Privacy Policy

Storey is a habit-tracking application that helps users visualize habits as buildings in a digital city. This Privacy Policy explains how Better World LLC collects, uses, discloses, retains, and protects information when you use the Storey iOS application, the Storey website at trystorey.com, and related services — collectively referred to as the "Service."

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, do not use the Service.

1. Who We Are

The Service is operated by:

For purposes of applicable data-protection law, Better World LLC is the controller of personal information processed through the Service, except where a third party independently determines how it processes information.

2. Scope of This Privacy Policy

This Privacy Policy applies to information processed through:

• The Storey iOS application;
• Storey account creation and authentication;
• Storey habit-tracking, calendar, reminder, analytics, and weather features;
• The Storey website; and
• Communications with Better World LLC concerning Storey.

This Privacy Policy does not govern third-party services that operate under their own privacy policies, including Apple, Supabase, PostHog, Microsoft Clarity, ipapi.co, Open-Meteo, GitHub, and their infrastructure providers.

3. Information We Collect

We collect information you provide, information generated through your use of the Service, and limited information received from service providers.

3.1 Account and Authentication Information

At launch, Storey uses Sign in with Apple as its authentication method. When you sign in, we may receive:

• A unique Apple-associated user identifier;
• Your email address, including an Apple private relay email address if you choose to hide your email;
• Your display name, if you choose to provide it and Apple makes it available; and
• Account authentication information such as your last sign-in time.

Apple may not provide your display name after your initial authorization. Storey may add email-based one-time-code authentication in a future version. If added, we would process the email address and authentication records needed to provide that method.

3.2 Habit and User Content

We collect and store content you create or record in Storey, including:

• Habit names;
• Habit emojis;
• Habit colors;
• Daily or weekly habit goals;
• Habit completion records;
• Calendar entries;
• Streak, progress, and building-state information derived from your activity; and
• Other information you voluntarily enter into habit-related fields.

You own the content you submit to Storey. Habit names and other user-entered content may reveal personal or sensitive details depending on what you choose to enter. Do not enter highly sensitive information that is not necessary to use the Service.

3.3 Behavioral Analytics

We use a behavioral-analytics service to understand how people interact with Storey, identify usability problems, diagnose product issues, and improve the Service.

3.3.1 Released app version — PostHog

The version of Storey currently released uses the PostHog mobile SDK on a first-party project we control, hosted on PostHog's United States cloud. PostHog receives:

• Your Storey user identifier and your account email address, sent as person properties so that activity is attributed to your account;
• App lifecycle events (install, open, background) and screen views, captured automatically;
• Product events describing actions you take in the app; some of these events include habit names;
• Session-level properties such as app version, platform, membership state, and number of habits;
• Session replays — visual reconstructions of the interface as you move through the app; and
• Device, application, and technical metadata associated with each event.

In session replay, text typed into input fields and all images are masked before upload. That masking applies to input fields rather than to every label drawn on screen, so habit names you have already saved may be legible in a replay of a screen that displays them.

Because analytics events carry your user identifier and email address, PostHog records are linked to your account. Better World LLC does not use PostHog for advertising, cross-app tracking, or building advertising profiles, and does not sell this information. See Section 10 for how these records are treated when you delete your account.

3.3.2 Forthcoming update — Microsoft Clarity

A forthcoming update replaces PostHog with the Microsoft Clarity mobile SDK and stops sending your email address, your Storey user identifier as a person property, and habit names to analytics. Once that update is released, the following describes Storey's analytics and PostHog is no longer used.

Clarity may process:

• App screens and visual layout information used to reconstruct a session;
• Screen visits and navigation paths;
• Taps, touches, gestures, and similar product interactions;
• Heatmap and interaction information;
• App name and version;
• Device type, device model, operating system, operating-system version, display type, screen size, and device specifications;
• Application performance and SDK diagnostic information;
• Session timing and related technical metadata; and
• Approximate country or region inferred from an Internet Protocol address.

Clarity session replays are visual reconstructions generated from app layout and interaction data. They are not conventional camera recordings or screenshots of the user.

In that version Storey uses Clarity's Strict masking mode, under which text and images are masked before being uploaded to Clarity. Content entered into input fields is also masked by the Clarity SDK. In that version we do not intentionally send Microsoft Clarity your Storey account email address, Apple account identifier, habit names, habit notes, calendar content, payment information, or other account content.

Although masking and sanitization are designed to prevent personal content from being collected, no technical safeguard is infallible. Interface structure, interaction patterns, device information, approximate region, and other non-content metadata may still be visible in Clarity.

Clarity data is used for product analytics, debugging, security, and user-experience improvement. Better World LLC does not use Clarity for advertising, cross-app tracking, or creating advertising profiles.

3.4 Approximate Location and Weather Information

Storey may use ipapi.co to perform a transient Internet Protocol address lookup and estimate an approximate city-level location.

Storey:

• Does not request iOS location permission for this feature;
• Does not access precise GPS location;
• Does not receive continuous location information;
• Does not store the resulting coordinates in your Storey account; and
• Does not intentionally link the resulting coordinates to your account.

The approximate coordinates are sent to Open-Meteo to obtain local weather information used for Storey's animated sky. Open-Meteo does not receive your Storey account information from us.

Because IP-based location is approximate, the weather shown may not match your exact location.

3.5 Notifications

Storey may request permission to send optional habit reminders. Notifications are scheduled and generated locally on your device.

Storey does not require notification permission to use the Service. You can change notification permissions through iOS Settings and manage available reminder settings within Storey.

Notification text may appear on your lock screen or in notification history depending on your device settings. Anyone with access to your device may be able to view that information.

3.6 Subscription and Purchase Information

At launch, Storey Pro may be displayed as coming soon and may not yet be available for purchase.

A future version may offer an auto-renewing subscription through Apple's App Store and StoreKit. If purchases are enabled:

• Apple will process payment through your Apple ID;
• Better World LLC will not receive or store your full payment-card number;
• We may receive transaction identifiers, subscription status, product information, purchase dates, expiration dates, trial status, and other information needed to provide subscription access; and
• Apple's processing of billing and payment information will be governed by Apple's policies.

3.7 Website and Network Information

The Storey website is hosted as a static website through GitHub Pages. When you access the website or when the app communicates with service providers, GitHub, hosting providers, network providers, or other infrastructure providers may automatically process technical information such as:

• Internet Protocol address;
• Request date and time;
• Browser or device type;
• Operating system;
• Referring page;
• Requested URL;
• Network and security information; and
• Server or access logs.

Better World LLC does not use the Storey website to serve advertising or intentionally track users across unrelated websites.

3.8 Communications and Support

If you contact us, we may collect:

• Your name;
• Email address;
• The contents of your message;
• Screenshots, attachments, or technical details you provide; and
• Records of our response and related support activity.

Please do not send passwords, payment-card information, government identification numbers, medical records, or other unnecessary sensitive information in support communications.

4. Information We Do Not Intentionally Collect

Storey does not intentionally collect or access:

• Precise GPS location;
• Contacts or address-book information;
• Photos or photo-library contents;
• HealthKit or Apple Health data;
• Medical records;
• Microphone recordings;
• Camera data;
• Advertising identifiers such as IDFA;
• Data for cross-app or cross-site behavioral advertising;
• Information from data brokers; or
• Payment-card details.

Storey does not currently use a third-party crash-reporting SDK. Technical errors may still be reflected in ordinary platform, server, or service-provider logs.

5. How We Use Information

We use personal information to:

1. Create, authenticate, maintain, and secure Storey accounts;
2. Provide habit-tracking, calendar, progress, city, building, reminder, and weather features;
3. Synchronize account information and user content across supported sessions or devices;
4. Process and verify subscription access if Storey Pro becomes available;
5. Understand how users interact with Storey;
6. Diagnose bugs, investigate failures, and improve usability and performance;
7. Respond to support, privacy, legal, and account requests;
8. Detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms;
9. Comply with legal obligations and lawful requests;
10. Establish, exercise, or defend legal claims; and
11. Protect the rights, safety, property, and integrity of users, Better World LLC, and others.

We do not use personal information to provide medical advice or determine health outcomes.

6. Legal Bases for Processing

Where the General Data Protection Regulation, United Kingdom data-protection law, or another law requiring a legal basis applies, we rely on one or more of the following grounds:

6.1 Performance of a Contract

We process account information, habit content, completion records, subscription status, and related information when necessary to provide the Service you request.

6.2 Legitimate Interests

We may process information for legitimate interests such as:

• Operating and improving Storey;
• Understanding product usage;
• Debugging and quality assurance;
• Securing the Service;
• Preventing fraud and abuse;
• Providing customer support; and
• Protecting legal rights.

We consider the nature of the information, the impact on users, and available safeguards when relying on legitimate interests.

6.3 Consent

We rely on consent where required, including for optional device permissions or other processing for which applicable law requires consent. You may withdraw consent through device settings, in-app controls, or by contacting us. Withdrawal does not affect processing that occurred before consent was withdrawn.

6.4 Legal Obligation

We may process information when necessary to comply with applicable law, respond to valid legal process, maintain legally required records, or meet regulatory obligations.

6.5 Protection of Vital Interests

In limited circumstances, we may process information where necessary to protect a person's life or physical safety.

7. How We Disclose Information

We do not sell personal information. We do not disclose personal information for cross-context behavioral advertising.

We may disclose information as described below.

7.1 Service Providers and Processors

We use third parties to operate the Service:

These providers process information under their own terms and privacy policies. Some act as processors on our behalf, while others may act as independent controllers for portions of their processing.

7.2 Legal Compliance and Protection

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or governmental request;
• Enforce our Terms or other agreements;
• Investigate or prevent fraud, abuse, security threats, or illegal activity;
• Protect the rights, property, safety, and security of Better World LLC, Storey users, or others; or
• Establish, exercise, or defend legal claims.

Where legally permitted, we may attempt to notify affected users before disclosing information in response to legal process.

7.3 Business Transactions

If Better World LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be disclosed or transferred as part of that transaction, subject to applicable law. Any successor may continue to process information as described in this Privacy Policy unless it provides notice of a materially different policy.

7.4 Professional Advisers

We may disclose information to attorneys, accountants, auditors, insurers, consultants, and other professional advisers where reasonably necessary and subject to appropriate confidentiality obligations.

7.5 At Your Direction

We may disclose information when you direct us to do so or provide consent.

8. No Advertising, Sale, or Cross-App Tracking

Storey:

• Does not display third-party advertisements;
• Does not sell personal information for money or other valuable consideration;
• Does not share personal information for cross-context behavioral advertising;
• Does not use IDFA or App Tracking Transparency authorization for advertising;
• Does not track users across unrelated apps or websites for advertising;
• Does not purchase personal information from data brokers; and
• Does not provide personal information to data brokers.

If our practices materially change, we will update this Privacy Policy and provide any notice, consent mechanism, or opt-out required by law before beginning the new processing.

9. Data Storage and International Transfers

Storey account information and user content are hosted through Supabase on infrastructure located in AWS us-west-2, Oregon, United States. Microsoft may process Clarity analytics through Microsoft systems and locations described in Microsoft's applicable terms and privacy documentation. Other providers may process information in the United States or other jurisdictions in which they operate.

If you use Storey from outside the United States, your information may be transferred to and processed in the United States. The laws of the United States may differ from those of your country.

Where applicable law requires a transfer mechanism, we and our providers may rely on:

• Adequacy decisions;
• Standard Contractual Clauses;
• Contractual safeguards;
• Statutory exceptions; or
• Other legally recognized transfer mechanisms.

You may contact us for additional information about safeguards applicable to your information.

10. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, complying with legal obligations, resolving disputes, enforcing agreements, and protecting the Service.

10.1 Account and Habit Data

Account information and user content are generally retained while your Storey account remains active.

Using Settings → Delete Account initiates an immediate cascading deletion of your Storey account and associated habit data from Storey's active server-side database.

10.2 Analytics and Service-Provider Records

Analytics data, session-reconstruction data, heatmaps, access logs, security logs, transaction records, provider backups, and similar records may follow separate retention schedules.

PostHog (released app version). PostHog analytics are linked to your Storey user identifier and account email address. Deleting your Storey account removes your account and habit data from Storey's active database, but it does not automatically delete analytics records already collected by PostHog. If you would like those records deleted as well, email support@trystorey.com and we will delete the associated PostHog person and their events, subject to identity verification and technical feasibility.

Microsoft Clarity (forthcoming update). Microsoft currently publishes different retention periods for different Clarity data types, including shorter retention for ordinary playback data and longer retention for certain heatmap, interaction, labeled, or favorited-session data. Microsoft may update those periods under its own policies. Clarity analytics are not intentionally linked to your Storey account email address or habit content, so we may be unable to identify or isolate a particular person's Clarity data in response to an account deletion or individual privacy request. Microsoft may require deletion of an entire Clarity project rather than deletion of a single session.

Other service-provider records may persist for a limited period after account deletion when:

• They are not directly connected to Storey's account-deletion workflow;
• Temporary retention is technically necessary for backup rotation, security, fraud prevention, or service integrity;
• A provider retains the information under its own documented practices; or
• Retention is required or permitted by law.

You may email support@trystorey.com with questions or requests concerning analytics data. We will evaluate the request subject to identity verification, whether the data can reasonably be associated with you, technical feasibility, provider capabilities, and applicable legal exceptions.

10.3 Support and Legal Records

We may retain support communications and privacy-request records for a reasonable period to respond to requests, document compliance, resolve disputes, and protect legal rights.

10.4 De-Identified Information

We may retain information that has been aggregated or de-identified so that it can no longer reasonably be linked to you. We will not attempt to re-identify information maintained in de-identified form except to test whether our de-identification processes are effective or as permitted by law.

11. Account Deletion

You may delete your Storey account through:

Storey → Settings → Delete Account

This action deletes your account and associated habit information from Storey's active backend database. Account deletion is permanent and cannot be undone.

You may also request deletion by emailing support@trystorey.com. We may need to verify that you control the relevant account before completing an email-based request.

Deleting the Storey app from your device does not, by itself, delete your Storey account.

Deleting your Storey account does not automatically cancel an Apple subscription. If paid subscriptions are enabled, subscription cancellation must be completed through the Apple App Store subscription settings.

12. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• Confirm whether we process your personal information;
• Request access to personal information we hold about you;
• Request correction of inaccurate information;
• Request deletion of personal information;
• Request a portable copy of information you provided;
• Request restriction of certain processing;
• Object to certain processing;
• Withdraw consent where processing is based on consent;
• Opt out of sale, sharing, targeted advertising, or certain profiling where applicable;
• Appeal a decision concerning a privacy request; and
• Lodge a complaint with a regulator or supervisory authority.

These rights are not absolute. We may deny or limit a request where permitted by law, including when we cannot verify identity, the request would adversely affect another person's rights, or an exception applies.

To exercise a privacy right, email support@trystorey.com with:

1. The email address associated with your Storey account;
2. The right you wish to exercise;
3. Enough detail for us to understand the request; and
4. The country and state or province where you reside.

Do not send passwords or government identification unless we specifically request an appropriate verification method.

We may verify a request by asking you to respond from the account email address, authenticate through the Service, or provide information reasonably necessary to confirm account ownership. We will use verification information only to process the request.

We will respond within the period required by applicable law. Where permitted, we may extend the response period and will explain the reason for the extension.

You will not receive discriminatory treatment for exercising a privacy right.

12.1 Authorized Agents

Where permitted by law, you may authorize another person to submit a request for you. We may require evidence of authorization and may separately verify your identity or confirm that you authorized the request.

12.2 Appeals

If we deny a request and applicable law provides an appeal right, you may appeal by replying to our decision or emailing support@trystorey.com with the subject line "Privacy Request Appeal."

13. California Privacy Notice

This section supplements the rest of this Privacy Policy for California residents.

13.1 Categories of Personal Information

During the preceding 12 months, we may have collected the following categories of personal information:

We do not intentionally collect precise geolocation, biometric information, government identification numbers, health records, or payment-card numbers.

13.2 Disclosure for Business Purposes

We may disclose the categories above to service providers and other recipients described in Section 7 for business purposes such as hosting, authentication, analytics, weather retrieval, payments, security, legal compliance, and customer support.

13.3 Sale and Sharing

Better World LLC has not sold personal information and has not shared personal information for cross-context behavioral advertising during the preceding 12 months.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

Because Storey does not sell personal information or share it for cross-context behavioral advertising, we do not currently provide a "Do Not Sell or Share My Personal Information" link. You may still contact us with questions or requests concerning these practices.

13.4 California Rights

Subject to applicable thresholds, exceptions, and verification requirements, California residents may have the right to:

• Know the categories and specific pieces of personal information collected;
• Know the categories of sources, business purposes, and recipients;
• Request deletion;
• Request correction;
• Obtain a portable copy;
• Opt out of sale or sharing;
• Limit certain uses or disclosures of sensitive personal information; and
• Receive non-discriminatory treatment.

Storey does not use or disclose sensitive personal information for purposes that require a right-to-limit mechanism under California law.

14. European Economic Area, United Kingdom, and Switzerland

If you are located in the European Economic Area, United Kingdom, or Switzerland:

• Better World LLC is the controller of personal information described in this Privacy Policy;
• Information is transferred to and processed in the United States;
• The legal bases described in Section 6 apply;
• You may exercise applicable access, rectification, erasure, restriction, objection, portability, and consent-withdrawal rights; and
• You may lodge a complaint with the data-protection authority in your country.

We encourage you to contact us first so we can attempt to resolve your concern.

Storey does not use personal information for solely automated decisions that produce legal or similarly significant effects.

Where appointment of a European Union or United Kingdom representative is required by applicable law, current representative information may be obtained by contacting support@trystorey.com.

15. Other United States State Privacy Rights

Residents of certain United States states may have rights concerning access, correction, deletion, portability, targeted advertising, sale, profiling, sensitive data, and appeals.

Storey does not sell personal information, use personal information for targeted advertising, or conduct profiling in furtherance of decisions that produce legal or similarly significant effects.

You may exercise applicable rights using the procedures in Section 12.

16. Children's Privacy

Storey is a general-audience application and may be rated 4+ in the App Store, but it is not directed to children under 13.

We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal information without legally valid parental consent, we will take reasonable steps to delete it.

A parent or guardian who believes a child has provided personal information may contact support@trystorey.com.

Age thresholds may be higher in some jurisdictions. Where local law requires parental authorization for a minor's use of the Service, the user and parent or guardian are responsible for complying with that requirement.

17. Security

We use administrative, technical, and organizational measures designed to protect personal information, including:

• Supabase row-level security intended to restrict records to the owning account;
• Authentication controls;
• Access limitations;
• Encrypted network communications where supported;
• Service-provider security controls; and
• Account-deletion functionality.

No method of transmission, storage, or security is completely secure. We cannot guarantee that unauthorized access, loss, misuse, alteration, or disclosure will never occur.

You are responsible for maintaining the security of your Apple ID, email account, device, passcode, and any authentication credentials used with Storey. Notify us promptly if you believe your Storey account or associated credentials have been compromised.

18. Data Breach Notification

If we become aware of a security incident involving personal information, we will investigate and take steps we consider appropriate. Where required by law, we will notify affected individuals and relevant authorities within applicable timeframes.

19. Third-Party Services and Links

The Service may link to or rely on third-party services. Those services are governed by their own terms and privacy policies.

We are not responsible for the privacy, security, availability, content, or practices of third parties. Review their policies before providing information or using their services.

20. Do Not Track and Global Privacy Control

Some browsers and devices offer "Do Not Track" signals. There is not a universally accepted standard for responding to all Do Not Track signals, and Storey does not use browser-based signals to alter core app processing.

Where legally required, we will recognize a valid opt-out preference signal, such as Global Privacy Control, for processing subject to that signal. Storey does not currently sell personal information or share it for cross-context behavioral advertising.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Service, our practices, technology, service providers, subscriptions, or applicable law.

When we make changes, we will update the "Last Updated" date. If a change is material, we may provide additional notice through the app, website, email, or another appropriate method.

Your continued use of the Service after an updated policy becomes effective means the updated policy will apply to future processing, except where applicable law requires consent or another legal basis.

22. Contact Us

For privacy questions, requests, or complaints, contact: