Privacy Policy

Last updated: 2026-10-12 · Plain-English version

1 · Who we are

Fablely is operated by Northbright Labs LLC (Wyoming, USA), founded in 2026 by solo founder Gavin Wong. You can reach us at hello@fablely.ai or by postal mail at 5830 E 2nd St, Ste 7000 #35863, Casper, WY 82609, USA (registered-agent forwarding address).

We are a small indie SaaS that helps families turn their memories into written stories and letters. We are not a trust company, not a financial product, not insurance, not a security, not an investment vehicle, and not a regulated financial service.

2 · What we collect

Automatically (no account required)

• Anonymous session ID in your browser's localStorage. Lets you come back to the stories you wrote without an account, without us knowing who you are.
• IP address, hashed with a secret key, for rate-limiting only. Deleted after about a day.
• Product events (for example "a story was written" or "a story was kept"), tied to a story and a one-way hash of the session ID — never your name or email. We use them only to see which steps work.

When you write a story or letter

• What you type — the memories, names, relationships, tone, and (for letters) occasion you enter.
• What we write for you — the story or letter text, any edits you make, and the illustration painted for it.
• We don't accept voice, photo, or video uploads.

If you create an account

• Email address — required for sign-in and transactional messages, plus a few welcome emails in your first week (unsubscribe any time).
• Display name — optional, how we address you in emails.
• OAuth provider data — if you sign in with Google, we receive your email and Google profile name. We never see your Google password.

When you buy

• Stripe handles the payment. We receive the email you gave at checkout, the amount, and whether it was paid — so we can unlock your story and help if something goes wrong. We never see your card number.

3 · Why we collect it

• Your memories → to write the story or letter you asked for, and to rewrite it when you ask.
• The story and its illustration → so you can read, edit, download, and share it.
• Email → sign-in, receipts, the private link to a story you paid for (or asked us to email you), and a few welcome emails after you sign up.
• IP (hashed) → rate-limiting only.

We do NOT use your data for:

• Targeted advertising
• Profiling or scoring
• Algorithmic decisions about you
• Training general-purpose AI models

4 · Who we share it with

We use exactly these processors, and only as needed to run the product:

• fal.ai — runs the AI for us. It sends the memories you enter to the writing model, which writes your story or letter and a one-sentence picture description, and it paints the illustration from that description (designed to show a place or objects, not people).
• OpenRouter and Anthropic — the writing model is currently Anthropic's Claude, which fal reaches through OpenRouter. Anthropic does not train its models on API data.
• Supabase (US-East-1, Virginia) — storage and database.
• Resend — transactional email.
• Stripe — payment processing. We never see your card number.
• Vercel — hosting and cookieless analytics.
• Cloudflare — DNS for fablely.ai and forwarding of email sent to our addresses.
• Formspree — our contact form.
• Sentry — error reports from our servers, so we can fix bugs (no story text).

We do NOT share with: advertisers, data brokers, social platforms, government (except by valid court order), or AI training datasets.

5 · Encryption and storage

• Stories and illustrations: AES-256 encryption at rest in Supabase.
• Not end-to-end encrypted: to write your story, the AI has to read your memories, so they are processed in readable form by us and by the providers listed above.
• Honest claim: we describe the actual algorithm (AES-256). We do not use marketing phrases like "bank-level" or "military-grade."
• Backups: daily encrypted snapshots in Supabase (US), kept for 30 days.
• Data residency: stored in the US (Supabase, Virginia). The AI providers in §4 process your text to write the story. Canadian users: your data is stored and processed outside Canada.

6 · Account deletion

Delete your account any time in Settings (or email hello@fablely.ai). We email you to confirm, and the deletion happens 30 days later — use the link in that email if you change your mind. Then:

• Stories, illustrations, private links, prepaid stories and the account → permanently deleted. Any private links stop working.
• Heir designation → removed.
• Backups → roll off within 30 more days.

7 · Content acceptance policy

We accept: memories, notes, and stories you type, about people you have the memories and the right to write about.

We refuse:

• Medical records and health data
• Banking or financial documents
• Government identification (passport, SSN, driver's license scans)
• Notarized or legally-binding documents
• Wills, trusts, or estate planning documents
• Cryptocurrency keys or wallet data
• CSAM (illegal everywhere)
• Content meant to harass, defame, or expose a real person, or private details about someone they wouldn't want shared

Each refused category keeps us out of a regulatory regime (HIPAA, GLBA, estate law) that we cannot afford to be in. Accepting that content would put your other data at risk too.

8 · COPPA posture (children)

• Fablely is 18+ only. Account holders must be adults.
• A parent can write a story or letter about a child, or to one.
• Children CANNOT be account holders, and we don't knowingly collect information from children.

This structure keeps Fablely out of COPPA jurisdiction.

9 · Two-factor authentication (2FA)

• Recommended for every account (authenticator app).

10 · Private links

• Every story is private until you choose to get a private link for it.
• Anyone you send the link to can read the story and download its PDF. It is never listed on Google or in our sitemap without your permission.
• Permission means you ticked "Let Fablely feature this story" under the link. Even then we choose by hand which stories to feature. Untick it any time and the story leaves search and our sitemap; the private link keeps working.
• If you sign in, stories you wrote on this device before signing in move into your account. If you bought a story, we email you a private link to it — anyone holding that link can open and edit the story, so share the family link instead.
• To turn a link off, email hello@fablely.ai — we usually reply within a day or two.

11 · Writing about other people

• Fablely is for writing about people you have the memories and the right to honor — a parent, a grandparent, a partner, a child, someone you've lost.
• We do not run facial recognition, and our illustrations are designed to show places and objects, not people.
• Takedown: if someone written about wants a shared story removed, email hello@fablely.ai — we act on takedown requests within 2 business days.

12 · Cookieless analytics

• We use Vercel's built-in analytics — no cookies, no fingerprinting.
• No Google Analytics. No Facebook Pixel. No Mixpanel. No third-party trackers.
• Transactional emails contain delivery receipts only, no tracking pixels.

13 · State-specific rights

California: Do Not Sell or Share My Personal Information (CCPA/CPRA)

Fablely does not sell your personal information, and we do not "share" it for cross-context behavioral advertising (CPRA definitions). We also do not engage in any activity that California's CPRA defines as "sale." There is therefore nothing to opt out of — the opt-out has already been applied by default for every user. To exercise this right formally in writing, email hello@fablely.ai with subject "CCPA Opt-Out Confirmation" and we will reply within 15 business days with a written confirmation suitable for your records.

Additional California rights you have, exercisable at hello@fablely.ai: right to know what we collect, right to delete, right to correct, right to limit use of sensitive personal information (we don't collect any to begin with), right to portability (one-click ZIP export from your Settings page covers this), right to non-discrimination for exercising any of the above.

California: Shine the Light (Cal. Civil Code § 1798.83)

California residents may request, once per calendar year, a disclosure of what personal information (if any) we have shared with third parties for those parties' direct marketing purposes in the preceding calendar year. Our answer is: none. Fablely has never shared customer personal information with third parties for direct marketing. To receive a written confirmation, email hello@fablely.ai with subject "Shine the Light Request."

Other states

• Illinois: the prior BIPA notice is deprecated. We do not process biometric data — no facial recognition, no voice cloning, no biometric identifiers.
• Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA): access / delete / portability rights are honored on the same email channel as CCPA above.
• Texas (TDPSA): covered by the same channel; we do not engage in "targeted advertising" as defined by the statute.
• Canada (PIPEDA): your data crosses the border to the US (Supabase US-East-1, Virginia). Disclosed here.
• Other states: standard US consumer protections apply.

14 · How to contact us

• Privacy questions: hello@fablely.ai
• Data subject requests (access, export, delete): hello@fablely.ai
• A story about you that you want taken down: hello@fablely.ai (we act within 2 business days)

15 · Changes to this policy

• 30-day email notice for material changes (the same as our Terms).
• "Last updated" date refreshed at the top of this page.

Change history

• 2026-10-12 — Rate-limit IPs are now hashed and deleted after about a day; backups are daily Supabase snapshots kept 30 days (not Cloudflare); added Formspree and Sentry; account deletion described as it works in Settings; emailed story links and welcome emails described; content rules reworded so tributes and family stories are clearly allowed.
• 2026-10-09 — Rewritten for the story product: what we collect, the AI providers we use (fal.ai, OpenRouter, Anthropic), private links, and writing about other people.