Privacy Policy

Effective date: 14 October 2026

1. Who we are

Opera Storybooks is provided by Intuitive Data AS (organisation number 933 001 121), Underlandsveien 98, 1389 Heggedal, Norway. Intuitive Data AS is the controller of the personal data described in this policy.

Contact: contact@intuitivedata.no

2. Scope

This policy applies to the Opera Storybooks mobile application, its account and subscription services, its public legal and support pages, and communications with our support team. It does not govern Apple, Google, Spotify or other independent services that you choose to use.

You may browse the catalogue, read the free preview, and purchase, restore and use Premium in the mobile app without creating or signing in to an Opera Storybooks account. An email account is optional for sharing verified access across devices and platforms. Store purchases and restoration use your Apple App Store or Google Play account.

3. Data we process

Store access without an email account

The mobile app creates a random technical identifier and authentication session without collecting an email address, name or password. Supabase stores this session and RevenueCat uses its random identifier to verify store purchases. Session credentials are stored securely on the device. If you voluntarily sign in, we associate this store identifier with your verified email account for access on other platforms. Signing out does not cancel the subscription or remove the store session. After reinstalling, use Restore purchases with the same store account.

Optional account data

When you create an account, we process your email address, a generated account identifier, email-verification status, authentication tokens and security records needed to operate and protect the account. Sign-in normally uses a one-time code sent by email; an optional password sign-in is also available. Supabase handles account authentication and password verification. Resend delivers email verification and sign-in codes, processing the recipient email address, authentication-email content and delivery records. We do not ask for a profile name or postal address inside the app.

Subscription and transaction data

When you purchase or restore Premium, Apple App Store or Google Play processes the payment. We do not receive or store your full payment-card details. We process the generated account identifier, store and product identifiers, subscription period, entitlement status, purchase and expiry times, renewal status, and limited event identifiers needed to verify access, handle refunds or transfers, prevent duplicate entitlement and support you.

RevenueCat processes purchase receipts or purchase tokens, device and operating-system information, transaction information, last-seen information and our generated account identifier to validate and synchronize subscription access. We do not send your email address to RevenueCat as its App User ID.

App activity stored on your device

Reading position, reading history, favourites, display theme, typeface and text-size preferences are currently stored locally on your device. They are not uploaded to our account database. Removing the app may remove this local data. Account deletion clears account-related local reading state on the device where deletion is performed.

Technical and support data

Our hosting and security providers may process IP address, request time, endpoint, response status, device or browser information and similar technical records when the app or a public page connects to the service. We use these records to deliver content, secure the service, diagnose faults and prevent abuse.

If you contact support by email or through our support form, we process your email address, request category, subject, message, an automatically generated support ID, and any optional platform or app-version information you provide. We use this information to deliver, confirm, investigate and answer your request. Please do not send passwords, one-time codes, full payment-card details or unnecessary sensitive information.

The support form sends the request and its confirmation through Resend to our Zoho-hosted support mailbox. For the first release, the email correspondence and support ID are the case record; we do not create a separate support-case database.

The current release does not contain third-party advertising, cross-app tracking or a general-purpose analytics SDK. We do not sell personal data or share it for cross-context behavioural advertising.

4. Why we process data and our legal bases

We process account, authentication and entitlement data because it is necessary to provide the service and perform our contract with you. We process security, minimal service logs, fraud prevention and service-improvement information for our legitimate interests in operating a reliable and secure service, balanced against your rights. We process records when necessary to comply with law and to establish, exercise or defend legal claims. Where law requires consent for an optional future feature, we will ask before enabling that processing.

5. Recipients and service providers

We use suppliers only for defined operational purposes:

• Supabase provides the hosted database, authentication, storage and server functions.
• RevenueCat validates and synchronizes subscription status.
• Apple and Google operate their respective app stores, accounts, payments, refunds and subscription management.
• Resend delivers account verification and sign-in emails, transmits support-form messages to our support mailbox and sends the automatic support confirmation email.
• Zoho hosts our business support mailbox and the resulting correspondence.
• Spotify receives information directly from your device only when you choose to open a Spotify link. Spotify access is separate from Opera Storybooks Premium.

These providers process data under their own terms where they act independently and under contractual data-protection commitments where they process data for us.

6. International transfers

Intuitive Data AS is established in Norway, which participates in the EEA data-protection framework. Some providers or subprocessors may process data outside Norway or the EEA. Where required, transfers rely on an adequacy decision, the EU Standard Contractual Clauses or another lawful safeguard. You may contact us for more information about applicable safeguards.

7. Retention

Account data is retained while your optional email account exists. Deleting it removes the email account, its account links and account entitlement records, and requests deletion of its corresponding RevenueCat customer profile. The separate technical store session and its verified purchase record remain available for account-free access and restoration while needed to provide the subscription. For deletion of technical store data, contact support; we may request a store order reference to verify ownership. Minimal billing-event identifiers may be retained without your account identifier where needed to prevent replay, reconcile transactions or document system integrity.

Security and infrastructure logs are retained according to limited operational and provider retention settings, unless a longer period is necessary to investigate abuse or comply with law. Support correspondence, including its support ID, is normally retained in our business mailbox for up to 24 months after the request is closed. Resend may retain limited delivery and service logs according to its configured service and legal obligations. Records or purchase records controlled independently by Apple or Google follow their policies and legal obligations. Provider backups may retain residual copies for a limited period before scheduled deletion.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, and to receive data you provided in a portable format. You may withdraw consent where processing relies on consent. You may also complain to a competent supervisory authority.

You can delete your Opera Storybooks account in the app under Settings, Account, Delete account. Deleting the account does not cancel an App Store or Google Play subscription. Manage or cancel the subscription in the store first if you want billing to stop. A web-based deletion route is also provided in our Account Deletion page.

To exercise another right, email contact@intuitivedata.no. We may need to verify that the request concerns your account. In Norway, you may complain to Datatilsynet after first giving us an opportunity to address the matter.

9. Children

The service is not designed to collect personal data from children without appropriate authorization. A person under 16 should create an account or purchase only with permission and involvement from a parent or legal guardian. The free preview can be used without an account. If you believe a child provided personal data improperly, contact us so we can investigate and delete it where required.

10. Security

We use access controls, row-level database policies, short-lived media links, server-side entitlement verification and encrypted network transport. No system is completely secure. Keep access to your email account protected because email codes can be used to sign in.

11. Changes

We may update this policy when the service, suppliers or law changes. The current version and effective date will remain available here. We will provide additional notice when required for a material change.