Privacy Policy

1. Who We Are

LegendCraft ("we", "us", "our") is an online service that creates personalized illustrated storybooks. Our website is legendcraft.io. If you have any questions about this policy, you can contact us at hello@legendcraft.io.

2. What Data We Collect

We collect only what is necessary to create your story:

• Account information — your email address, and if you sign in with Google, your name and Google profile.
• Story inputs — the child's name, physical description, personality traits, and story preferences you provide in the creation wizard.
• Usage data — standard server logs and analytics to improve the service (pages visited, errors encountered).
• Uploaded photos — if you upload a photo to create a character, it is used once — only to draw the illustrated character — and deleted automatically once your character is created, in every case within 48 hours. See Section 10.
• Saved-character email — if you choose to save your character before creating an account, we store the email address you enter so we can send you your sign-in link and, if you don't finish, one reminder. It is deleted automatically after 60 days — or as soon as you create your account.

We do not collect payment information directly — payments are handled by third-party processors.

3. How We Use Your Data

• To generate and deliver your personalized storybook.
• To send transactional emails (magic link sign-in, order confirmations).
• To maintain and improve our service.
• To comply with legal obligations.
• To send you your saved character and, at most, occasional reminders about a story you started — every such email includes a way to opt out.

We do not sell your data. With your consent, we use advertising tools to measure and improve our own ads (see Section 4) — never to sell or share your data with data brokers.

4. Third-Party Services

We use the following trusted third-party providers to operate our service:

• Supabase — database and authentication infrastructure.
• Google — optional sign-in via Google OAuth. Governed by Google's Privacy Policy.
• Resend — transactional email delivery.
• Lulu — physical book printing and fulfillment (shipping address shared when you order a print).
• PostHog — product analytics (EU-hosted). Only runs after you accept analytics cookies — see section 9 for details.
• Stripe — payment processing (PCI-DSS compliant). Card and billing details are submitted directly to Stripe and never stored on LegendCraft servers.
• Vercel — website hosting and content delivery.
• Meta & Pinterest — advertising measurement pixels that load only if you accept marketing cookies. When you purchase, we share the purchase event with Meta in hashed form to measure our ads.
• AI generation partners — Google (Gemini) renders the illustrations — your uploaded photo is sent solely for that single generation, under API terms that prohibit its use for model training; Anthropic (Claude) helps write and safety-check story text. Neither receives your account details.
• Support chat — conversations with our support assistant are processed by Google (Gemini API) to generate answers, and logged to PostHog (EU) for quality monitoring.

5. Data Retention

We keep personal data only for as long as it serves you:

• Account & story data — kept while your account is active; deleted on request.
• Uploaded photos — deleted automatically once your character is created — in every case within 48 hours.
• Saved-character emails (no account yet) — deleted after 60 days, or immediately once you create your account.
• Order & payment records — kept for as long as tax and accounting law requires, then deleted.
• Support chat escalations — if you ask us to follow up, the email address you provide in the contact form and the conversation transcript are stored with Supabase (EU) and retained for 90 days.

If you'd like your data deleted, email us at hello@legendcraft.io and we will remove it within 30 days.

6. Children's Privacy

LegendCraft is a service for parents and gift-givers to create stories about children — it is not directed at children themselves. We do not knowingly collect personal data from anyone under 13. Story input data about a child (name, appearance) is provided by an adult and used solely to personalize the book.

7. Your Rights

Depending on your location, you may have rights to access, correct, or delete the personal data we hold about you. To exercise any of these rights, contact us at hello@legendcraft.io.

8. Changes to This Policy

We may update this policy from time to time. We'll note the date of the last update at the top of this page. Continued use of LegendCraft after changes constitutes acceptance of the revised policy.

9. PostHog Product Analytics

For visitors in the EU, EEA and United Kingdom, we use PostHog to understand how our service is used and to improve it. PostHog only runs after you accept the cookie banner.

• Purpose — product analytics — we measure page views, click events and funnel-step completions to find friction points and improve the product.
• Data captured — page views, click events, custom funnel events, your user ID once signed in, your email address once signed in, and an IP-derived approximate geolocation. We do not capture form input.
• Retention — PostHog retains event data for 1 year by default; after that it is anonymised or deleted.
• Legal basis — your consent (Art. 6.1.a GDPR), captured via the cookie banner the first time you visit.
• Right to withdraw — you can withdraw consent at any time by reopening the cookie banner here: Cookie preferences.

10. Uploaded Photos

Photos are the most personal thing you trust us with, so our rule is simple: we don't keep them. Your uploaded photo goes to a private, temporary storage area, is used once to draw the illustrated character, and is deleted automatically once your character is created — an automatic clean-up guarantees deletion within 48 hours in every case. What remains is the finished illustration: a drawing, not the photo. Your photos are never made public, never shared beyond the single AI request that draws the character, and never used to train AI models.