Privacy Policy

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Manuel Gasteiger, [street and house number], [postcode and city], [country]. Email: [contact email].

2. Hosting (Cloudflare)

The site runs on Cloudflare Workers, and story submissions are stored in a Cloudflare D1 database. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Whenever you open a page, Cloudflare necessarily processes your IP address, the page requested, your browser type and the time of the request in order to deliver the page and to protect the site against attacks. We do not keep access logs of our own.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in delivering the site securely and reliably). Cloudflare may process data in the USA; it is certified under the EU-US Data Privacy Framework and uses the EU standard contractual clauses. See the Cloudflare privacy policy.

3. Cookies

We set only two cookies, both strictly necessary, so no cookie banner is needed:

• st_locale remembers the language you chose (EN, RU or DE) for one year. It is set only when you use the language switcher.
• storyteller_session is used only in the private admin area by the site operator. Visitors never receive it.

We set no third-party cookies ourselves. For the video player, see the YouTube section below.

4. Fonts

The Nunito typeface is served from our own server. No connection to Google Fonts or any other font service is made.

5. YouTube videos

Story pages and the “How it works” page embed our films with YouTube’s privacy-enhanced player (youtube-nocookie.com). As soon as such a page loads, your browser connects to YouTube servers and transmits your IP address and technical browser data. When you press play, YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) may store cookies or similar identifiers in your browser and process your viewing data, including in the USA. We have no influence over that processing.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in showing our own films on our own site). If you prefer to avoid this, do not open the story pages, or watch the films directly on YouTube under Google’s terms. See the Google privacy policy.

6. Sending a story (the form)

On the “Send us your story” page you can send us a story your child invented. We then store: the story text (required); the child’s first name and age (optional); your email address (optional); the language of the form; a shortened hash of your IP address; the time of sending; and an internal handling status (new, read, picked, done).

Purpose: reading the idea and possibly turning it into a film; crediting the child by first name and age in the film and on this site, if you provided them; and contacting you at the email you gave, only about that story. We never use the email for newsletters or advertising.

Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the box in the form. You can withdraw it at any time by email, with effect for the future.

Children’s data: the form is meant for parents and guardians, and we ask you to confirm that you are one. If we believe a child sent something on their own, we delete it. Leave the name and age blank if you would rather the child stayed anonymous.

Retention: submissions stay in our story box while we work on them and are deleted no later than 24 months after sending. Email addresses are deleted as soon as we have replied, or together with the submission. The IP hash is deleted automatically after 7 days.

Anti-spam: the form contains a hidden field that only bots fill in, and we allow at most 5 submissions per 10 minutes per IP hash. The hash is a truncated SHA-256 value; we cannot recover your IP address from it.

7. Story Builder

The experimental Story Builder runs entirely in your browser. Nothing is saved until you press “Send my story to the storytellers”. We then store the story you built, as structured text, together with an IP hash as described above. The Builder asks for no personal data; please do not type any into the story. Purpose, retention and your rights are the same as for the form.

8. Who receives your data

We do not sell data and do not use it for advertising. Our processors are Cloudflare (hosting and database) and YouTube/Google (video player). Beyond that, data is disclosed only where the law requires it.

9. Your rights

Under Art. 15 to 21 GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent at any time (Art. 7(3) GDPR), and you can lodge a complaint with a data protection supervisory authority, for example the one at your place of residence.

To exercise your rights, write to [contact email]. To have a submission deleted, tell us roughly when it was sent and what it was about so that we can find it.

10. Changes

We update this policy when the site changes. The date at the top shows the current version.