StoryStitch privacy policy
Last updated: November 11, 2026
StoryStitch ("we") is run by Ashish Nag. This policy covers the StoryStitch website and iOS app: what we collect, why, and what you can do about it. Questions: ashishnag94@gmail.com.
The short version
- Your photos stay on your device. StoryStitch finds subjects, arranges and crops your photos, and makes your collage on your device. Your photos and collages are never uploaded.
- You don't need an account to make and share collages. An account is only needed to save your own layouts.
- No ads, no third-party tracking, and we don't sell your data.
- We count how StoryStitch is used, anonymously. Things like how many collages were shared today, never who shared them.
What we collect
| What | When | Why |
|---|---|---|
| Email address and a hashed password | You create an account | To sign you in, confirm your email and reset your password |
| Saved layouts: the name you give each one and the shape of its cells, with no photos | You save a layout | To show your layouts in your account |
| Sign-in session details: a session token, IP address and device or browser type | You're signed in | To keep you signed in and protect your account |
| Attempt counts for sign-in, sign-up and password reset | You use those forms | To limit abuse |
| Technical logs, which can include IP address and time | You use the app or website | To run the service and keep it secure. Kept for a limited time by our hosting providers |
| A running count of how often each built-in layout is shared | You share a collage | To put popular layouts first. This count holds the layout only. The daily usage counts below also include which layouts are chosen and shared, with no link to who did it |
| Anonymous usage counts: daily totals of app opens, screens viewed, some buttons pressed, how many photos were picked (the number only), built-in layouts chosen, collages exported and shared (with the layout, the image format and whether they were shared or downloaded), layouts saved, sign-ups and error types, split by platform and app version | You use the app or website | To see which features get used and what goes wrong. These counts aren't linked to you, your account or your device |
To estimate how many people use StoryStitch each day, our server briefly combines your IP address and device or browser type with a random value that changes every day, and remembers the result until the end of that day so you aren't counted twice. To limit abuse, it also keeps a similar value made from your IP address for about a minute. These results are never saved to our database, and the IP address isn't kept with usage counts. When the day ends the random value is thrown away, so nothing can be traced back to you or matched across days.
When you're signed in on the website, we use one cookie to keep you signed in. On iOS, your session is kept in your device's secure keychain.
What we don't collect
We don't collect your photos, your collages, what's in your photos, your contacts or your location. Subject detection runs on your device, and its results never leave it.
Usage counts never include your photos, file names, the names you give layouts, your email address or your account.
On iOS, you choose photos in Apple's picker, and StoryStitch only receives the ones you select. If you save a collage to Photos, iOS may ask permission to add it to your library.
Who processes data for us
We use these providers only to run StoryStitch:
- Cloudflare hosts the website and runs the bot check on sign-up, sign-in and password reset. The bot check receives technical information about your device and connection. See Cloudflare's privacy policy.
- Railway runs our server and database, which hold your account, saved layouts and usage counts.
- Resend sends confirmation and password-reset emails, so it receives your email address.
- RevenueCat records StoryStitch Plus purchases. When you buy Plus, it receives a purchase record and your account's ID.
- Paddle sells Plus on the web, and Apple sells it in the iOS app. When you buy Plus, they receive your payment and billing details. StoryStitch never sees these.
These providers may process data in the United States and other countries.
How long we keep data
We keep your account and saved layouts until you delete them. Sign-in sessions expire on their own. Attempt counts are short-lived. Layout counts and usage counts are kept because they aren't linked to anyone.
Your choices and rights
- Delete a saved layout at any time from the Layouts tool.
- Delete your account in the app or on the website, under Account, then Delete account. This permanently removes your email address, password, sessions and saved layouts. Any copies in backups are removed as those backups expire.
- Get a copy of your data, correct it or ask a question by emailing ashishnag94@gmail.com.
Usage counts aren't linked to anyone, so we can't find, copy or delete one person's share of them. Deleting your account doesn't change them.
Depending on where you live, such as California, the EU or the UK, you may have further rights, including complaining to a regulator. We honor these requests for everyone.
Children
StoryStitch isn't for children under 13, and we don't knowingly collect their data. If you think a child has created an account, contact us and we'll delete it.
Security
Passwords are stored hashed, never as plain text, and connections use HTTPS. No system is perfectly secure. If a breach affects you, we'll tell you.
Changes
If this policy changes in a way that matters, we'll update the date above.