Privacy Policy (GDPR / AVG)
Last updated: October 13, 2026 • Applies to StoryPulse and all 6 browser extensions
This Privacy Policy governs the processing of personal data by StoryPulse (based in the Netherlands, hereinafter: “StoryPulse”, “we”, or “us”), through the web application accessible at https://storypulse.app and our suite of browser extensions: AuditLens, GhostDraft, IntentGate, PromptSanitizer, SubSentry, and GroupSentry (collectively: “the Extensions”).
StoryPulse respects your privacy and ensures that all personal data processing strictly adheres to the General Data Protection Regulation (GDPR / Regulation EU 2016/679) and applicable European privacy legislation.
1Browser Extensions: 100% Local Processing & Zero External Data
For all 6 browser extensions in our suite, we strictly adhere to the principles of "Privacy by Design" and "Privacy by Default":
- No External Servers or Telemetry: The extensions do not collect, transmit, upload, or sell any personal data, browsing history, clipboard contents, keystrokes, or screenshots to remote servers or third parties.
- Local Browser Sandbox: All stored preferences (such as temporary form drafts or daily audit counters) are stored exclusively in your local browser sandbox via chrome.storage.local.
- Zero Third-Party Trackers: No analytical trackers, advertising cookies, or third-party tracking scripts are embedded within the extensions.
2Extension-Specific Disclosures & Permissions
Captures diagnostic screenshots and environment specs (viewport, OS, browser, DOM) only upon explicit user action. Generated entirely in local memory; nothing is uploaded.
Protects typed work by caching form text locally. Strictly excludes passwords, credit cards, telephone numbers, and email inputs. All drafts auto-expire and are purged after 24 hours.
Operates solely on targeted domains (YouTube, LinkedIn, Reddit, X). Declared focus intentions remain purely in volatile page memory and are never persisted or transmitted.
Redacts API keys and sensitive secrets before pasting into AI chatbots using reversible placeholders. Text processing occurs entirely in client-side memory without network requests.
Scans checkout pages locally for subscription keywords. Only stores trial bookmarks and cancellation URLs explicitly saved by the user in local storage.
Tracks pending group post approval status locally using your active browser session. Sends native alerts upon approval without storing external Facebook account credentials.
3Google Chrome Web Store Limited Use Compliance
Our use of information received from Google Chrome APIs adheres strictly to the Chrome Web Store User Data Policy, including the Limited Use requirements:
- Data is used solely to provide and improve prominent user-facing features.
- Data is not transferred to third parties except as strictly necessary for security or legal compliance.
- Data is never used or transferred for advertising, creditworthiness, or lending purposes.
4StoryPulse Web Platform: Data We Process & Purpose
When you use the StoryPulse web application (as an author or as a beta reader), we process the following categories of data:
5Legal Bases for Processing (Article 6 GDPR)
In accordance with Article 6 of the GDPR, we only process personal data on the following lawful bases:
- Performance of a Contract (Art. 6(1)(b) GDPR): Necessary for creating your account, delivering manuscript access, hosting feedback questionnaires, and facilitating reader-author interactions.
- Legitimate Interests (Art. 6(1)(f) GDPR): For safeguarding platform security, preventing abuse or fraud, and maintaining optimal technical performance.
- Compliance with Legal Obligations (Art. 6(1)(c) GDPR): When required to retain specific transaction or invoice records under applicable tax laws.
6Sub-Processors & Data Transfers
To securely host and operate StoryPulse, we engage established, compliant sub-processors:
Database hosting, encrypted storage, and user authentication. Encrypted in transit (TLS) and at rest (AES-256).
Serverless application hosting and cookieless, privacy-friendly Vercel Web Analytics.
Data Processing Agreements (DPAs) are in place with all sub-processors. Any data transfers to the US rely on the EU-U.S. Data Privacy Framework or approved EU Standard Contractual Clauses.
7Data Retention Periods
- Extension Data: Remains purely on your local machine. You can clear it anytime via browser settings. GhostDraft purges drafts after 24 hours.
- StoryPulse User Accounts: Retained as long as your account remains active. When you delete a manuscript or your account, personal data is permanently wiped from active databases immediately.
8Cookies and Local Storage Policy
StoryPulse does not utilize invasive tracking cookies or cross-site advertising trackers. We strictly use:
- Essential Functional Cookies (Supabase Auth): Strictly necessary to maintain secure user sessions and authentication.
- Cookieless Web Analytics: Vercel Analytics aggregates high-level visitor metrics without cookies or personal IP tracking.
Your Rights Under GDPR (Articles 15 to 22)
As a data subject, you hold the following statutory rights under the GDPR regarding your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure / to be forgotten (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
To exercise any of these rights, contact us at support@storypulse.app. We respond free of charge within the statutory deadline of one month (30 days).
Questions or Data Requests?
Contact our team directly regarding data access, corrections, or security questions.