Privacy Policy

Bella Storia is an app for reading Italian stories with inline language-learning help. This policy explains what data the app collects, why, and what you can do about it.

Who we are

Bella Storia is operated by Mike Borozdin, the data controller for the purposes of the UK GDPR and the EU GDPR. You can reach us at mike.borozdin@gmail.com.

Account information

You need an account to use Bella Storia. You can create one with an email address and password, with Sign in with Apple, or with Google Sign-In. When you use Apple or Google we receive your email address and, if you choose to share it, your name. If you use Apple's Hide My Email, we only ever see the relay address Apple gives us. We never see your Apple or Google password.

Accounts and passwords are handled by Supabase, which stores your email address, a hashed password where applicable, and your sign-in provider.

Information the app stores about your learning

• The language and CEFR level you have chosen.
• Which stories have been assigned to you.
• Whether you have turned push notifications on or off.
• If you enable notifications, a push token for your device, along with the platform (iOS or Android) and the notification permission status the operating system reports.

Information that stays on your device

Your reading and quiz progress, the words you have tapped to look up, and cached story content are stored only on your device. They are not uploaded to our servers, and they are removed when you delete the app.

Analytics

We use PostHog to understand how the app is used so we can improve it. PostHog is configured on EU-hosted infrastructure, and analytics are disabled entirely in development builds. Session replay is switched off, so we never record your screen.

Analytics events are linked to your account identifier and cover things like screens viewed, which sign-in method you used, the level you chose, stories opened, words and sentences you looked up, and quiz results. We do not include your email address, your name, or any free text you type in analytics events.

This website also uses PostHog to count visits and see which links are clicked. On the website, analytics are anonymous: we do not set cookies or store anything on your device, and session replay is switched off. If you open the site on a phone and are sent to the App Store or Google Play, we record that redirect, the store, and the referring page.

What we do not collect

• No microphone, camera, photo library, location, contacts, or health data. The app never asks for these permissions.
• No advertising identifiers, ad networks, or ad targeting.
• We do not sell or rent your personal data to anyone.

Who processes data for us

• Supabase — accounts, authentication, and the database that holds your level, assigned stories, and notification settings.
• PostHog — product analytics, on EU infrastructure.
• Expo — issuing push tokens and delivering push notifications, if you enable them.
• Apple and Google — sign-in only, if you choose those options.
• Anthropic — used by us to generate the story content before it is published. Prompts contain only story topics written by our editors. No user data is sent to Anthropic.

Story illustrations are loaded directly from Wikimedia Commons by your device. That means Wikimedia can see your IP address when an image loads, in the same way it would if you visited their website.

Why we are allowed to use your data

• Performance of a contract — creating your account, assigning stories, and running the app.
• Legitimate interests — analytics that help us understand and improve the app, and keeping the service secure.
• Consent — push notifications, which you can turn on or off at any time in Settings or in your device settings.

How long we keep your data

We keep your account data for as long as your account exists. You can delete your account from the Settings screen in the app. Deleting your account deletes your account and the data associated with it, including your level, assigned stories, notification preferences, and push tokens. This cannot be undone. You can also email us and we will delete your account for you.

Analytics data is retained in an aggregated form that is no longer linked to you.

Your rights

If you are in the UK or the EU, you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we rely on it. Email mike.borozdin@gmail.com to exercise any of these rights.

If you think we have handled your data badly, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local data protection authority in the EU.

International transfers

Some of our providers process data outside the UK and the EEA. Where that happens, the transfer is covered by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.

Children

Bella Storia is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

We may update this policy as the app changes. The date at the top of this page shows when it was last revised, and we will tell you in the app if the changes are significant.