Privacy Policy

01 · Who we are

SoundToStory provides in-browser media conversion. This policy explains how we handle personal information connected with accounts and the service. For privacy questions, contact privacy@yoofungame.com.

02 · Information we process

• Account data: email address, authentication user ID, verification status, display name, language, registration and recent sign-in times.
• Plan and usage data: plan status, Pro Pass expiration, the daily number of files whose conversion is started, and media category, batch count, and largest file size used for an immediate plan check. We do not store filenames or file contents in the usage table.
• Billing data: PayPal payer, subscription, plan, order, captured-transaction, and billing-status identifiers. PayPal processes full payment-instrument details; we do not store them.
• Security and technical data: peppered hashes of IP/email identifiers, request times, browser and service logs, and anti-abuse verification results.

03 · Media stays on your device

Audio, video, and images you select are processed by WebAssembly in your browser. They are not uploaded to SoundToStory, Supabase, or a conversion server. Downloads and converted output remain on your device.

04 · Purposes and legal bases

We process information to create and maintain accounts, deliver features and plans, provide support, complete payments, secure the service, prevent abuse, and meet legal obligations. Where applicable, our legal bases include performing our contract with you, legitimate interests, consent, and legal obligations.

05 · Providers and international processing

We use Cloudflare for hosting, security, and logs; Supabase for authentication and databases; Resend for authentication email; and PayPal for payments when paid features are enabled. These providers may process information outside your country using applicable transfer safeguards under their terms. We do not sell personal information or use it for targeted advertising.

06 · Retention and security

Account data is generally kept until account deletion. Daily conversion counts are normally kept for about 31 days and removed during usage maintenance; they are also deleted with the account. Authentication rate-limit records use irreversible hashes and records older than about 24 hours are removed during maintenance. Security, payment, and transaction records may be kept longer under provider settings or for fraud prevention, tax, disputes, or legal requirements. We use access controls, encrypted transport, origin checks, and rate limits, but no system can guarantee absolute security.

07 · Your rights and account deletion

You can review data and permanently delete your account from the account page. You may also email us to request access, correction, deletion, restriction, objection, or a portable copy where applicable. Account deletion immediately cancels a linked subscription but does not automatically issue a refund or erase transaction or security records we must legally retain. You may also complain to your local data-protection authority.

08 · Children and changes

The service is not directed to children under 16, and we do not knowingly collect their personal information. If this policy changes materially, we will post the update here and revise the effective date.