Privacy and Cookie Policy

Last updated: August 2026

This notice explains how CantaStories (the "Site") handles the personal data of users, in accordance with EU Regulation 2016/679 (GDPR).

Data controller

The data controller is the operator of CantaStories. For any request about your data you can write to us from the Contact page.

What data we collect

Account data (if you register): username, email address and a password stored in encrypted form (a hash). Alternatively you can log in with Google: in that case we receive your name, email and an identifier from your Google profile, to create or link your account.
Game data: the games you play, the questions you ask the narrator and the solutions you submit, with their outcomes and any rating you leave.
Voice content (only if you use the voice feature): your voice is turned into text to build your question. See the Voice play section.
Technical data: IP address, browser type and technical logs, processed for security and to prevent abuse.
Local identifiers: we use the browser's storage (localStorage and sessionStorage) for an anonymous session identifier, for the access token and to remember a few preferences (such as voice mode and the last screen you opened). These are not profiling cookies.
Advertising data: if you consent, our advertising partners may process identifiers and browsing data. See the Cookies and advertising section.

Why we process data, and on what basis

To provide the game and your account — performance of the service you ask for.
Security and anti-abuse, such as request rate limits — legitimate interest.
To answer your requests sent from the Contact page — legitimate interest.
Advertising and related storage technologies — consent, which you can give or refuse from the banner and withdraw at any time.
Voice play — consent: the feature is off by default and is only enabled if you choose it, which also authorises microphone use.

Artificial intelligence and model providers

The game runs on language models. The questions you ask the narrator and the solutions you submit are sent to the model provider to generate the answer and the score. The same applies to the text the app generates to create the stories.

To guarantee continuity of service we use several providers in sequence: if the first is unavailable or has hit its own limits, the request is automatically forwarded to the next. This means that the same question may be processed by any one of the providers we use:

Google (Gemini models) — United States;
Groq — United States;
Anthropic (Claude models) — United States;
any models hosted on our own infrastructure, in which case the text never leaves our systems.

These providers process the text to give us the answer. We ask you not to enter personal, third-party or confidential data in the game: questions and solutions are free-form content and we have no way of checking them before they are sent.

Voice play

You can play by voice: you dictate your questions to the microphone and the answers are read aloud. The feature is optional and off by default; it only starts when you press the right control and allow microphone access in your browser.

Speech recognition is performed by the browser, not by our servers: we neither receive nor store any audio recording, only the transcribed text, which becomes your question and is processed as such. Keep in mind, however, that some browsers, Google Chrome among them, send the audio to their own servers to perform the transcription: in that case processing takes place under the browser vendor's privacy notice. You can stop listening at any time, or revoke microphone permission from your browser settings.

Third-party services

To make the Site work we rely on some providers that may process data on our behalf or as independent controllers:

Cloudflare — content delivery, security and network infrastructure.
Brevo — transactional email (password reset, invitations, replies to contacts).
Google — Google sign-in, if you choose it; advertising (Google AdSense); speech transcription, if you play by voice with a browser that uses it.
Google, Groq, Anthropic — artificial intelligence model providers, as described above.
Stripe — if you choose to support the project with a donation, payment takes place on pages operated by Stripe, which independently handles the payment data. We neither receive nor store your card details.

Some of these providers process data outside the European Union, particularly in the United States; in that case the transfer takes place on the basis of the guarantees provided by the GDPR (for example standard contractual clauses or adequacy decisions).

The Site uses technical and functional technologies (localStorage and sessionStorage) that are necessary for the game, for login and for your preferences: without them the service cannot be provided and they do not require consent.

The Site's public content pages also host advertisements served through Google AdSense. For this purpose Google and its partners may use cookies and similar identifiers to show ads, measure their performance and, if you consent, personalise them based on your interests.

Before these tools are activated you are shown a consent banner: you can accept, reject or choose in detail.
You can change or withdraw your choice at any time by reopening the banner from the Site's privacy settings.
Refusing does not stop you browsing: you will see non-personalised ads.
You can manage your Google account's advertising preferences at myadcenter.google.com and read how Google handles partner site data at policies.google.com.

No advertisements are shown in the game area.

Data retention

We keep account data for as long as the account stays active; game data for as long as the purposes described require it; technical logs for a limited period, for security. You can ask for deletion at any time.

Your rights

You have the right to access your data, ask for it to be rectified or erased, to restrict or object to processing, to withdraw consent and to request portability. You can exercise these rights by writing from the Contact page. You also have the right to lodge a complaint with your supervisory authority (in Italy, the Garante per la protezione dei dati personali).

Minors

The Site is not aimed at children under 14 and does not knowingly collect their data.

Changes

We may update this notice; the current version will always be published on this page with the date of the last update.