English translation for your convenience. The legally binding version is the German one.

Privacy Policy

Last updated: 1 October 2026

1. Controller

Controller within the meaning of the GDPR: Squadhouse Media GmbH & Co. KG, Ehrenbergstraße 18, 78532 Tuttlingen, Germany, email: welcome@everglowstories.app

2. What Everglow is about — and our basic promise

Everglow is an application for private, interactive stories for adults. Your stories are private: they are shown to no one but you, not published, not shared with other users, and not used to train AI models.

3. What data we process

Account data: email address, display name, language, declaration of legal age, date of registration. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR).

Information about you (optional): When you first start the App, we ask for your year of birth, country, gender and the categories of stories you like to read. Every answer is optional: you can skip the step and change or remove your answers at any time under Profile > Your preferences. Purpose: we suggest stories that suit you, arrange your home page accordingly and set up your first story (e.g. your character’s pronouns). Your year of birth also serves the protection of minors: anyone who enters a year of birth that makes them under 18 is signed out. Legal basis for year of birth and country: legitimate interests (Art. 6 (1) (f) GDPR). Gender and interests may allow conclusions about your sex life. We therefore store them only with your explicit consent, which you give by ticking the box in the App (Art. 9 (2) (a) in conjunction with Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future by removing gender and interests in the App or by writing to us; the information is then deleted. We do not pass gender or interests on to third parties or AI services. Only your character’s pronouns become part of a story’s narrative context.

Content data: your stories, chapters, inputs, own scenarios, uploaded images, and the memory and state data derived from them by the narrative engine. Legal basis: performance of a contract. Uploaded images are stripped of metadata (e.g. GPS coordinates) before being stored.

Usage data: we record your use of the App linked to your account — e.g. screens opened, stories started, chapters generated, abandoned inputs, errors that occurred (including technical error messages from your browser) and the times of these events. Purpose: we want to understand where the App is unclear, where users get stuck and where technical problems occur, in order to improve the product and fix faults. The content of your stories is not part of this record. Legal basis: legitimate interest (Art. 6 (1) (f) GDPR) in product improvement and fault diagnosis. You may object to this processing at any time (see section 9); core functions remain unaffected.

Referral data: on your first visit we store how you found Everglow (e.g. campaign parameters in the URL, referring website, entry page). This is assigned to your account once. Purpose: we want to know which channels work. Legal basis: legitimate interest.

Payment data: for purchases, our payment service provider (section 5) processes your payment data; we ourselves neither receive nor store any card numbers, only transaction references, amounts, product and status, as well as a credit ledger. Your consent to immediate commencement of the service (withdrawal) is stored with its timestamp as evidence (Art. 6 (1) (c) GDPR).

Emails: we send you account emails (welcome, password reset, email confirmation) as well as messages from the App to your email address. We do not send promotional newsletters without separate consent.

Server logs: IP address, time, address requested, status code — for operational security, abuse prevention and fault diagnosis (legitimate interest), retained for 14 days.

4. Local storage on your device

The App stores the following in your browser’s local storage: sign-in status, drafts of your inputs, reading settings, and the referral data from your first visit (until registration). No third-party tracking cookies are set for advertising.

4a. Notifications (Web Push)

If you turn on notifications, your browser asks for permission once. We then store the push address your browser assigned to your device and two keys that encrypt every message. Messages are delivered through your browser’s push service (Google for Chrome, Apple for Safari, Mozilla for Firefox); this service sees only encrypted data and does not know who you are. The text never names a story title or content. Occasions: a finished chapter and a reminder after a few days without activity. You can turn off every occasion and every device at any time under Profile → Notifications; the stored data is then deleted. Legal basis: your consent (Art. 6 (1) (a) GDPR).

5. Processors and recipients

We use the following service providers (processing on our behalf, Art. 28 GDPR):

• Hosting: Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany (server location: EU) — operation of the application and database.
• Google Firebase Authentication (Google Ireland Ltd.): sign-in by email/password or Google account. In doing so, Google processes your email address and sign-in data. Transfers to the USA are safeguarded by the EU-US Data Privacy Framework or standard contractual clauses.
• Mittwald CM Service GmbH & Co. KG (Königsberger Straße 4–6, 32339 Espelkamp, Germany): dispatch of our emails to you via our own mailboxes.
• OpenRouter, Inc. (USA) as access to AI language models: in order to generate your chapters, your inputs and the narrative context of your story (not your name, not your email address) are transmitted to the respective language model. Logging and use for training purposes are disabled in our OpenRouter settings. Transfer on the basis of standard contractual clauses.
• Stripe Payments Europe Ltd. (Ireland): payment processing including fraud prevention and tax calculation. Stripe is itself the controller for parts of the processing; details: https://stripe.com/privacy.
• Speech output (read-aloud): Trooper AI as the provider of speech synthesis — the chapter text is transmitted without account data in order to generate the audio file; we store the file for you.
• Image generation: where offered in the App, the image description (not your name) is transmitted to the respective connected image service; we name it at the point in the App where you generate the image.

No disclosure to other third parties takes place unless we are legally obliged to do so.

Note on voice input: if you use the dictation feature, your browser performs the speech recognition; in Chrome, audio data is transmitted to Google for this purpose. This only happens when you actively start the microphone.

6. Retention periods

• Account and content: until your account is deleted. Account deletion has a 7-day reversal period, after which all personal data and content are permanently deleted or anonymised.
• Stories moved to the bin: permanently deleted after 30 days, or immediately at your request.
• Ledger and payment records: 10 years (statutory retention obligation, section 147 of the German Fiscal Code).
• Usage event data: 24 months.
• Database backups: daily, retained for 14 days (Sunday backups 8 weeks), encrypted on our server in Germany.
• Information about you (year of birth, country, gender, interests): until you change or remove it, at the latest until your account is deleted. We keep the time of your consent as proof for as long as the information is stored.

7. Security

Transmission exclusively encrypted (TLS). Your content is accessible only to you; administrator access to content data is logged and limited to support cases.

8. No automated individual decisions, no advertising

No profiling for advertising purposes takes place and we do not sell data. Automated review of the content of your inputs is carried out exclusively to enforce statutory prohibitions (e.g. depictions of child sexual abuse) and the rules of use. Suggestions based on your information are a simple sorting within the App and have no legal or similarly significant effect on you.

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR) — for usage tracking, an informal message to welcome@everglowstories.app is sufficient. You can export your stories in the App at any time and delete your account yourself. Right to lodge a complaint: with the data protection supervisory authority responsible for you; the authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany. You can withdraw any consent you have given at any time (Art. 7 (3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal.