Privacy Policy

Last updated: July 27, 2026

This policy explains what RJStory collects, why, and who processes it. We keep data to what the Service needs and do not sell it.

What we collect

• Account and sign-in: your email address and an authentication session, managed by our authentication provider. Sign-in uses a one-time email link or your Google or Apple account.
• Credits and billing: your credit balance and a ledger of grants, reservations, and charges. Credit purchases are processed by our payment processor (the merchant of record), which handles your card details; we receive a confirmation and the amount, not your full card data.
• Wallet and staking, when enabled: if you choose to connect a wallet, we process your Privy account identifier (DID), public wallet address, chain ID, and link or unlink timestamps. To determine staking reward eligibility, we read public on-chain token balances and staking-position data and keep a record of reward claims and grants. RJStory does not receive your wallet private key or seed phrase.
• Jobs: the render jobs you submit - their settings, status, cost, and outcome.
• Your submitted content: the text, uploaded PDF text, linked-page content, X-post text, topics, ad briefs, and any optional reference image (uploaded directly or selected from your PDF - stored only as a normalized, metadata-stripped copy and deleted with the job) you provide as source material.
• Generated artifacts: the keyframes, audio, subtitles, and MP4 produced for your job, kept as bounded job artifacts while the video is produced and made available to you.

How we use it

To authenticate you, meter and charge credits, run your renders, deliver and let you re-watch your videos, prevent abuse, and operate and improve the Service.

Processors and third parties

We use a small set of third-party service providers to run RJStory:

• Authentication provider - sign-in and session verification.
• Privy - optional wallet connection and proof that the connected public wallet belongs to your signed-in identity.
• Payment processor - payment processing (merchant of record).
• AI and video generation providers - your source content and derived prompts are sent to the providers that generate the story, images, video, and narration in order to produce your reel.
• Hosting and infrastructure providers - run the service and store bounded job artifacts.

We do not sell your personal data or your submitted content, and we do not use your private content to advertise to you.

Analytics

We use Vercel Web Analytics to understand aggregate site usage. It collects anonymous, aggregated data - page views, referrers, device and browser type, and approximate location derived from the request - without third-party cookies and without tracking you across sites. Besides page views it receives clicks on our create and $RJS calls-to-action and the growth-funnel steps (preview submitted / delivered / refused, full-reel click, sign-in started, checkout started / returned, render started). Each event still carries only a landing-page category and a traffic-source category (for example instagram, x or direct). Those two fields never contain an email, wallet, content, job or order identifier, and the addresses of our own pages are stripped of query strings and fragments before they leave your browser. The analytics service also receives the address of the page that referred you, as your browser supplies it (usually only the referring site's name; some sites send a full page address). Vercel, our hosting provider, acts as the analytics processor for this data.

During the growth preview flow, the exact draft may remain in this browser for up to ten minutes solely to continue the sign-in or checkout flow across tabs. It is removed when read where browser storage permits, and it is never included in analytics.

Retention and deletion

Job artifacts are bounded and retained to deliver and let you access your video. An unlinked wallet-link record is retained for up to 180 days for relink-abuse prevention, then deleted. Staking reward and related credit-ledger audit records are not deleted when you unlink a wallet; they are retained as durable financial and anti-abuse records. Other ledger and account records are kept as needed to operate billing and meet legal obligations. To request access to or deletion of your data, contact info@rjstory.io. Deleting your account removes your login; some billing records may be retained where the law requires.

Security

Sessions are verified server-side, media links are job-scoped and time-limited, and we do not expose access credentials or session tokens in page URLs. No system is perfectly secure; use a current browser and keep your sign-in link private.

Contact

Privacy questions or data requests: info@rjstory.io.