Privacy Policy

Last updated: 13 May 2026

This Privacy Policy explains how Storya, operated by NEURALTREE PRIVATE LIMITED ("we," "us," "our"), collects, uses, and protects information when you use the Storya platform at storya.app.

We comply with India's Digital Personal Data Protection Act (DPDPA) 2023, the Nigeria Data Protection Regulation (NDPR), and the Nigeria Data Protection Act (NDPA) 2023 with respect to Nigerian residents' data.

1. Who Controls Your Data

Data Controller / Data Fiduciary:
NEURALTREE PRIVATE LIMITED
#278, 14th Main, 17th Cross,
Sri Chamundishwari Railway Layout,
Shyadanahally, Mysore – 570016,
Karnataka, India

Email: team@storya.app
Website: storya.app

2. Information We Collect

Account information. When you register, we collect your name (or display name), email address, and/or phone number.

Payment information. Token purchases are processed through the MTN Nigeria marketplace. We do not collect or store your bank details, card numbers, or airtime PINs. MTN handles all payment data under their own privacy policy.

Usage data. We automatically collect:

Stories you read and chapters you have unlocked
Token balance and transaction history within the platform
Device type and operating system
IP address and approximate location (country/state level)
Session duration and navigation patterns within the platform

Author content. If you publish as an author, we store the stories, chapter text, and metadata (title, tags, genre) you upload.

Author payment details. To send quarterly revenue share payments, we collect your preferred payment method (e.g., bank account or mobile money number).

Communications. If you contact us by email or through the platform, we retain that correspondence.

3. How We Use Your Information

We use your information to:

Provide and maintain the platform and its features
Process token transactions and track chapter access
Calculate and pay author revenue shares
Send service updates, security alerts, and support responses
Detect, investigate, and prevent fraud and abuse
Comply with legal obligations under Nigerian law
Analyse aggregated usage patterns to improve the platform

We do not use your data to train third-party AI models. We do not sell your personal data to any third party.

4. Legal Basis for Processing (DPDPA 2023 / NDPA 2023 / NDPR)

PurposeLegal basisAccount creation and managementPerformance of a contractToken transactionsPerformance of a contractAuthor revenue paymentsPerformance of a contractFraud detection and preventionLegitimate interestsCompliance with Nigerian lawLegal obligationPlatform analytics (aggregated, non-identifiable)Legitimate interestsMarketing emails (if you opted in)Consent

5. How We Share Your Information

We share your data only in the following circumstances:

Service providers. We engage third-party vendors for hosting, analytics, and email delivery. These vendors process data solely on our behalf under data processing agreements that prohibit them from using your data for their own purposes.

Payment processor. Token transaction data is shared with MTN Nigeria to process purchases. MTN's privacy policy governs their use of that data.

Legal requirements. We may disclose your information to law enforcement or regulatory authorities when required by Nigerian law — including mandatory reporting obligations related to illegal content.

Business transfers. If Storya is acquired or merged with another entity, your data may transfer to the successor operator. We will notify you before any such transfer and provide the option to delete your account if you prefer not to continue.

We do not share your reading history or personal data with other platform users.

6. Data Retention

Data typeRetention periodAccount dataActive account + 12 months after deletionUsage logs90 daysAuthor payment records7 years (Nigerian financial regulation)Support correspondence3 years

If Nigerian law requires a longer retention period for any category, that requirement takes precedence.

7. Your Rights Under the NDPA 2023

You have the right to:

Access a copy of the personal data we hold about you
Correct inaccurate or incomplete data
Delete your data (subject to our legal retention obligations)
Object to processing based on legitimate interests
Withdraw consent for marketing communications at any time
Data portability — receive your data in a structured, machine-readable format
Lodge a complaint with the Data Protection Board of India (dpboard.gov.in) or, if you are a Nigerian resident, with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng

To exercise any of these rights, email us at team@storya.app. We will respond within 30 days.

8. Cookies and Local Storage

The Storya platform is built for low-bandwidth mobile use and avoids heavy tracking technologies. We use:

Session cookies — required for login and to track your token balance within a session. These are deleted when you close your browser.
Preference storage — saves display settings (e.g., font size, theme) in local storage on your device. No data from preference storage is sent to our servers.

We do not use third-party advertising cookies or tracking pixels.

9. Children's Privacy

The platform is not directed at children under 13. We do not knowingly collect personal data from anyone under 13 years of age. If you believe we have inadvertently collected data from a child under 13, contact us at team@storya.app and we will delete the data promptly.

10. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

Encrypted data transmission (HTTPS/TLS) for all platform traffic
Access controls limiting backend data access to authorised personnel
Regular security reviews of platform infrastructure

No system is entirely secure. In the event of a personal data breach that affects your rights and freedoms, we will notify affected users and the relevant regulator (Data Protection Board of India or NDPC for Nigerian residents) within the timeframe required by applicable law.

11. International Data Transfers

Our servers may be located outside India or Nigeria. When we transfer your data across borders, we apply safeguards consistent with India's DPDPA 2023, the NDPA 2023, and the NDPR, including standard contractual clauses with relevant service providers.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via a notice on the platform or by email to the address associated with your account. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the platform after the effective date of any revision constitutes acceptance of the updated policy.

13. Contact

For privacy questions, data access requests, or to exercise your rights:

NEURALTREE PRIVATE LIMITED
#278, 14th Main, 17th Cross,
Sri Chamundishwari Railway Layout,
Shyadanahally, Mysore – 570016,
Karnataka, India