Legal

Privacy Policy

Massal Stories (massal.online) lets you write and illustrate stories with AI models. This policy explains what we store and why.

What we collect

• Account basics: your name, email address and, with Google sign-in, your profile picture (scopes openid, email, profile).
• Your stories: chat messages, story text, characters, frames and generated images you create.
• Your AI provider API keys (OpenAI, Anthropic, Google), stored encrypted and used only to run your own requests.
• Usage records: which AI model was called and how many tokens it used, so you can see your costs.
• Your channel, if you publish: its name, handle, bio and the links you add.

Public stories and channels

Stories are private until you publish them. When you publish a story, anyone can read it (its text, frames and character pictures), and your channel's name, handle, bio and links are shown with it. Your email address is never shown. You can make a story private again at any time.

Every story is rated automatically from its text. Stories rated 18+ or with sexual content can't be published. We may take down public stories that break our rules.

Likes and comments on public stories are public: comments show your channel's name and handle. You can delete your own comments; a story's author can delete any comment on their story, and we may delete comments that break our rules.

To count views, we keep for each story and day a one-way hash of the reader's network address and browser, not the address itself, and delete these records after 60 days.

How we use it

Only to provide the service to you. Your story content is sent to the AI providers you choose, using your own API keys, under those providers' terms. We do not sell your data or use it for advertising.

Sharing

We share data only with the services needed to do what you ask: the AI provider you selected (OpenAI, Anthropic or Google). Stories and images are stored in our database and object storage; our hosting runs behind Cloudflare.

Deleting your data

You can delete single stories, or your whole account (all stories, images and keys), at any time in Settings. Deletion is immediate.

Security

API keys are encrypted at rest. Your private stories require signing in, and other users cannot see them.

Last updated: 2 November 2026