Effective Date: July 1, 2025

This Privacy Policy describes how CYOA.APP ("we," "us," or "our") collects, uses, and discloses information when you use our web application (the "Service").

1. Information We Collect

We collect and store the following types of information:

• Account Information: When you register, we collect your username and a hashed version of your password. We do not store your password in plain text.
• Story Content: The text, choices, and generated image URLs for the visual stories you create are stored in per-user files on our server.
• Share Links: If you generate a share link, a short code is created and mapped to your story. Anyone with the link can view and play your story, including your username as author.
• Login Attempts: We log failed login attempts (including IP address and timestamp) for security and brute-force protection.
• IP Address: Collected for security purposes, specifically for login protection and abuse prevention.
• Session Cookies: Used for authentication and maintaining your login session.

2. How We Use Your Information

We use the collected information for the following purposes:

• To provide and maintain the Service, including storing and retrieving your stories and user account.
• To authenticate users and manage user sessions.
• To enable sharing of your stories via short links, which make your story and author name publicly accessible to anyone with the link.
• To protect our Service from abuse, such as brute-force attacks, using IP address and anti-bot data.
• To improve and optimize the Service (e.g., by analyzing usage patterns, though no personal data is used for this without explicit consent).

3. How We Share Your Information

We do not share your personal account information (username, password hash) with third parties. Your story content and generated images are stored on our server and are accessible only to you through your authenticated account, except when you generate a share link. Anyone with the share link can view and play your story, including your username as author.

We use anti-bot techniques (such as CAPTCHA, honeypot, and IP detection) to protect the service from abuse.

4. Data Storage and Security

Your data (user accounts, story content, images, share links, login attempts) is stored on our self-hosted server in JSON and PNG files. We implement reasonable security measures to protect your data, including password hashing and brute-force protection. However, no method of transmission over the Internet or method of electronic storage is 100% secure.

5. Your Choices

• Account Information: You can update your story content through the application. Account deletion is not currently offered directly through the UI, but you can contact us to request data deletion.
• Cookies: Our application uses session cookies for authentication. You can configure your browser to refuse all cookies or to indicate when a cookie is being sent. However, some features of the Service may not function properly without cookies.

6. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes.

7. Contact Us

If you have any questions about this Privacy Policy, please contact us at: