Privacy Policy

This policy explains what personal data OutaStory GmbH processes, why, who we share it with, how long we keep it, and the rights you have. Where we name a third party below, that provider processes your data under its own privacy policy. You can view, export, or delete your data at any time from your privacy settings.

Reading the version for your role makes this easier to follow. We also publish three focused notices — for website visitors, for members and for writers. This page remains the complete reference policy.

Data Controller

The responsible party for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Thimo Buchheister
OutaStory GmbH
Bemeroder Strasse 67
30559 Hannover, Germany

Data Protection Officer

Our appointed Data Protection Officer is Attorney Kai Flatau, Hamburg.

Contact

For all data protection enquiries, please contact us at privacy@outastory.com.

General Data Collection

Server Logs

When you visit OutaStory, our servers automatically record the following data: your IP address, access timestamps, and browser/client information. This data is stored for a maximum of 10 days and is used solely for security and technical diagnostics.

Cookies

We use session cookies that are required for the platform to function correctly. These cookies are temporary and are deleted when you close your browser. We do not use persistent tracking cookies without your explicit consent.

Third-Party Services

We rely on the third-party services below. Essential services are required for the platform to function and operate on a contractual or legitimate-interest basis. Consent-based services run only after you opt in through our cookie/consent banner — none of them load before you agree. Each provider processes data under its own privacy policy.

Essential services

Required for OutaStory to operate. We cannot provide the service without these.

• Auth0 (Okta) — Authentication and account identity. Processes your email address, name, and login identifiers.
• Stripe (incl. Stripe Connect) — Subscription billing and author/speaker payouts, including Stripe Connect onboarding and identity verification (KYC). Processes your payment instrument, billing/payout address, VAT/tax ID, bank details, and transaction history. OutaStory never sees your full card number; card data and KYC documents are handled directly by Stripe.
• Microsoft Azure (SQL, Blob Storage) — Hosts our application and stores your data — the primary database and file/image/audio storage. Your data is hosted within the EU.
• Azure AI Search (Microsoft, EU region) — Search index for stories and authors. Holds author names, author bios, story titles, and story descriptions as a derived, rebuildable search index — the authoritative data remains in our primary database. When you delete your account, your author profile and all your story entries are removed from the index. The search index is essential platform infrastructure and is not a consent-based tracker; it does not introduce any new personal-data fields beyond what is already in your data export.
• Azure OpenAI & Azure Speech — Generate story cover images, story descriptions, and the speech-synthesis markup and audio narration for chapters. Only story and chapter content is processed; no account profile data is sent.
• ElevenLabs — Text-to-speech narration (ElevenLabs Inc.). When an author enables ElevenLabs audio for a story, its chapter text is sent to ElevenLabs solely to generate the spoken audio; no account or personal profile data is shared. In addition, for Premium authors who actively opt into voice cloning, a biometric voice sample is shared with ElevenLabs to create a cloned voice — this happens only on the basis of your explicit consent (Art. 9(2)(a) GDPR). We also use ElevenLabs (ElevenLabs Inc., US) to operate our optional voice and chat assistant "Ernest" (Conversational AI); when you use it, your conversation text and — if you speak — your voice audio are sent to ElevenLabs, but never your email address or account identifier. The assistant only starts after you actively open it and accept the first-use notice (consent, Art. 6(1)(a) GDPR) — see the "Conversational Assistant" section below for details.
• Azure Content Safety — Automated safety screening of comments, chapter text, and cover images. The text or image being checked is processed to detect harmful or disallowed content.
• SendGrid (Twilio) — Delivers transactional, newsletter, and marketing/announcement email. Processes your email address, display name, and delivery metadata. SendGrid is our only email vendor.
• Sentry — Error and performance monitoring on a legitimate-interest basis (no personal-data payloads by default). Optional session-replay diagnostics run only with your consent.
• Apple App Store, Google Play — Validate in-app purchases and subscriptions made through our mobile apps. Process purchase receipts and transaction identifiers.
• Stripe, Apple App Store, Google Play (Credits) — Processing credit purchases. Stripe handles credit purchases on the web app; the Apple App Store and Google Play process in-app credit purchases on mobile apps. OutaStory stores your current balance and an append-only transaction ledger (date, type, amount, balance after, reason). These financial records are retained for the statutory period under GDPR Art. 17(3)(b) and survive an erasure request.
• German Federal Central Tax Office (BZSt) — For authors who earn revenue, we are legally required to report identity and payout totals under the German Platform Tax Transparency Act (PStTG / DAC7).

Services used only with your consent

These load only after you accept the matching category in our consent banner. Until then, they are blocked.

• Google Analytics 4, Microsoft Clarity, Firebase Analytics — Web and app analytics, including session replay and heatmaps, used to understand how the platform is used. Process device, session, and event data.
• Google AdMob / AdSense, Meta Audience Network, Media.net, Monetag, Unity Ads — Advertising networks that may display ads and use cookies, advertising identifiers, and behavioural data. Shown only on ad-supported surfaces and only with your consent. On the web that consent is collected through our cookie banner; in our apps it is collected through the consent form of Google's User Messaging Platform (see "Advertising in our apps").
• OneSignal — Push-notification delivery. Processes a device push token and your account identifier, only if you enable push notifications.
• Bluesky, Meta / Instagram — When you connect a social account to cross-post a story, the story content, your author name, and an encrypted access token are shared with that network.
• LanguageTool — Optional grammar and spell-checking of your drafts. Draft text you submit for checking is sent to LanguageTool for analysis.

For the approximate location used in our own analytics, we use MaxMind GeoLite2 as a local database file embedded on our own servers — your IP address is never sent to MaxMind, so GeoLite2 is not a sub-processor.

Member Data

Registration & Account Data

When you register for an OutaStory account, we collect and store the information you provide: your name, email address, date of birth, gender, and postal address, plus optional preferences such as your favourite categories and relationship status. Date of birth, gender and address are required for registration; favourite categories and relationship status are optional and used to personalise your recommendations. This data is stored securely within the Microsoft Azure cloud infrastructure. You can view, change, export, or delete all of it at any time using the tools on this page. During the current closed testing phase we subscribe you to our newsletters (daily Story of the Day and the weekly digest) by default; you can unsubscribe at any time using the one-click link in any newsletter email or the toggles on your settings page.

Reading Activity

We track your reading progress, library interactions, and engagement metrics (e.g. pages read, time spent) in order to provide personalised recommendations and to support authors with aggregated analytics. For our own (first-party) analytics we store a salted, irreversible hash of your IP address — never the raw address by default — together with a privacy-bounded device signal that lets us link your anonymous sessions to your account once you sign in. We also derive an approximate location (country, region, and city) from your IP address for analytics purposes, without ever storing the IP address itself, and record a coarse indication of where you arrived from (e.g. a search engine, a social site, or direct) — never the full address of the page you came from. These first-party analytics records are kept for at most 14 months. Third-party analytics services (listed above) run only with your consent. Authors can see aggregate, anonymised statistics about the audience for their own works — including coarse age ranges and gender — only where at least 10 readers fall into a group, so no individual can be identified.

Serial Subscriptions

For a story published as an ongoing serial, you can subscribe to be notified about new installments. We store that you subscribed to that serial, plus the time of your last notification, so that several installments released in quick succession don't each trigger a separate notification. Subscribing is independent of favouriting and is based on your consent. The notification itself is delivered as a push notification (via OneSignal) and/or an email (via SendGrid/Twilio), following your existing notification preferences — this does not add a new vendor. You can unsubscribe at any time; doing so deletes the subscription immediately, as does deleting your data.

Marketing & Announcement Emails

From time to time we may send you marketing and announcement emails (for example, news about new features, contests, or noteworthy stories), and we may reach out to contacts who are not yet members. To understand whether these emails are useful and to improve them, we measure when an email is opened and when a link inside it is clicked, linked to your email address. Every such email contains a one-click unsubscribe link; once you unsubscribe — or if an email bounces or is reported as spam — your address is added to a suppression list so we no longer send you marketing emails. Your data export includes the campaign name, subject, and your own open/click signals, but never the body of the email. We keep that suppression entry even after you delete your data, on a legitimate-interest basis, solely so we can continue to honour your opt-out.

Marketing Contacts (Leads)

We may hold contact details (such as an email address, name, company, and which audience a contact belongs to) for marketing contacts who are not yet OutaStory members. For each such contact we record the lawful basis on which we hold their data and only ever contact them where we have one. Every marketing message includes a one-click unsubscribe link, and any contact can ask us to delete their details at any time. If you later create an account with the same email address, this contact record is included in your data export and is deleted when you erase your data.

Payment Processing

Payments — both subscription billing and, for authors and professional speakers, payouts — are handled by Stripe (including Stripe Connect). OutaStory does not store complete payment card details; your card data is held by Stripe under its own PCI-compliant systems.

Credit purchases are processed via Stripe (web app) or through the Apple App Store or Google Play (mobile apps). OutaStory stores your balance and a complete transaction history (date, type, amount, balance after, reason); these financial records are retained after an erasure request for the statutory period under GDPR Art. 17(3)(b).

Data Retention

Your personal data is retained for as long as your account is active. Upon account deletion, your personal data is removed within a reasonable timeframe. First-party analytics records are kept for at most 14 months, and abuse-prevention records that contain an IP address (such as content reports and moderation actions) have the IP removed after at most 12 months. An exception applies to financial transaction and tax records, which are retained for 10 years as required by German tax law (§ 147 AO).

Personalization

We personalize your home page from your reading activity — the categories, stories, authors and reading lengths you engage with — to surface stories you're more likely to enjoy. For signed-in adults, and only while this feature is enabled, we may also show a 'popular with readers like you' selection based on coarse age, gender and country groupings (never for under-18s, and only when enough readers share a grouping). You can view this personalization data in your data export and have it deleted at any time.

If you choose to add profession, music-genre or hobby details to your profile, signed-in adults may also see groupings such as "popular with jazz fans" or "popular among readers in your profession" — built from coarse, optional attributes only, never for under-18s, and only when enough readers share an attribute. These details are optional, are never shared with third parties, appear in your data export, and can be deleted at any time.

Conversational Assistant ("Ernest")

OutaStory offers an optional voice and chat assistant called "Ernest". It is inactive by default and only starts once you open it yourself and accept the first-use notice — nothing is sent to our assistant provider before you do. The legal basis is your consent (Art. 6(1)(a) GDPR).

The assistant is operated by ElevenLabs Inc. (United States) as our processor (Conversational AI). When you chat with Ernest, your conversation text and — if you speak — your voice audio are sent to ElevenLabs for processing and stored there. Because ElevenLabs is a US provider, this transfer relies on your consent. We deliberately share as little as possible: no email address and no account identifier. To give the conversation context we pass only display information — your display name, your roles, your language, and the platform (web or app). We do not give ElevenLabs a persistent identifier that links a conversation to your account, so OutaStory cannot associate the conversation content with your account.

About your assistant use, we ourselves store only two small items: the time you (as a signed-in user) accepted the notice, and a simple per-day count of conversations, used to run the service and prevent abuse. Both appear in your data export and are removed when you delete your account. The conversation content itself (transcript and audio) is held by ElevenLabs.

You can withdraw your consent at any time by simply no longer using the assistant (and, if you wish, clearing your browser data). Because we do not link conversations to your account, we cannot enumerate or delete them ourselves; if you want the conversation content held by ElevenLabs deleted, contact privacy@outastory.com and we will initiate deletion with our processor.

Without signing in, you can use Ernest as a text chat only and with a limited number of conversations per day. For this daily cap we store a random device identifier (a GUID) locally in your browser; it is functional, stays on your device, and is not linked to your identity.

Children & Young Users

OutaStory is a general-audience platform that is also used by minors, so we take youth protection seriously. We protect young readers through content-band age ratings — every story is rated 0, 6, 12, 16, or 18 — combined with server-side filtering and youth-protection labels (JusProg, age rating, and RTA). When you create an account we ask for your date of birth to confirm you are old enough to use the service. If you are under 16 (the age of digital consent in Germany under Art. 8 GDPR), we ask a parent or guardian to confirm their consent — through a link we email to them — before your account can be fully used. Your date of birth is stored on your profile; you can export or delete it at any time using the tools on this page. We never build an advertising or analytics profile that targets you as a minor.

For more on how we keep younger readers safe, see our Youth Protection page.

Writer Data

Writers who publish on OutaStory agree to the following data practices:

• Submitted stories and associated metadata are stored on OutaStory's servers for the duration of the publishing relationship.
• The writer's identity (or chosen pseudonym) is linked to their published works and displayed publicly on the platform.
• Publication metrics — including page reads, ratings, and revenue data — are tracked and made available to the writer via their dashboard.

Voice Cloning (Narrating Your Own Stories)

If you are a Premium author and actively opt in, you record a short voice sample or upload an existing audio recording, and OutaStory — working with ElevenLabs — creates a cloned voice you can use to narrate your own stories. The voice sample is biometric data and therefore a special category of personal data under Art. 9 GDPR, whether you record or upload it. We process it solely on the basis of your explicit consent (Art. 9(2)(a) GDPR). You can use your cloned voice to narrate your own stories; independently of that, you may also use it to create, for your own personal use, an audio rendition ("personal narration") of another author's published story — private by default and shareable only via a link you deliberately generate. You can delete these personal narrations at any time; they appear in your data export. The voice sample is stored until you delete it; deletion completely and permanently removes both the stored voice sample and the cloned voice held at ElevenLabs. We also store when your cloned voice was last used (an activity timestamp), to operate the service and manage our voice capacity efficiently; this timestamp is removed when you delete your voice. You can withdraw your consent at any time by deleting your cloned voice.

For the Professional Voice Clone (PVC) option, you upload multiple longer audio recordings to train a high-quality cloned voice; the full collection of those voice samples constitutes biometric data under Art. 9 GDPR. As part of the PVC process, your voice also goes through a voice verification step at ElevenLabs (a voice-based captcha) that confirms you personally recorded the submitted audio. This step is part of ElevenLabs' processing and falls within the existing data-processing agreement. All voice sample files uploaded for a PVC voice are stored until you delete your voice; on deletion, every sample file and the derived cloned voice at ElevenLabs are permanently removed.

Payouts, Marketplace & Tax Data

If you earn through revenue share or as a professional speaker in our marketplace, you complete Stripe Connect onboarding, including identity verification (KYC). We hold your payout country, tax residency, optional VAT ID, payout address, and KYC/tax-form completion status; Stripe holds your legal name, date of birth, bank details, and tax forms directly. For German revenue-share authors we are legally required to report your identity, gross payout, and transaction count to the German Federal Central Tax Office (BZSt) under the Platform Tax Transparency Act (PStTG / DAC7). Financial transaction and tax records are retained for 10 years under German law (§ 147 AO, § 257 HGB) and therefore outlive your account: they survive an erasure request and are anonymised only when the statutory period ends.

Your Rights under GDPR

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights with respect to your personal data:

• Right of Access (Art. 15 GDPR) — You may request confirmation of whether we process your personal data and, if so, obtain a copy of it.
• Right to Rectification (Art. 16 GDPR) — You may request correction of inaccurate or incomplete personal data we hold about you.
• Right to Erasure (Art. 17 GDPR) — You may request deletion of your personal data subject to applicable legal retention obligations.
• Right to Restriction (Art. 18 GDPR) — You may request that we restrict the processing of your data in certain circumstances.
• Right to Data Portability (Art. 20 GDPR) — You may receive your personal data in a structured, machine-readable format.
• Right to Withdraw Consent (Art. 7(3) GDPR) — Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@outastory.com. We will respond within the timeframes required by applicable law.

Account Activity & Security Log

Internally, we keep a log of security- and accountability-relevant account actions — for example publishing actions, moderation decisions, role changes, or credit-balance movements — recording what happened and when, linked to the acting account. The legal basis is our legitimate interest in platform security and accountability (Art. 6(1)(f) GDPR); for credit-wallet and revenue-share movements our statutory retention obligation also applies (Art. 6(1)(c) GDPR). Log entries are deleted after at most 12 months; entries for credit-wallet and revenue-share movements instead follow the 10-year statutory tax retention period (see "Data Retention" above). Your own logged actions appear in your data export. If a staff member takes an action on your account (for example a moderation action), your data export shows that action and its timestamp — but not who performed it: that remains an internal accountability record.

Two-Factor Authentication

You can add an extra layer of security to your account with two-factor authentication (2FA) — using an authenticator app, a security key (e.g. a YubiKey), or a passkey (fingerprint/face). This feature is optional and can be turned on under "Security & 2FA" in your profile. Whether 2FA is enabled for your account, and the enrolled factors themselves — the type of factor and when you set it up — are managed on our behalf by our authentication provider Auth0 (Okta) (already listed above as an essential service); we do not additionally store this in our own database, and instead read it back from Auth0 to build your data export. Your data export accordingly shows whether 2FA is enabled, the types of factors you have enrolled, and when the first one was set up. This data is retained for as long as your account exists; deleting your account also deletes your Auth0 user record, which automatically removes all enrolled factors with it.

Advertising in our apps (Android & iOS)

Our mobile apps are paid for by advertising. The ads are served by Google AdMob (Google Ireland Ltd. / Google LLC). To do that, Google processes your device's advertising ID (AAID on Android, IDFA on iOS), your IP address, and coarse device details (operating system, device model, screen size, language) in order to choose which ads to show and to count how often an ad was seen. For ad serving Google acts as an independent controller, not as our processor — Google's own privacy policy applies.

The legal basis is your consent (Art. 6(1)(a) GDPR). We collect it on first launch through the consent form of Google's User Messaging Platform (UMP). Until you have consented — and also if the form cannot be loaded for technical reasons — not a single ad request is made. On iOS we additionally ask, afterwards, via Apple's App Tracking Transparency (ATT) whether we may use your device's advertising ID; if you say no you still see ads, just less relevant ones.

You can change your answer at any time — in the app under Profile → Privacy → "Ads & privacy". This works without an account. You can also reset or block the advertising ID at any time in your device's system settings (Android: Settings → Privacy → Ads; iOS: Settings → Privacy → Tracking).

We store none of it ourselves. Neither your advertising ID nor the IP address of your ad request ever reaches our servers; both stay on the device and with Google. All that lands in our database is an anonymous counter per displayed ad (which story, which slot, which ad network) so that we can share advertising revenue with our authors — with no identifier of you attached. Your data export therefore has nothing to show for this.

On our website, consent is not collected through UMP but through our cookie banner (see "Cookies and similar technologies").

Offline reading in our apps (storage on your device)

So that you can keep reading without a connection, our apps (Android, iOS, macOS, Windows) keep a copy on your own device: the text and the cover image of every story you open, plus a small selection of stories that already ships with the app. For each copy we store two technical timestamps — when it was stored and when it was last opened — so the app can decide which copy to remove first when it runs short of space. This does not include your reading progress: where exactly you stopped reading is still remembered only by your account on our servers (see "Reading Activity").

As a Premium member you can also deliberately make a story available offline — via "Make available offline" on the story page. Alongside the text and cover, we then also save the narrated version as an MP3 file per chapter on your device, so you can listen without a connection; if you listen to a chapter while online, we save it as a copy for the same reason, so a dropped connection doesn't interrupt playback. The app also stores a small technical confirmation that you were last recognised online as a Premium member, and when. That confirmation is valid for 30 days: within that window you can keep listening to your already-downloaded stories with no connection; new downloads stay blocked until we can check your membership online again. It records nothing further about you — only that, and when, a Premium membership was last confirmed.

Writing works offline too: if you start a new story or edit an existing draft in our apps while you have no connection, we continually save the title, text, and its related details (chapters, category, tags, main characters) to your device, so nothing you write is lost. Unlike the copies above, a draft you write offline does not leave your device on its own: as long as you are offline, it stays purely local. As soon as your device is back online, the app automatically uploads it to our servers — from that point on it is an ordinary draft in your account, just like any draft you create online (see "Writer Data" above). The locally stored draft is kept separately per signed-in account and is deleted from your device in full as soon as you sign out or uninstall the app — even if it had not yet been uploaded at that point. The legal basis is the same as above: storage on your terminal equipment under § 25 TTDSG, strictly necessary to provide exactly the function you asked for — writing and editing with no connection (§ 25(2)(2) TTDSG).

These copies sit in the app's private storage and are not transmitted to anyone — neither to us nor to any third party; no new provider receives data about you because of it. They are kept separately per signed-in account, and as soon as you sign out they are deleted in full — which matters on a device you share with other people. They also go away when you uninstall the app.

Legally, this is storage on your terminal equipment (§ 25 TTDSG / ePrivacy). For a story you opened yourself, or downloaded for offline listening, it is strictly necessary in order to provide exactly the function you asked for: continuing to read and listen without a connection (§ 25(2)(2) TTDSG). The technical Premium confirmation is purely functional — it lets the app know, even offline, what you've already downloaded — and is equally necessary on that basis. The bundled selection is part of the app package itself and contains nothing about you. None of it is analysed — neither for advertising nor for analytics.

Security

OutaStory uses 256-bit SSL/TLS encryption for all data transmitted between your device and our servers. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction.