calendar days.

4.6. How Users Can Revoke Access (Google Security Settings)

Users can revoke StoryK's access to their Google account data at any time via the Google Security Settings page at https://myaccount.google.com/permissions. Removing StoryK from your authorized Google apps immediately invalidates all tokens and terminates our access.

5. AI Model Processing & Voiceover Synthesis Disclosures

StoryK leverages artificial intelligence models (such as Google Gemini, OpenRouter, and Sarvam AI) to generate scripts and synthesize regional neural voiceovers:

• Only prompt topics and script texts submitted by the user are transmitted to AI inference engines.
• Your private authentication credentials, social media access tokens, billing information, and email addresses are NEVER shared with or processed by third-party AI model providers.
• AI-generated scripts and audio files remain the intellectual creation of the user, subject to our Terms of Service.

6. Third-Party Sub-Processors & Infrastructure Providers

To provide high-reliability cloud computing, StoryK engages trusted enterprise sub-processors under strict data protection agreements:

• Amazon Web Services (AWS Asia Pacific - Mumbai): Secure cloud hosting, database storage, and AWS Lambda GPU/CPU serverless video compilation.
• Google LLC (YouTube Data API): Official API infrastructure for uploading YouTube Shorts and monitoring upload analytics.
• Meta Platforms, Inc. (Graph API): Official API infrastructure for publishing Reels/videos and fetching analytics on Instagram and Facebook.
• Sarvam AI: Indian neural voiceover synthesis engine for high-fidelity regional Indian languages (Hindi, Tamil, Telugu, Kannada, Bengali, etc.).
• Payment Gateways (Razorpay & Cashfree): Authorized payment gateways for processing INR and USD subscription billing.

7. Data Retention, Storage & Security Measures

• Data Encryption: All data in transit is protected via TLS 1.3 encryption. Sensitive tokens and secrets are encrypted at rest using AES-256.
• Rendered Video Retention: Rendered video output files and temporary scene clips are securely cached on cloud storage to allow downloading and social publishing. Temporary render caches are automatically cleaned based on system storage cycles.
• Social Token Retention: Social media tokens are stored only while your account connection is active. When you disconnect a social channel or delete your StoryK account, all corresponding access tokens and scheduled posts are immediately purged.

8. User Data Deletion Instructions & Revocation

StoryK provides multiple simple, instant methods for users to delete their personal data, revoke social media access, and request complete erasure:

• Method 1 (Instant Disconnection in StoryK): Navigate to your Creator Dashboard → Social Automation Tab, and click "Disconnect" next to any connected YouTube, Instagram, or Facebook account. This immediately invalidates and deletes the stored access tokens and halts all scheduled automation.
• Method 2 (Revoke via Google Security Settings for YouTube):
  1. Visit the Google Account Permissions dashboard: https://myaccount.google.com/permissions.
  2. Locate StoryK in the list of third-party apps with account access.
  3. Click Remove Access to instantly invalidate StoryK's OAuth access and refresh tokens.
• Method 3 (Revoke via Meta / Facebook Settings):
  1. Log in to your Facebook account and open Settings & Privacy → Settings.
  2. In the left sidebar, select Apps and Websites.
  3. Locate StoryK in the list of active apps and click Remove.
• Method 4 (Dedicated Data Deletion Page & Automated Request): You can visit our dedicated User Data Deletion page at https://storyk.in/data-deletion or submit a request directly to support@storyk.in. All associated user records, task histories, and social data will be permanently wiped within 48 to 72 hours.

9. User Rights Under the DPDP Act 2023 & International Laws

As a Data Principal under the DPDP Act 2023 and global privacy standards, you have the right to:

• Right of Access & Summary: Request a summary of personal data being processed by StoryK.
• Right to Correction & Erasure: Request the correction of misleading or incomplete data, or the complete erasure of your personal data.
• Right to Nominate: Nominate an individual to exercise data rights in the event of death or incapacity.
• Right of Grievance Redressal: Submit grievances directly to our Data Protection Officer for prompt resolution.

10. Statutory Grievance Redressal Officer (IT Act 2000, IT Rules 2021 & DPDP Act 2023)

In accordance with the Information Technology Act 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, and the Digital Personal Data Protection Act 2023, the contact details of our designated Grievance Redressal Officer are:

11. Non-Affiliation & Trademark Disclaimers

StoryK is an independent SaaS productivity application developed to help creators produce and distribute multimedia content. StoryK is not affiliated with, endorsed by, sponsored by, or a partner of Google LLC, YouTube, Meta Platforms, Inc., Instagram, Facebook, TikTok, or ByteDance. All trademarks, service marks, logos, and brand names are the property of their respective owners.

12. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements in our features, changes in YouTube API Services Developer Policies, Meta Platform Terms, or legal amendments. Updates will be posted on this page with a revised "Last updated" date. Continued use of StoryK after modifications constitutes your acceptance of the updated policy.