The short version: What Wind and River remember about you is sealed with a key we do not have, so nobody but you can read it — not us, not anyone who compels us. Your conversations with them are sealed the same way, and your writing goes to your own Google Drive if you connect it. Messages pass through our servers to reach the AI; what we keep, we keep only in a form we cannot read. We do not sell your data, and nothing you say is used to train a model.
What We Collect
When you sign in:
- Name and email address — to identify your account
- A stable account identifier from Google, or your email address if you sign in with an emailed link — to recognise you across visits
Sign-in is provided by Google or by a one-time link sent to your inbox. We never see your Google password. Sign-in asks for identity only. The optional Drive features, described below, ask separately for their own narrow permission if and when you turn them on.
Service usage:
- Usage metering — we record the amount of AI processing your account uses, measured in tokens, so we can manage your membership. This is a number, not the content of what you said.
- Feature counts — we count how often features are used, as totals, not tied to profiles of individual behaviour.
- Country and last active date — basic operational information.
- Arrival tag — if you arrived through a campaign link, we record that campaign's tag once, so we know which invitations work. It says where you came from, not who you are.
- Crisis counts — every message to an AI character is checked for signs of crisis before the AI answers (see Safety and crisis help). When a sign appears we record the day and the kind of sign, nothing else: not your words, not your account, not your address. We use the totals to see whether the check works and to report them where the law requires.
- Talking time — to offer a break after three hours of continuous conversation, we keep when your current stretch of talking began and when you last sent a message, under a scrambled identifier. Not what you said.
Your Locket
The Locket is where Wind and River keep what they know about you. It is sealed in your own browser before it is sent to us, using a key made from a passphrase we never receive. We store the sealed result. There is no function on our servers that opens it — not disabled, not restricted to staff: it does not exist.
How it is sealed
When you choose a passphrase, your browser turns it into an encryption key (PBKDF2, 600,000 rounds) and uses that key to encrypt the contents (AES-256-GCM). Only the encrypted result and a random value called a salt ever reach us. The salt is not a secret and is not a key; it exists so that two people who choose the same passphrase do not end up with the same lock.
What it holds
- A short portrait of you, written by Wind and River, which you can read and correct
- A longer record, searched inside your own browser
- What each of them separately remembers of working with you
- Your conversations with them, so you can pick up where you left off on any device
As a Locket fills, its older half is sealed into an archive under the same key. Nothing is discarded, and archives are only opened when something in them is looked for.
The one thing we cannot do
If you lose your passphrase, we cannot recover your Locket. There is no reset link, no support route, and no exception for us. The only remedy is to clear it and begin a new one, which permanently destroys the old contents. This is the direct and intended consequence of nobody but you holding the key.
What happens when you are talking
To answer you, the AI has to be able to read the relevant part of your Locket. Your browser unlocks that part and sends it with your message, held in memory for the moment of answering and never written to our storage. So the accurate statement is: we never store it in a form we can read. We do not claim it never passes through us, because that would not be true.
Your controls
- Read your portrait and correct anything wrong with it
- Delete your Locket entirely, at any time
- Choose whether a device remembers your key. If it does, your Locket opens without typing; if you have chosen to be remembered you can undo that for any device, which removes the key there and leaves the Locket untouched.
Where Your Conversations Live
In your Locket. Your conversations with Wind and River are sealed in your browser with your Locket key before they are saved, so they follow you to any device where you open your Locket. We store them only in that sealed form and cannot read them. A working copy also stays in your browser. You can export them to a file you keep, and delete them at any time.
In transit: when you send a message, it passes through our server on its way to the AI provider and the reply passes back. On the way, each message is checked automatically for signs of crisis, as described on our Safety page. We relay this traffic; we do not keep a readable copy.
When you explicitly share: some features let you choose to place a copy on our server — for example moving your conversations to another device with a transfer code. Anything you share this way:
- happens only when you press a clearly labelled button, never by default
- is deleted automatically after 14 days at most
- can be deleted by you sooner, at any time
Clubs
A club is a private room for a small group of people you invite. The messages people write in a club are encrypted on their own devices before they are sent, with a key shared only among the club's approved devices. We store the sealed messages and cannot read them.
To run a club we do keep some things in readable form: the club's name, description, meeting details and pinned notes; who belongs to it and their display names; and which devices each member has approved. When someone asks to join or adds a new device, we email the club's hosts to say so, without any message content.
If you ask Wind or River for help inside a club, that conversation is between you and them, handled like any other conversation with them.
Google Drive, If You Connect It
You can connect your own Google Drive. If you do, a StoryTalk folder appears in it and holds:
- Your documents from the Private Writer, as ordinary files you can open without us
- Your Private Journal entries, as plain text
- A file carrying your conversations between your devices
What matters about this arrangement:
- The permission we ask for is the narrowest Google offers. We can only see files this feature itself created. Your other Drive files, documents and photos are invisible to us, including anything you place in the StoryTalk folder yourself.
- The sync runs between your browser and your Drive. Our servers are not part of it and hold no copy.
- Disconnecting takes one click, and deleting the files in your Drive removes that data entirely.
- Google can read files in your Drive under its own policies. Connecting Drive is a choice to keep your work somewhere you own; it is not a claim that Google cannot see it.
The Foundry, If You Install It
The Foundry is an optional application that runs on your own Mac. It stores your memories and documents in a folder in your home directory. It communicates only with your own browser, on your own machine. Nothing it holds is sent to us, and we have no way to see what is in it or whether it is running.
The Agent Check
We publish a free check that lists which programs on your computer can act on their own. It runs entirely on your machine, reads only the list of running programs, changes nothing, and sends nothing anywhere. We receive no result, no account is required, and we have no way of knowing you ran it.
What We Do Not Do
- We do not train AI models on your conversations, and we do not permit our providers to do so on our behalf
- We do not sell or share your personal information with third parties for advertising
- We do not show advertising
- We do not build behavioural profiles from your feature usage
- We do not keep your conversations in any form we can read. The one exception is a copy you choose to share with a transfer code, which is deleted within 14 days
Third-Party Services
AI processing: your messages are processed by AI providers to generate responses. Depending on which is in use, this includes Anthropic and models reached through OpenRouter. These providers handle message content under their own privacy policies:
Sign-in and optional Drive features: Google provides authentication, and Drive features use the Google Drive API, both under the Google Privacy Policy.
Payments: membership payments are handled by our payment processor. We do not receive or store your full card number.
Security
Traffic between you and us is encrypted in transit. Your Locket is additionally encrypted before it leaves your browser, which means a breach of our servers would expose sealed data we could not read ourselves. No system is perfect, and we do not claim otherwise; the Locket exists so that the worst case is smaller than it would otherwise be.
Data Retention
- Account information (name, email): kept while your account is active; deleted on request
- Usage metering: kept as operational records
- Your Locket: kept, sealed, until you delete it or close your account
- Explicit transfers: 14 days maximum, then automatically deleted
- Crisis counts: kept as totals for annual reporting
- Clubs: kept, sealed, while the club exists
- Everything in your browser, your Drive, or your Foundry: entirely under your control
To request deletion of your account data, contact info@biglovestudios.com.
Your Rights
- Access — request a copy of the data we hold about you. For your Locket this means the sealed file; we cannot produce a readable version, because we cannot read it.
- Correction — update inaccurate information, including your portrait
- Deletion — request deletion of your data
- Portability — export your own data at any time with the built-in export
Children's Privacy
StoryTalk is not intended for users under 18 years of age. We do not knowingly collect information from children under 18.
Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes via email or in-app notice.
Contact Us
Questions about privacy? Contact info@biglovestudios.com
StoryTalk, LLC
← Back to StoryTalk