Privacy Policy

1. Who We Are

Loreteller is a digital storytelling toolkit available at loreteller.com (the "Site"). For any privacy-related questions, contact us at [email protected].

2. Information We Collect

Information you provide

Email address — required to create an account and access resources. Used for authentication via magic link (no password is stored).
Payment information — if you purchase the Premium Toolkit, payment is processed by Stripe. We do not receive or store your credit card number. We receive your email address, transaction ID, and payment confirmation from Stripe.

Information collected automatically

Usage data — pages visited, features used, and referring URLs, collected via Google Analytics and advertising pixels (see Section 4).
Device data — browser type, operating system, and screen resolution. Google Analytics 4 does not store full IP addresses.
Cookies and local storage — used for authentication sessions, user preferences (such as favorited resources), analytics, and conversion tracking deduplication. See Section 5 for details.

3. How We Use Your Information

Authentication — to sign you in and provide access to free and premium resources.
Purchase fulfillment — to grant and verify your premium access.
Site improvement — to understand how resources are used and improve the toolkit.
Advertising measurement — to measure the effectiveness of our advertising campaigns.
Transactional communication — to send magic link emails and purchase confirmations. We do not send unsolicited marketing emails.

4. Third-Party Services

We use the following third-party services that may receive your data:

Service	Purpose	Data shared
Supabase	Authentication and database	Email address, account data
Stripe	Payment processing	Email, payment details
Google Analytics	Site analytics	Page views, usage data
Meta Pixel	Advertising measurement	Page views, conversion events
Reddit Pixel	Advertising measurement	Page views, conversion events
Pinterest Tag	Advertising measurement	Page views, conversion events

We do not sell your personal information to anyone. The advertising pixels listed above are used solely to measure campaign performance, not to sell data.

5. Cookies and Tracking

We use the following types of cookies and browser storage:

Essential — authentication session tokens (Supabase). Required for the site to function.
Functional — user preferences such as favorited resources, stored in your browser's local storage.
Analytics — Google Analytics cookies to measure site usage.
Advertising — Meta Pixel, Reddit Pixel, and Pinterest Tag cookies. These track page views across the Site and conversion events (purchases) on the checkout success page to measure advertising performance.

Most browsers allow you to block or delete cookies through their settings. Blocking essential cookies will prevent authentication from working.

Do Not Track

Some browsers send a "Do Not Track" signal. There is no industry standard for how websites should respond to this signal. We do not currently alter our data collection practices based on Do Not Track signals. You can opt out of tracking by blocking cookies in your browser settings or using a browser extension.

6. Data Retention

Account data — retained for as long as your account exists.
Payment records — retained as required for accounting and legal obligations.
Analytics data — retained according to each service's default retention policy.

You may request deletion of your account and associated data at any time by emailing [email protected]. We will process deletion requests within 30 days.

7. Data Security

We protect your data using:

HTTPS encryption on all pages
Supabase Row Level Security for database access control
Stripe PCI-compliant payment processing
No storage of passwords (magic link authentication only)

No method of transmission over the internet is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have the right to:

Access — request a copy of the personal data we hold about you.
Correction — request correction of inaccurate data.
Deletion — request deletion of your account and personal data.
Portability — request your data in a machine-readable format.
Opt out of tracking — block cookies in your browser settings or use a browser extension to block analytics and advertising scripts.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

California Residents

Under the California Consumer Privacy Act (CCPA), California residents have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information. To make a request, email [email protected].

European Economic Area Residents

If you are located in the EEA, our legal basis for processing your data is: consent (account creation), contract performance (premium access fulfillment), and legitimate interest (site improvement and advertising measurement). You may withdraw consent at any time by deleting your account.

9. Children's Privacy

The Site is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

10. International Data Transfers

The Site is operated from the United States. If you access the Site from outside the US, your data may be transferred to and processed in the United States. By using the Site, you consent to this transfer. Our third-party service providers may also process data in other jurisdictions in accordance with their own privacy policies.

11. Changes to This Policy

We may update this Privacy Policy at any time by posting the revised version on this page with an updated effective date. For material changes, we will notify registered users by email.

12. Contact

For privacy questions or data requests, email [email protected].