Privacy Policy

This policy explains what personal data the My Scenario mobile app and marketing site process, why we need it, and what rights you have. The operator is sole proprietor Oleksandr Anatoliiovych Kosianchuk. It covers the mobile app, the related service at api.myscenario.app, and the marketing site myscenario.app. The marketing site has no user accounts.

Who controls the data

Data controller: Sole proprietor Oleksandr Anatoliiovych Kosianchuk, tax ID (RNOKPP) 3287610697.

Address: Ukraine, 08132, Kyiv Region, Kyiv-Sviatoshynskyi District, Vyshneve, 24 Zhovtneva St., apt. 55.

For this policy and data-rights requests, write to alexanderkosianchuk@gmail.com. There is no separate data protection officer.

What we process

We collect what is needed for your account, stories, and purchases. We do not ask for a profile photo, phone number, your home address, or advertising device identifiers.

Account data: email, username, optional first and last name, interface language.
Sign-in: a password hash, or Google / Sign in with Apple identifiers. Apple may provide a private relay email instead of your address.
Content you create: scenarios, stories, chapters, characters, places, mentor messages, personalization answers, generated illustrations, and narration audio.
Purchases and usage: token balance, in-app purchase transaction records, and AI request metadata.
Technical data: a user identifier in error reports (Sentry); IP address may be used for rate limiting and is not stored as a profile field.
On device: a session token and a cached profile in the app’s local storage; your analytics cookie choice.
With your consent: experience-analytics data via Contentsquare, including pages viewed, clicks, scrolls, session replay, and device or browser technical data. We do not use this for advertising.

Why we use data

We process data to provide the service and to meet legal duties.

Create and maintain your account and authenticate sign-in.
Store your story world and show it only to you.
Send the needed text and images to AI providers to generate chapters, illustrations, or narration at your request.
Grant tokens, verify store purchases, and keep accounts.
Fix failures and protect the service from abuse.
Understand how the marketing site and app are used, and improve them, when you accept analytics cookies.
Respond to access, correction, or deletion requests.

Legal bases

In Ukraine, processing follows the Law of Ukraine on Personal Data Protection and the contract for using the service.

If you are in the EEA or the United Kingdom, the GDPR bases are performance of a contract (account and generation), legitimate interest (security and error diagnostics), consent (Contentsquare experience analytics), and legal obligation (purchase records).

Providers

We use contractors who receive only what they need for their role.

Hetzner: hosting for the API, database, and illustration and audio files (EU).
OpenAI: text and image generation; story data may be processed in the United States.
ElevenLabs: turning chapter text into narration.
Google: Google sign-in and in-app purchase verification.
Apple: Sign in with Apple and App Store purchase verification.
Sentry: error reports (processed in the EU).
Contentsquare (Content Square SAS): experience analytics and session replay, only after you accept analytics cookies. Data may be processed in the EU and other countries where Contentsquare operates.

International transfers

Servers and files are hosted with Hetzner in the EU. Text and image generation requests go to OpenAI in the United States. By using those features, you understand that the relevant content and related service data may be processed in the US.

Other providers may process data in the EU, the US, or other countries where their services run. We do not sell personal data.

How long we keep data

Account data, stories, and related content are kept until you delete the account or ask us to delete them.

After account deletion we try to remove your profile, stories, chats, illustration files, and audio. Backups may remain for up to 100 days, then they are overwritten in the normal cycle.

Anonymized purchase records (no longer tied to your profile) may be kept longer for accounting and store reconciliation.

Your rights

You can review and edit your profile in the app and delete your account in the account-deletion section. That ends access and starts deletion as described above.

To receive a copy of your data, correct an inaccuracy, or make another request, write to alexanderkosianchuk@gmail.com. We will respond within 30 days.

A data export is available on request at the same address. The app does not currently include an export button.

You may also complain to the Ukrainian Parliament Commissioner for Human Rights or, where GDPR applies, to your local supervisory authority.

Children

My Scenario is not intended for children under 13. We do not knowingly collect data from a child that age. If we learn that an account belongs to someone under 13, we will delete it.

The bedtime-story genre does not make this a children’s product and does not mean the app is designed for a Kids audience in the stores.

Cookies and analytics

The app does not use cookies for sign-in: the session is stored locally on the device.

On the marketing site and in the app we use Contentsquare, an experience-analytics service from Content Square SAS. After you accept analytics cookies, it may set cookies and similar storage to measure page views, clicks, scrolls, and session replay. We do not use advertising SDKs, and we do not sell this data to advertisers.

On the marketing site, Contentsquare loads only after you tap Accept in the cookie banner. You can change that choice later through Cookie settings. Your Accept or Reject choice is stored on your device so we can remember it; that storage is necessary to honour your preference. The app does not show a cookie banner.

Error diagnostics go through Sentry and do not depend on the analytics banner.

Security

We use technical and organisational measures, including password hashing, API access control, and rate limiting. No service is perfectly secure. If an incident affects your data, we will notify you as required by law.

Changes to this policy

We publish an updated version on this page with a new effective date. We do not send separate emails or push notifications about policy changes. Continued use of the service after an update means you accept the new version.