Privacy Policy

SerialStorm is built to hold the minimum personal data required to run your studio, and to never touch your generation credentials.

What we store

• Account: email, bcrypt-hashed password, plan and subscription status, Stripe customer identifiers.
• Work product: series bibles, character locks, episodes, shots, prompts, asset-registry entries, schedules, metric snapshots, compliance-check results, competitor entries (Pro), and dispatch-registry endpoint metadata (Pro).
• Billing audit: grant records (which checkout session granted which plan), and processed Stripe event ids for idempotency.

What we never store

• API keys for Seedance / Kling / Veo / Sora or any generation provider. The registry stores base URLs and model ids only; every generated request carries a placeholder credential.
• Your platform (YouTube/TikTok/Instagram) passwords or OAuth tokens — we don't connect to your platform accounts at all.
• Payment card numbers — payments and card data are handled entirely by Stripe.

Third parties

• Stripe — payments, customer portal, webhooks. Stripe receives your payment details under its own privacy policy.
• Platform links — our compliance checker links to official platform pages; clicking them is a normal navigation to that platform.

Security

Sessions use signed, httpOnly cookies (SameSite=Lax). Passwords are bcrypt-hashed. Access is scoped per user at every API route. Rate limiting protects auth and mutation endpoints.

Your rights

You can export your work product (bible PDF on Pro; everything is plain data on request) and delete your series or account. Deletion cascades to episodes, shots, schedules, and logs. Contact us for any GDPR/CCPA request; we respond within 30 days.

Cookies

One session cookie (serialstorm_session) — strictly necessary, no tracking, no advertising cookies, no third-party analytics by default.