Privacy policy

1. Data controller

The data controller for this website is On Story, operated by Wafaa Albadry. For any inquiries regarding your personal data, you can reach us directly via hello@on-story.com.

2. Data we collect and legal basis

We operate under the GDPR principle of "data minimisation." We only collect personal data that you explicitly provide to us.

• Communication data: if you sign up for our pre launch updates or waiting list, we collect your email address.
• Legal basis: the processing of this data is strictly based on your explicit consent (GDPR Article 6(1)(a)). You give this consent by actively submitting your details through our submission forms.

3. Purpose of processing

Your information is used solely to:

• Provide updates regarding our upcoming launch, project milestones, and developmental progress.
• Respond directly to inbound project inquiries.
• We will never sell, trade, or distribute your email address to third party marketing entities.

4. Data retention

We store your personal information only for as long as necessary to fulfil the launch phase of the project, or until you choose to exercise your right to erasure.

5. Your rights under GDPR

As an EU resident, you possess the following strict legal rights regarding your data:

• Right to access: you can request a copy of the data we hold about you.
• Right to rectification: you can request that we update or correct inaccurate data.
• Right to erasure ("right to be forgotten"): you can request that we delete your email from our systems instantly.
• Right to withdraw consent: you can unsubscribe from our communications at any moment by clicking the "unsubscribe" link or contacting us.

6. Exercising your rights

To exercise any of these rights, contact us at hello@on-story.com.

What we collect

From the early access form: your email address, your first name if you choose to give it, a record that you gave consent, and the timestamp of that consent and submission. Nothing else.

Why we collect it

To send you occasional updates as On Story gets ready to launch, and to let you know when early access opens. The legal basis is your consent, which you gave by ticking the box on the form. You can withdraw it at any time.

Where it is stored

Early access entries are written to a private Google Sheet held in Google Drive. Depending on account and region settings, Google may store or process this data outside the European Union. We do not sell or share this list with third parties.

How long we keep it

Until launch plus twelve months, or until you ask us to delete it, whichever comes first. If you unsubscribe, we keep only the record needed to honour that request.

Your rights

You can ask to see, correct, export or delete your data, and you can withdraw consent at any time. Email hello@on-story.com and we will act on it. Every email we send includes a working unsubscribe link, honoured immediately.

The self-check on this page

The impostor thoughts self-check is scored on our server and the result is sent straight back to your screen. Your answers are not saved, not linked to you, and not written to any sheet or database. If you close the page, the answers are gone.

Registering your interest

If you fill in the interest form after the self-check, we store your name, age range, email, telephone number, whether you signed up as an individual user or as a wellbeing practitioner, your preferred way of being contacted, and your consent with its timestamp. We never attach your self-check answers to it.

Practitioner and coach accounts

If you apply as a mental health practitioner, certified coach or accredited wellbeing practitioner, we may ask for your registration or accreditation details to check that you qualify. We keep that only as long as your practitioner application is active.

Cookies and tracking

This website uses no advertising cookies and no cross-site trackers. We store your language choice in your browser so the site opens in the language you picked. We do not build profiles of visitors and we do not sell traffic data.

International transfers

Our form storage runs on Google services, so your details may be processed outside the European Economic Area. Where that happens, the transfer relies on the European Commission's standard contractual clauses.

Security

Data is sent over encrypted connections, storage is restricted to accounts that need it, and access is protected with two-factor authentication. No system is perfect, so if a breach affects your data we will tell you and the relevant authority as required by law.

Children

On Story is for adults. It is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us data, email us and we will delete it.

Sharing with others

We do not sell your data, and we do not share it for advertising. The only third parties involved are the service providers that help us run the site and the mailing list, and they act on our instructions only.

Automated decisions

The self-check score is calculated by a fixed formula and shown to you as information. It makes no decision about you, it is not a diagnosis, and no person or system acts on it.

Complaints

If you are unhappy with how we handle your data, write to us first at hello@on-story.com and we will try to put it right. You also have the right to complain to your national data protection authority.

Changes to this policy

If we change how we handle data, we will update this page and change the date at the top. If the change is significant and you are on our list, we will tell you by email.

The app itself

On Story is preventative and privacy-first. Reflection entries are yours. We do not use them to train models, and we do not sell them.