Privacy Policy

1. Introduction

IRO (“IRO”, “we”, “us”, “our”) is an interactive AI manga experience available through the IRO mobile application and the website irostories.com (together, the “Service”). In IRO you create a manga character of yourself and play through stories in which every choice generates a brand-new manga page.

This policy explains, in plain language, exactly what data the Service needs, what happens to it, who processes it, how long we keep it, and the rights and controls you have. It applies to everyone who uses the app or visits the website.

Contact for anything in this policy: support@irostories.com.

2. At a glance

• We collect the minimum needed to run the game: your character inputs, your story activity, your credit balance and purchase confirmations, and standard technical logs.
• A selfie is always optional. If you share one, it is used only to draw your manga character — never for identification, advertising or biometric analysis.
• Story text and artwork are generated by AI providers acting on our behalf; we share with them only what generation requires.
• We do not sell personal data, we show no third-party advertising, and we use no cross-app tracking or advertising SDKs.
• You can request deletion of anything — or everything — at any time.

3. Data we collect

3.1 Account and identifiers

The Service assigns your installation an account identifier that links your characters, stories, credit balance and purchases together. If sign-in options are offered (for example Sign in with Apple), we additionally receive the identifier — and, if you choose to share it, the email address — that the sign-in provider passes to us. We do not require your real name.

3.2 Character creation data

To create your manga character you provide:

• a character name, an adult age, and appearance/personality traits you type or select;
• either a written description of a face, or — only if you choose — a selfie (JPEG, PNG or HEIC).

Selfies are uploaded directly from your device to our private media storage over an encrypted, short-lived signed link. The resulting character sheet (your manga likeness) is stored the same way. See Section 5 for the full face-data treatment.

3.3 Story and gameplay data

• Your story setup (world, tone, story language).
• The choices you pick and any free text you write during play.
• The generated story text and manga pages, which are stored so your library stays permanent.
• Gameplay events needed to run the credit system (for example “page generated”, “generation failed → credits refunded”).

3.4 Purchases and credits

All purchases are processed by Apple through the App Store. We receive the purchase confirmation (product, transaction identifier, timestamp) and maintain your credit (“ink drop”) balance as a ledger on our servers. We never receive or store your payment card details — Apple does not share them with developers.

3.5 Technical and log data

Like nearly every online service, our servers automatically record request metadata: IP address, request time, endpoint, app version, device OS version, and error details. We use this strictly for security, abuse prevention, debugging and capacity planning.

3.6 Support communications

If you email us, we receive your email address and the content of your message, and keep the thread for as long as needed to resolve your request and maintain a support history.

3.7 What we do not collect

• No precise location, contacts, calendar, microphone or photo library access (choosing a single selfie uses the system picker, which shares only the photo you select).
• No third-party advertising or tracking SDKs, no cross-app tracking, no data brokers.
• No biometric templates, face geometry maps, or identity recognition of any kind.

4. How we use data, and the legal bases

Where GDPR or similar laws apply, each use below rests on the stated legal basis:

• Running the game — generating your character sheet and manga pages, remembering your story so it stays consistent, maintaining your library. Basis: performance of a contract.
• Credits and purchases — maintaining your balance, applying automatic refunds of failed generations, preventing double-charging. Basis: performance of a contract.
• Safety and moderation — screening inputs and outputs against our content rules (see Terms, Section 9), blocking prohibited content, investigating abuse. Basis: legitimate interest in a safe, lawful service.
• Security and reliability — logs, rate limiting, fraud prevention, debugging. Basis: legitimate interest.
• Support — answering you when you contact us. Basis: legitimate interest / contract.
• Legal compliance — keeping records we are required to keep, responding to lawful requests. Basis: legal obligation.

We do not use your data for third-party advertising, and we do not sell or rent personal data to anyone.

AI training: we do not use your selfies, stories or pages to train our own AI models. Our AI providers process your data as processors to generate your content, under agreements that restrict use of API data for their model training.

5. Your selfie and face data

Because a selfie is a photo of your face, we treat it with extra care and describe its handling completely:

• Optional. You can play all of IRO by describing a face in words instead. The Service never requires a selfie.
• Single purpose. A selfie is used for exactly one thing: as a visual reference so the image model can draw a stylized manga character that resembles you. It is not used to identify you, to verify your identity, to build a biometric template, or for any form of facial recognition.
• Where it lives. The selfie is uploaded from your device straight to our private cloud storage (Amazon Web Services, EU — Frankfurt). Files there are not public; the app accesses them through signed links that expire within minutes.
• Who sees it. During character generation, the selfie is transmitted to our image-generation provider (Google) as reference input, solely to produce your character art. It is not shared with anyone else.
• How long. The selfie and the generated character sheet are retained while your character exists, because the character sheet is re-used as the visual anchor for every page of your stories. You may request deletion of the selfie at any time (Section 8) — including while keeping your stories.
• Other people's faces. Uploading photos of anyone other than yourself is prohibited by our Terms. If we become aware of such an upload, we remove it.

6. Who processes your data

We use a small number of service providers (“processors”) that handle data on our instructions to make the Service work. We share with each only what its role requires:

• Amazon Web Services (AWS) — server hosting and private media storage, EU (Frankfurt) region. Holds: all Service data at rest.
• xAI — story text generation. Receives: your story context (character description, story setup, prior story summary, your latest choice or free text). Does not receive your selfie.
• Google — manga page and character art generation. Receives: visual references (your character sheet; your selfie during character creation; the previous page for visual continuity) and the page's visual brief.
• Apple — App Store distribution and payment processing. Apple's own privacy policy governs the data Apple collects as part of purchases.

We do not permit processors to use your data for their own advertising, and API-submitted content is excluded from provider model-training programs under our agreements with them.

Beyond processors, we disclose personal data only: (a) if required by law or valid legal process; (b) to protect the rights, safety or property of users, the public or the Service; or (c) as part of a merger or acquisition, in which case this policy continues to apply to previously collected data.

7. International transfers

Our servers and media storage are located in the European Union (Frankfurt, Germany). Generating content requires transmitting the relevant inputs to AI providers that operate in the United States (xAI, Google) — these transfers happen only at the moment of generation and rely on recognized transfer safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

8. Retention and deletion

How long we keep things

• Stories and generated pages: for as long as your account exists — permanence of your library is the core of the product.
• Characters, selfies, character sheets: while the character exists (a deleted character's sheet survives inside stories that already used it, as part of those stories — see Terms Section 7).
• Credit ledger and purchase confirmations: for the life of the account, plus any period required by tax and accounting law.
• Server logs: routinely rotated; kept no longer than 12 months, typically much less.
• Support emails: as long as needed to handle the matter and keep a support history.

Deletion

• You can delete characters directly in the app.
• To delete your selfie, specific stories, or your entire account and all associated data, email support@irostories.com from the device or address associated with your use. We will verify the request, complete the deletion within 30 days, and confirm to you — keeping only what law requires us to keep (for example purchase records for tax purposes) and residual copies in encrypted backups until those backups expire on their normal cycle.
• When in-app account deletion ships, it will perform the same complete removal without needing an email.

9. Your rights

Subject to the law that applies to you, you have the right to:

• Access the personal data we hold about you and receive a copy in a portable format;
• Correct inaccurate data;
• Delete your data (Section 8);
• Restrict or object to processing based on legitimate interests;
• Withdraw consent at any time where processing is based on consent (for example, by deleting a selfie you chose to provide), without affecting prior processing;
• Complain to a supervisory authority — your local data protection authority under the GDPR, or the Personal Data Protection Authority (KVKK) in Türkiye.

If you are a California resident, you additionally have the rights granted by the CCPA/CPRA, including the right to know, delete and correct, and the right to non-discrimination for exercising them. We do not “sell” or “share” personal information as those terms are defined in the CCPA.

To exercise any right, email support@irostories.com. We respond within 30 days.

10. Age requirement

The Service is rated 17+ and is not directed to children. You must be at least 17 years old (or older where your local law sets a higher minimum for this kind of content) to use the Service. We do not knowingly collect personal data from anyone under this age; if we learn that we have, we delete it promptly. If you believe a minor is using the Service, contact us.

11. Security

Security measures in place, matching how the Service is actually built:

• All traffic between your device and our servers uses TLS encryption; the application server is not directly reachable from the internet.
• Media (selfies, character sheets, pages) lives in private storage with public access blocked; every read and upload goes through signed URLs that expire within minutes.
• Storage credentials follow least-privilege: the key used by the Service can access only IRO's own bucket.
• Credit operations are atomic and idempotent, preventing double-charges even under failures.
• Access to production systems is limited to the operator, over key-based authentication.

No online service can promise perfect security; if a breach affects your personal data, we will notify you and the competent authority as the law requires.

12. Changes to this policy

When we change this policy, we update the “Last updated” date above. For material changes — such as a new category of data or a new processor — we will additionally give you notice in the app or on this site before the change takes effect. Archived versions are available on request.

13. Contact

Data controller: IRO, operator of irostories.com.
Questions, requests, complaints: support@irostories.com