Privacy Policy

Effective Date: July 12, 2026

This Privacy Policy explains how The Stream Facility ("we," "us," "our") collects, uses, and protects your personal data. We are committed to compliance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA/CPRA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Australia's Privacy Act 1988 (APPs), Brazil's Lei Geral de Proteção de Dados (LGPD), and other applicable regional laws.

Data Controller: Stream Facility — https://streamfacility.com/contact

1. Data We Collect

Account data: Name, email address, and a hashed (never plaintext) password when you register.

Profile data: Biography, social links, profile image, genre preferences, and other information you choose to provide.

Content data: Written works, codex entries, chapter notes, planning documents, AI conversation history, and other creative content you create on the Platform. Your creative content is yours and is not used for any purpose beyond delivering the service to you.

Subscription data: Subscription tier, billing cycle, and payment status. Payment card details are processed directly by Stripe and are never stored on our servers.

Usage data: Features used, sync activity, log-in times, and interaction history, used to operate and improve the Platform.

Communication data: Support inquiries, beta reader messages, and in-platform communications.

Technical data: IP address, browser type, operating system, and device identifiers collected automatically when you access the Platform. IP addresses are used for security and fraud prevention and are not linked to your content or sold.

Desktop app: The Stream Facility Desktop application stores your data locally on your device in an encrypted SQLite database. This data does not leave your device except when you explicitly initiate a sync. No additional telemetry or usage data is collected from the desktop app.

Affiliate program data: If you apply to the Affiliate Program, we collect your full legal name, tax identification number (SSN for individuals, EIN for businesses), tax classification, and mailing address. This information is required for tax compliance, including the issuance of IRS Form 1099-NEC. Your tax ID is encrypted at rest using AES-256-GCM encryption and is never stored in plaintext. Only the last four digits are visible to authorised Platform staff. Tax IDs of rejected or suspended applicants are automatically purged after 90 days. All access to affiliate tax data is logged.

2. How We Use Your Data

| Purpose | Legal basis (GDPR / UK GDPR) | Legal basis (other) |
|---|---|---|
| Operating and delivering the Platform | Contract performance (Art. 6(1)(b)) | Contractual necessity |
| Account and subscription management | Contract performance | Contractual necessity |
| Security, fraud prevention, and rate limiting | Legitimate interests (Art. 6(1)(f)) | Legitimate business interest |
| Customer support | Legitimate interests | Legitimate business interest |
| Legal compliance and responding to lawful requests | Legal obligation (Art. 6(1)(c)) | Legal obligation |
| Transactional communications (receipts, security alerts) | Contract performance | Contractual necessity |
| Service improvement and bug fixing | Legitimate interests | Legitimate business interest |
| Marketing and promotional communications | Consent (Art. 6(1)(a)) | Consent |

We do not use your content for model training, advertising targeting, or any purpose other than providing the service to you.

3. AI Writing Assistance and Data Processing

When you use AI writing assistance features, the text you submit (scene content, prompts, chat messages) is transmitted to your configured AI provider via their API. Only the text you explicitly send is transmitted — we do not batch-transmit your full manuscript library. Each provider's privacy policy governs their handling of API input. We do not store AI providers' responses beyond your session or conversation history as displayed to you in the Platform.

Local LLM: If you configure a local language model, prompts are processed entirely on your own device and are not transmitted to Stream Facility's servers or any third-party service. No data leaves your machine in this mode.

OpenRouter: If you use OpenRouter, your prompts are transmitted to OpenRouter (USA), which routes them to the underlying model provider you have selected (which may include providers outside the USA). OpenRouter's privacy policy at openrouter.ai/privacy governs their handling of your data and that of their downstream providers.

4. Data Sharing and Processors

We share your data only with service providers ("processors") that help us deliver the Platform. All processors are bound by data processing agreements:

| Processor | Purpose | Location |
|---|---|---|
| Vercel | Cloud hosting and content delivery | USA (with global CDN) |
| MongoDB Atlas | Database hosting | USA |
| Stripe | Payment processing and subscription management | USA |
| Cloudinary | Image storage and delivery | USA (with global CDN) |
| Resend | Transactional email and author mailing lists | USA |
| Anthropic | AI writing assistance (user-configured) | USA |
| OpenAI | AI writing assistance (user-configured) | USA |
| OpenRouter | AI writing assistance — routes prompts to user-selected downstream model providers | USA |
| Google AdSense / DoubleClick | Display advertising and ad personalisation | USA (with global CDN) |

We do not sell your personal data. We use Google AdSense to display advertisements; this involves Google receiving information about pages you visit on the Platform in order to serve relevant ads. See our Cookie Policy for details and opt-out options.

5. International Data Transfers

Our primary infrastructure is located in the United States. If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with data transfer restrictions, we transfer your data to the US under appropriate safeguards:

• EEA → USA: Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914)
• UK → USA: International Data Transfer Agreements (IDTAs) approved by the UK ICO
• Other jurisdictions: Equivalent contractual protections or as permitted by applicable law

6. Data Retention

We retain your account and content data for as long as your account remains active. If you delete your account, we delete your personal data promptly (typically within 30 days), except where we are required by law to retain it longer — for example, financial records and transaction data are retained for up to 7 years for tax and accounting purposes. Anonymised or aggregated data that cannot identify you may be retained indefinitely.

Tax identification numbers collected through the Affiliate Program are purged from rejected and suspended applications after 90 days. Active affiliate records are retained for the life of the affiliate relationship plus 7 years, as required for tax compliance.

7. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required under GDPR Art. 33 and UK GDPR). We will notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34).

8. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects about you (GDPR Art. 22). Subscription tier limits are enforced mechanically based on your account tier, not by profiling.

9. Your Privacy Rights

EU / EEA users (GDPR):
- Access (Art. 15): Request a copy of the personal data we hold about you
- Rectification (Art. 16): Request correction of inaccurate data
- Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
- Restriction (Art. 18): Request that we limit how we use your data
- Portability (Art. 20): Receive your data in a machine-readable format
- Objection (Art. 21): Object to processing based on legitimate interests
- Complaint: Lodge a complaint with your national data protection supervisory authority. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en

United Kingdom users (UK GDPR):
All GDPR rights above apply under the UK GDPR. You may also lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint.

California residents (CCPA / CPRA):
- Right to know what personal information is collected and how it is used
- Right to delete your personal information
- Right to correct inaccurate personal information
- Right to opt-out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising)
- Right to limit use of sensitive personal information
- Right to non-discrimination for exercising these rights

Canadian residents (PIPEDA):
You have the right to access your personal information and request correction of inaccurate information. Contact us at https://streamfacility.com/contact to exercise these rights.

Australian residents (Privacy Act 1988 / APPs):
You have the right to access and correct personal information we hold about you, and to make a complaint to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au if you believe we have not handled your information appropriately.

Brazilian residents (LGPD):
You have rights equivalent to those under GDPR, including access, correction, deletion, portability, and the right to revoke consent. Contact us at https://streamfacility.com/contact to exercise these rights.

To exercise any rights, contact us at: https://streamfacility.com/contact We will respond within 30 days (GDPR / UK GDPR) or 45 days (CCPA).

10. Security

We implement technical and organisational security measures appropriate to the sensitivity of the data we process, including:
- Encryption in transit (TLS 1.2+)
- Passwords stored as bcrypt hashes (never in plaintext)
- API keys and tax identification numbers stored with AES-256-GCM encryption using separate encryption keys for each data category
- Access controls limiting data access to authorised personnel
- Regular security reviews

In the event of a data breach, we will notify you and relevant authorities as required by applicable law.

11. Cookies

We use cookies and similar technologies. Please see our Cookie Policy for full details.

12. Children's Privacy

The Platform is intended for users aged 13 and over. We do not knowingly collect, use, or disclose personal data from children under the age of 13. This Platform is not directed at children under 13, and registration by anyone under 13 is prohibited.

If you are a parent or guardian and believe your child under 13 has created an account or provided personal data to us, please contact us immediately at https://streamfacility.com/contact. We will investigate and, if confirmed, promptly delete the account and all associated personal data.

If we discover that we have inadvertently collected personal data from a user under 13, we will delete that data without delay.

Users aged 13 to 17 may access General, Teen, and Mature-rated content. Explicit-rated content is restricted to users aged 18 and over and requires date-of-birth verification before access is granted. The Platform does not serve behavioural advertising to any user and does not share personal data with advertising networks.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice at least 14 days before they take effect. The updated policy will be posted here with a revised effective date.

14. Contact

Privacy questions and rights requests: https://streamfacility.com/contact

15. Security

We use Cloudflare Turnstile to protect our contact and submission forms from automated abuse. Turnstile may collect certain data to determine whether a visitor is human. See the Cloudflare Turnstile Privacy Policy for details.