Privacy Policy - StoryJam

← Back

StoryJam

Privacy Policy

Last updated: 15 July 2026 — Version 3

This Privacy Policy explains how StoryJam, operated by Daniel Ibink and Remco Snijders ("we", "us", or "our"), collects, uses, stores, and protects your personal data when you use the StoryJam mobile application ("App").

We are committed to protecting your privacy and ensuring that your personal data is handled responsibly and in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Dutch Implementation Act (UAVG), and other applicable data protection laws.

By using StoryJam, you agree to the collection and use of information as described in this Privacy Policy. This Policy should be read together with our End-User License Agreement.

1. Data Controller

The data controller responsible for your personal data is:

StoryJam, operated by Daniel Ibink and Remco Snijders

Established in the Netherlands

Email: appstoryjam@gmail.com

Website: https://www.storyjam.nl

If you have any questions about how we handle your data, please contact us at the address above.

2. What Data We Collect

2.1 Account Information

When you create an account, we collect:

your name or display name;
your email address;
your profile photo (optional).

2.2 User Content

When you use the App, you may upload:

photos and videos;
chat messages;
moment titles and descriptions.

This content is stored to provide the core functionality of the App: sharing and preserving memories with the people you choose.

2.3 Device and Technical Data

We collect limited technical data to ensure the App functions correctly:

device type and operating system version;
push notification tokens (to deliver notifications);
App usage data (e.g. when you last opened the App).

2.4 Data We Do Not Currently Collect

We want to be explicit about what we do not currently collect. If any of this changes in the future, we will update this Policy and, where required by law, ask for your explicit consent before enabling such collection.

we do not currently collect your device location as a separate data point;
we do not access your contacts or address book;
we do not track your browsing behavior outside the App;
we do not use advertising trackers or third-party ad SDKs;
we do not collect financial or payment information.

2.5 Metadata Embedded in Photos

Photos taken with modern smartphones may contain embedded metadata (EXIF data), including the date and time of capture, camera model, and — if enabled on the device — GPS coordinates of where the photo was taken. When you upload a photo, this metadata may be uploaded along with the image file.

We are progressively rolling out automatic removal of location metadata from photos at the moment of upload. You can also disable location metadata at the device level in your camera settings. Please be mindful that photos you share may reveal location information through their visible content (for example, recognisable buildings, street signs, or landmarks) even after metadata is removed.

3. How We Use Your Data

We use your personal data only for the following purposes:

Providing the service: storing and displaying your photos, videos, and messages to you and the people you share them with;
Account management: authenticating your identity and managing your account;
Notifications: sending push notifications about activity in your moments and communities (e.g. when someone adds photos);
App improvement: understanding how the App is used so we can improve it (using aggregated, non-identifying data);
Safety and moderation: reviewing reported content and enforcing our terms of use.

3.1 What We Do Not Use Your Data For

We do not:

sell, rent, or share your personal data with advertisers;
use your content for AI training, machine learning, or any purpose beyond providing the service;
create advertising profiles based on your behavior;
share your data with third parties for their marketing purposes.

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

Performance of a contract (Art. 6(1)(b)): processing your account data and user content is necessary to provide the StoryJam service to you;
Consent (Art. 6(1)(a)): we ask for your consent before sending push notifications and before accessing your camera or photo library;
Legitimate interests (Art. 6(1)(f)): we process limited technical data to maintain and improve the App, and to ensure its security.

You may withdraw your consent at any time (see Section 7). Push notifications and camera/photo library access can be disabled through your device settings; disabling these does not affect the core functionality of the App.

5. Who We Share Your Data With

5.1 Other Users

Your photos, videos, and messages are shared only with the users you choose to share them with through moments. Your display name and profile photo are visible to other users in shared moments and communities.

5.2 Service Providers (Processors)

We use the following third-party service providers, who act as data processors on our behalf under a Data Processing Agreement:

Google Firebase (Google LLC / Google Ireland Limited): authentication, database (Firestore), file storage (Cloud Storage), push notifications (Firebase Cloud Messaging), and serverless functions (Cloud Functions). For more information, see privacy.google.com;
Apple Push Notification service (Apple Inc.): delivery of push notifications to iOS devices;
App Store and Google Play (Apple Inc. and Google LLC): distribution of the App.

We do not share your data with any other third parties. If we engage additional processors in the future, we will update this Policy.

5.3 Legal Requirements

We may disclose your data if required to do so by law, or if we believe in good faith that such action is necessary to comply with legal obligations, protect our rights, or ensure the safety of our users.

6. Data Storage, Security, and Retention

6.1 International Data Transfers

Your data is stored on Google Cloud servers operated by Google LLC. We use Google’s EU data regions where available. Some data is transferred to and processed in the United States as part of Google’s global infrastructure.

Such transfers rely on two safeguards:

the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), under which Google LLC is self-certified; and
the European Commission’s Standard Contractual Clauses, incorporated into Google Cloud’s Data Processing Addendum, as an additional safeguard.

You can request a copy of these safeguards by contacting us at appstoryjam@gmail.com.

6.2 How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data, including:

encrypted data transmission (TLS/SSL);
secure authentication via Firebase Authentication;
access controls limiting who can access backend systems;
regular review of our security practices.

While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6.3 How Long We Keep Your Data

We retain your personal data for as long as your account is active. If you delete your account:

your personal data and User Content will be deleted from active systems within 30 days;
backup copies may persist for up to 90 additional days before being overwritten as part of Google Cloud’s standard backup rotation;
moderation logs relating to reported content or account restrictions may be retained for up to 12 months to enable us to comply with our legal obligations under the EU Digital Services Act and to defend against legal claims.

Content you shared in moments with other users may remain visible to those users after your account is deleted, unless you specifically request removal of that content before deleting your account. Where we are required by law to retain certain information beyond these periods, we will do so only to the extent and for the duration required.

6.4 Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) without undue delay and, where feasible, not later than 72 hours after having become aware of it, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly, in accordance with Article 34 GDPR.

7. Your Rights Under GDPR

As a user in the European Union, you have the following rights regarding your personal data:

Right of access (Art. 15): you can request a copy of the personal data we hold about you;
Right to rectification (Art. 16): you can request correction of inaccurate personal data;
Right to erasure (Art. 17): you can request deletion of your personal data and account;
Right to restrict processing (Art. 18): you can request that we limit how we use your data;
Right to data portability (Art. 20): you can request your data in a structured, machine-readable format;
Right to object (Art. 21): you can object to processing based on legitimate interests;
Right to withdraw consent (Art. 7(3)): you can withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at appstoryjam@gmail.com. We will respond within the statutory period, in principle within one month of receipt of your request, extendable by two additional months where necessary given the complexity or volume of requests (Article 12(3) GDPR). Where we extend this period, we will inform you of the reasons.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

8. Push Notifications

We use Firebase Cloud Messaging (FCM) and, on Apple devices, the Apple Push Notification service (APNs) to send you push notifications about activity in your moments and communities (e.g. when someone adds new photos or sends a message).

You can manage or disable push notifications at any time through your device settings. Disabling notifications does not affect the functionality of the App.

9. Camera and Photo Library Access

The App requests access to your camera and photo library so you can take photos and select existing photos to add to moments. We only access photos you explicitly select or capture within the App. We do not scan, analyse, or access your photo library in the background.

You can revoke these permissions at any time through your device settings (iOS: Settings → Privacy & Security → Camera / Photos → StoryJam; Android: Settings → Apps → StoryJam → Permissions).

10. Photos of Other People

StoryJam allows you to share photos and videos, which often include other people. As the person uploading content, you are responsible for ensuring you have the right to do so, including consent from the people depicted (or their parents or legal guardians if they are under 16), as required under the GDPR and Dutch portrait right (portretrecht) under Articles 19–21 of the Dutch Copyright Act.

If you appear in a photo or video shared on StoryJam and you did not consent to it, or you would like it removed for any reason, you can request removal by emailing appstoryjam@gmail.com. Once available, you may also use our removal request form at https://www.storyjam.nl/removal-request. You do not need a StoryJam account to make such a request. We aim to respond and confirm removal within 72 hours.

11. Design Intent — Private Sharing

StoryJam is designed for the private sharing of personal memories within small, closed groups of people known to each other. The App does not offer public discovery, public feeds, open communities, or public search. Content is visible only within the specific moments and communities that a user creates or is invited to join.

Where an individual’s use of the App qualifies as a purely personal or household activity under Article 2(2)(c) of the GDPR, the GDPR does not apply to that individual’s processing. StoryJam nevertheless applies GDPR-level safeguards to all personal data processed on the platform.

12. Children’s Privacy

StoryJam is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without appropriate consent, we will take steps to delete that information as soon as possible.

If you believe a child under 16 has provided us with personal data, please contact us at appstoryjam@gmail.com.

Child Safety Standards (CSAE). StoryJam, as published on Google Play and the Apple App Store, explicitly prohibits child sexual abuse and exploitation ("CSAE") in any form, including child sexual abuse material ("CSAM"), grooming, sextortion, and the sexualisation or trafficking of minors. Where we obtain actual knowledge of CSAM, we will expeditiously remove it and report it to the competent authorities, including law enforcement and recognised child protection organisations such as the National Center for Missing & Exploited Children (NCMEC) and Offlimits (the Dutch hotline against online child sexual abuse), in accordance with applicable law. We comply with all applicable child safety laws and regulations in the jurisdictions where the App is offered.

Suspected CSAE can be reported through the in-app report function available on every photo, video, message, and user profile. Such reports are reviewed with the highest priority. Our designated child safety point of contact is: appstoryjam@gmail.com (attn: Child Safety — StoryJam); this address may also be used by individuals who do not hold a StoryJam account. Our full Child Safety Standards are set out in Section 4.7 of our End-User License Agreement, available on our website (https://www.storyjam.nl).

13. Third-Party Links

The App may contain links to third-party websites or services that are not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the App and on our website, and — where the change is significant — by sending you a notification. The "Last updated" date at the top of this Policy indicates when it was last revised.

Your continued use of the App after any changes to this Privacy Policy constitutes your acceptance of the updated Policy. Where a change requires your consent under applicable law, we will ask for it before the change takes effect for you.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

StoryJam, operated by Daniel Ibink and Remco Snijders

Email: appstoryjam@gmail.com

Website: https://www.storyjam.nl

This Privacy Policy is governed by the laws of the Netherlands and the European Union.