Privacy Policy

Last updated: 9 October 2026.

This policy explains what personal data Storymapper holds about you, why, who else handles it and what you can do about it.

1. Who we are

Storymapper (storymapper.co.uk) is run by Craig Hodgkinson, a sole trader in the United Kingdom, trading as Storymapper. In this policy “we” and “us” mean Craig Hodgkinson. We are the data controller for the personal data described here.

We are registered with the Information Commissioner’s Office (ICO), the UK data protection regulator. Our registration number is ZC266080.

Email: hello@storymapper.co.uk
Contact form: storymapper.co.uk/#contact

2. What we collect

Account details: your email address, your password (stored only in a scrambled form that we cannot read), a display name and, if you add one, a profile picture.
Your work: the projects, timelines, scenes, relationship charts, maps, notes, labels and images you create or upload.
Preferences: your theme, text size, font, motion setting and similar choices.
Plan details: whether you are on Free or Storymapper Plus, whether you pay monthly or yearly, when the subscription started and renews, whether a payment has failed, and the reference numbers that link your account to your subscription.
Messages you send us: what you write in the Help and feedback form, any screenshots you attach, and details of your device that help us trace a fault: browser, operating system, screen size, language, time zone, display settings, plan and the page you were on. If you use the contact form on the home page, your name, email address and message.
Technical records: your IP address, browser type and the time of each request. Our hosting providers record these to deliver the site and to keep it secure.

We never see or store your card number. Onelink takes payment on its own pages (see section 5).

We do not use advertising, analytics or tracking tools, and we do not build a profile of you.

Share links. Your work is private unless you choose to share it. If you make a share link for a project, anyone who has that link can look at the project without an account: its title, its Timeline, its Relationships chart and its maps, with their titles, chapters, dates, labels, colours and map images. Your notes, the images on your scenes, your name and your email address are not shown. You can switch a link off at any time and it stops working straight away. Anyone you give a link to can pass it on, so share it only where you are happy for the project to be seen.

Where it comes from. Almost all of this comes directly from you. The one exception is the state of your subscription, which Onelink sends to us.

3. Why we use it, and our legal basis

To run your account and store your work. Legal basis: our contract with you (the Terms of Use).
To give you the plan you have paid for. Legal basis: our contract with you.
To send emails about your account, such as confirming your address, resetting your password or telling you about a significant change to the service. Legal basis: our contract with you.
To answer your messages and fix problems you report. Legal basis: our legitimate interest in supporting the people who use Storymapper.
To keep the service secure and stop misuse. Legal basis: our legitimate interest in protecting the service and its users.
To keep business and tax records. Legal basis: our legal obligations.

We do not sell your data. We do not send marketing emails. We do not use your work for anything except showing it back to you, and we do not use it to train artificial intelligence.

We look at the content of a project only when you ask us for help with it, when it is needed to fix a fault, or when the law requires it.

4. Companies that handle data for us

These companies process personal data on our instructions, under contracts that require them to protect it:

Supabase holds the database of accounts and projects and stores your images. The data is kept in London.
Cloudflare delivers the website, runs our server code and forwards our email. Its Turnstile service checks that the sign-up, log-in, password reset and contact forms are being used by a person and not a script. To do that it looks at technical details of your browser and connection.
Resend sends account emails, and delivers feedback and contact form messages to us.
Google provides the mailbox where we read and answer your messages.

Apart from these companies and Onelink (section 5), we share personal data only when the law obliges us to, for example under a court order.

5. Payments

Storymapper Plus is sold through Onelink, a service run by Stripe. Onelink is the seller of record: it takes your payment, works out the tax, sends your receipt and handles refunds and payment disputes. To do this it collects your name, email address, billing address and payment details directly from you, and it decides for itself how to use them. Its own privacy policy, shown at checkout, covers that data. Stripe’s policy is at stripe.com/privacy.

We give Onelink your email address when you start a purchase, so that the subscription can be matched to your account. It tells us the state of your subscription and nothing about your card beyond what is needed to show you a failed payment.

6. Where your data goes

Your account, your projects and your images are stored in the United Kingdom, in London. The companies we use are based in the United States, so personal data can leave the UK. Each transfer is protected in one of two ways:

The UK–US Data Bridge. UK adequacy regulations cover US companies that are certified under the UK Extension to the Data Privacy Framework.
The UK Addendum. The UK’s International Data Transfer Addendum to the standard contractual clauses, which forms part of our contract with the company.

The organisations, all in the United States, and the protection each relies on:

Supabase, Inc. (database and file storage): the UK Addendum.
Cloudflare, Inc. (website hosting and delivery): the UK–US Data Bridge.
Resend (Plus Five Five, Inc.) (email delivery): the UK–US Data Bridge.
Google LLC (our mailbox): the UK–US Data Bridge.
Stripe, which runs Onelink (payments): the UK–US Data Bridge.
Amazon Web Services, Inc. (hosting used by Supabase and Resend): the UK–US Data Bridge.

Cloudflare delivers the website from data centres around the world, so a request may pass through the country you are in.

7. Storage in your browser

Storymapper keeps a small amount of information in your browser’s local storage: your login session, your display preferences and whether you chose “Remember me”. The site cannot work without these, so we do not ask for consent to store them.

We set no advertising or analytics cookies. Cloudflare may set a cookie that is strictly needed for security. Onelink’s checkout pages are on its own website and use its own cookies.

8. How long we keep it

Your account and your work: for as long as your account exists. When you delete your account in Settings, your profile, projects and images are deleted straight away, and any subscription is cancelled. Copies in our hosting provider’s backups disappear as those backups are overwritten.
Images you remove from a project: cleared from storage the next time the project is opened, and at the latest when you delete your account.
Feedback and contact messages: up to 2 years. Feedback in our records, with its screenshots, is deleted automatically once it is 2 years old. Until then it stays, with the email address you used, even if you delete your account. Ask us and we will delete it sooner.
Technical records: kept by our hosting providers for a short period, usually no more than 30 days.
Records of payments we receive: about six years, to meet UK tax law. Onelink keeps its own payment records for as long as the law requires it to.

9. Your rights

Under UK data protection law you can:

ask for a copy of the personal data we hold about you, and ask where we got it and who we have shared it with;
ask us to correct anything that is wrong or incomplete;
ask us to delete your data;
ask us to stop or limit how we use it, or object to a use that relies on our legitimate interests;
ask for your data in a form you can take to another service.

Which rights apply can depend on the legal basis in section 3. For example, the right to object applies where we rely on our legitimate interests, and we cannot delete records that the law requires us to keep.

You can do much of this yourself. Settings lets you change your details, export every project as a file, and delete your account. For anything else, email hello@storymapper.co.uk. We reply without undue delay and always within one month, and there is no charge.

10. Security

All traffic to Storymapper is encrypted. The database lets each account read and change only its own rows, and images are held in private storage that needs a short-lived, signed link to open. The one exception is a project you have chosen to share by link (see section 2), which can be read, and never changed, by anyone who has that link. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the ICO as the law requires.

11. Children

Storymapper is for people aged 16 or over. We do not knowingly hold data about anyone younger. If you believe someone under 16 has opened an account, email hello@storymapper.co.uk and we will delete it.

Every account, whatever the holder’s age, is private by default: nothing you make is visible to other people, and we use no advertising, tracking or profiling.

12. Changes to this policy

We will update this page when the way we handle data changes, and change the date at the top. If a change is significant, we will email you before it takes effect.

13. Complaints

If you are unhappy with how we have used your personal data, tell us at hello@storymapper.co.uk. A complaint that reaches us any other way counts too. We will acknowledge it within 30 days, look into it without undue delay, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office at any time: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL.