Privacy notice

StoryMap is built and operated by Kriasoft, which is responsible for the data described here and is the contact point for questions about it.

Legal entity name and registered address: Kriasoft by Konstantin Tarkus, 444 Alaska Ave, Ste 13750, Torrance, CA 90503, USA.

Six categories, and no others:

Account information

The identity you sign in with — an email address, and a name and avatar if your sign-in method provides them — plus the StoryMap workspace your account belongs to.

Your Linear connection

The access token issued when you authorise StoryMap, and identifiers for the Linear workspace and team you connect, so we can read the issues that belong on your board.

Issue data from Linear

Titles, identifiers, statuses, assignees, estimates, cycles, projects and labels, read so that cards can be drawn and placed. What is kept versus read on demand is section 4.

Your map

The structure StoryMap adds: boards, journey columns, release slices, and where each issue sits. The review tray is not stored — it is simply the issues Linear returns that have no place on the board yet.

Technical records

Request and error logs produced while you use StoryMap, including IP address and request metadata, kept to run the service and investigate faults and abuse. Linear also notifies us when something changes in a connected workspace; those notifications carry the type of change and the workspace id, and are logged.

Billing and support

The subscription state of a workspace, and whatever you send us when you get in touch. Card details are handled by our payment provider and never reach StoryMap.

StoryMap uses cookies needed to sign you in and keep the session secure, including short-lived cookies while an external sign-in is in progress. A separate cookie records only thatsomeone is signed in, so the edge knows whether to serve the marketing page or your board. Product analytics runs with memory-only persistence and writes neither a cookie nor a browser-storage entry, and this marketing site keeps one local-storage entry: whether you chose the light or dark theme. There is no advertising or cross-site tracking.

Analytics is three events — starting a Linear connection, building a board, and starting checkout. There is no page-view tracking, no autocapture and no session recording. The properties StoryMap attaches to an event can only be numbers and booleans, which is enforced in the code, so no issue title or other text of yours can travel with one. Alongside that, an event carries your account identifier, an opaque identifier for the workspace, and the standard metadata the analytics library collects itself, such as the page address, browser and IP.

To sign you in; to read your Linear workspace and draw your board; to keep your map and its placements; to keep the board current as issues change in Linear; to bill a paid workspace; to answer support requests; and to keep StoryMap reliable and secure. We do not use your data to build advertising profiles, and we do not sell it.

This is the boundary the product is designed around: Linear owns the issues, StoryMap owns the map.

Issue content is read from Linear to render your board rather than maintained as a second copy of your backlog, and our database has no table for it: what it holds is boards, columns, slices, placements, and account and subscription rows. Those rows are read through a connection pooler that may briefly cache query results, which caches our own tables and never Linear content.

Issue content does live, briefly, in the browser drawing the board: the page keeps what it read for about two minutes before asking Linear again, and closing the tab ends it.

A board opened through a read-only share link is the one place a copy may sit on our side. Anyone holding the link can open it, and each opening would otherwise re-read the board out of Linear, so the drawn board may be held at our edge for up to a minute and reused. It expires by itself, it is never written to our database, and it is only ever the cards that were placed on the board — not the rest of the backlog. Revoking the link stops it working at once: the link is checked against our database on every request, before any held copy is used.

None. StoryMap asks Linear for the read scope and nothing else, so the access you grant cannot create, edit, move, reassign or close an issue even if we wanted it to.

Arranging a board is therefore a change to your map, not to your workspace: moving a card between cells moves the card. Linear notifies us when a connected workspace changes, so that boards can stay current. A notification about an issue or a person marks the boards built from that workspace as due a fresh read; one telling us access was revoked discards the Linear tokens we hold for it. We keep none of the issue content those notifications carry — an open board goes back to Linear and reads it again.

Running StoryMap means other companies handle some of this data, each for the purpose named below. Most act on our instructions; where a provider has its own legal responsibilities — Stripe's for payments and fraud is the clear case — it also handles that data under its own terms, which its own notice describes.

Cloudflare

Hosting, the edge network that serves this site and the app, and the request and error logs it produces. A board opened through a read-only share link is also held there briefly — see section 4.

Neon

The PostgreSQL database holding accounts, boards and placements.

Stripe

Payment processing. Stripe is also the merchant of record for StoryMap subscriptions, so it sells the subscription, calculates and remits tax, and appears on your receipt and statement as Link.

Resend

Transactional email — sign-in codes and account mail.

PostHog

Product analytics, on its EU cloud. Three events, described in section 2.

OpenAI

The optional step that names and orders the journey columns on a first board. When it runs, a compact summary of the board being built is sent to the model — the groups your issues fall into, how big each one is, a sample of shortened issue titles, and for issues that fall into no group, their identifier and shortened title — and what comes back, the column names and which column an issue belongs in, becomes the first draft of your map, which is stored. The issue text itself is not. It is never required: without it the board is built from your workspace's own projects, labels and links.

Google

Fonts for the app interface are served from Google, so loading the app tells Google your IP address and browser. Google also authenticates you if you choose to sign in that way.

Linear itself is the source of your issue data, and your workspace is governed by your own agreement with Linear rather than by this notice. StoryMap is not affiliated with Linear.

Where each provider stores and processes data: the database is in Neon's AWS US East 2 region (Ohio) and email is sent from Resend's AWS US East 1 region (Northern Virginia), both in the United States. PostHog is on its EU cloud. Cloudflare serves the site and the API from its global network, so a request is handled near you. Stripe handles payment data under its own privacy policy — we never see a card number. The optional OpenAI step runs under OpenAI's API terms, and its region follows the data-residency setting on our OpenAI project rather than a fixed country, so it is not named here.

Your account, boards and maps are kept for as long as your account exists, because they are the product. Revoking StoryMap in Linear ends our access to it. There is no self-serve delete button yet, so account deletion is a request we carry out by hand — write to us and we will remove the account and the maps it holds. Neither touches anything in Linear.

Request logs are kept for 30 days and database backups for 30 days. When you ask us to delete your account, it and the maps it holds are removed within 30 days.

Access to your workspace is granted by OAuth rather than by handing us credentials, the token is stored to read the issues on your boards and nothing else, and it can be revoked from Linear at any time. Traffic is encrypted in transit, and access to production systems is limited to the people who operate StoryMap.

We hold no security certifications and claim none. If you find a vulnerability, write to us at the address in section 12 before disclosing it publicly.

You can cut off our access to Linear at any time: Settings has a disconnect that discards the token we hold for you, and revoking StoryMap in your Linear workspace's application settings does the same for everyone on the workspace — we discard the tokens when Linear tells us it happened. Either way our access ends at once, and any token still in flight expires within a day. The shared-link copy described in section 4 expires by itself within a minute; the copy in a browser already drawing a board lasts as long as that tab does, because it is in the page rather than on our servers. After that your boards keep their layout and stop showing issue content until the workspace is reconnected. You can also ask us for a copy of what we hold about you, ask for corrections, or ask us to delete your account and its maps. Write to the address in section 12 and a person will answer.

You choose what appears on a board, StoryMap only ever reads what it points at, and revoking it in Linear ends that access. Your account details — the identity you sign in with, the workspace it belongs to, and the events in section 2 — are used only for the purposes in section 3. Which statutory rights you have depends on where you are; write to us and we will honour any that apply to you.

StoryMap is a tool for software teams. It is not intended for anyone under 16, it is not directed at children, and we do not knowingly collect data from them. If you believe a child has given us data, write to us and we will remove it.

When StoryMap's data practices change, this page changes with them and the date at the top is updated. For a change that materially affects how we handle your data, we will tell account holders directly rather than relying on you to notice the edit.

Questions about this notice, or a request about your data, go to hello@storymap.cc. It reaches the people who build StoryMap.