Privacy Policy

Last updated 5 October 2026

StoryPrompt ("we", "us") sends weekly memoir prompts and compiles your answers into a downloadable book. This policy explains what personal data we collect, why, and what rights you have over it, under UK GDPR and the Data Protection Act 2018. See our Terms & Conditions for how the Service itself works, including our right to discontinue it.

Who we are

StoryPrompt is run by Galaxy Technology, a Scottish partnership of Lesley McCoy and Michael McCoy, of 31 Priorwood Road, Newton Mearns, Glasgow G77 6ZZ, Scotland. A Scottish partnership is a legal person in its own right, so the firm, Galaxy Technology, is the data controller for StoryPrompt and the party you contract with. It is registered with the Information Commissioner’s Office as a data controller under reference ZC212441. You can check that registration on the ICO’s public register.

For anything about this policy, your data, or to exercise any of the rights below, contact privacy@storyprompt.co.uk. We aim to respond within a few days, and are required to respond within one month.

What we collect

• Account data — your email address. We use passwordless magic-link sign-in, so we don’t store a password.
• Your prompt responses — whatever you write in answer to each weekly prompt. This is likely to include personal, and sometimes family, memories — treat what you write as being for the person compiling the book, not for public sharing, unless you choose to share it yourself.
• Billing data — handled by Stripe. We store your Stripe customer ID and a record of your purchase; your card details never reach our servers.

Why we process it, and on what basis

• To provide the Service (necessary to perform our contract with you) — sending prompts, storing your answers, compiling your book.
• To process payment (necessary to perform our contract with you) — via Stripe.
• To meet legal obligations — retaining billing records for tax purposes.

Who we share data with

We don’t sell your data. We share it only with the processors that make the product work:

• Stripe (payment processing) — see Stripe’s privacy policy.
• Resend (transactional email — sign-in links, weekly prompts, account notices).
• Microsoft Azure (hosting — our servers and database run in Azure’s UK South region).
• Cloudflare (network — every request to the site passes through Cloudflare, which handles DNS, TLS and protection against abuse and so sees your IP address; it also delivers email sent to our hello@ and privacy@ addresses, and provides cookieless, aggregate page-view analytics that identify no individual).

How long we keep it

Access is sold as a 365-day pass, not an ongoing subscription (see Terms & Conditions). If the Service is ever discontinued, we’ll email you in advance with a date to download your book before your account and its contents are permanently deleted. Billing and transaction records are kept separately, in anonymized form, for the period required by UK tax law (approximately 6 years), for legal, accounting, and dispute-resolution purposes. You can request deletion sooner at any time — see "Your rights" below.

We keep encrypted database backups so we can recover from technical failures. Backups are automatically and permanently deleted after a maximum of 14 days — deleted or anonymized personal data does not persist in backups indefinitely.

Cookies

We use a single essential session cookie to keep you signed in. It’s always set and isn’t optional, since the Service can’t work without it. We don’t currently use any analytics or advertising cookies.

International transfers

Our hosting and database are in the UK. Some of our processors (Stripe, Resend) may process data outside the UK; where they do, this happens under their own standard contractual safeguards.

Your rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted ("the right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format; and
• complain to the Information Commissioner’s Office if you think we’ve got something wrong.

To exercise any of these, contact us using the details below.

Children

StoryPrompt isn’t intended for use by anyone under 18.

Changes to this policy

If we make material changes, we’ll update the date at the top of this page and, where appropriate, notify you directly.

Contact us

Questions about this policy or your data: privacy@storyprompt.co.uk

See also our Terms & Conditions.