Legal

Privacy Policy

Effective May 8, 2026 · Sandstories LLC, an Oklahoma single-member limited liability company

Sandstories is built around the principle that the best privacy is the privacy you don’t have to trust. The platform collects almost no information about you, and none about your clients. This Privacy Policy explains what little we do collect, why, and what we do with it.

Our promise to your clients

No client login. No tracking. Nothing about your clients ever touches our servers.

1. What we collect

Email address — provided at purchase. Used to send your license key, refund confirmations, and (rarely) critical security notices about the platform. Never used for promotional emails without your separate opt-in.
Stripe payment metadata — name, billing address, last four digits of card, transaction amount. Held by Stripe, not by Sandstories. We see only what Stripe shows in the merchant dashboard.
License activation records — when your license is first activated on a device, a randomly-generated device identifier is stored against your license key so we can enforce your tier’s device limit.
Optional support correspondence — anything you write to us at Hello@sandstories.app, kept for as long as is needed to resolve your issue.

2. What we do not collect

Anything about your clients. Sandstories is PHI-free by design — see the PHI-Free Use Statement for details.
Session content. The figures you place, the sand you shape, the notes you type — none of this leaves your device.
Browsing behavior, analytics events, page views, click trails, or anything else that would let us reconstruct what you did inside the platform.
Your IP address (beyond the temporary, automatic logging done by our hosting provider for the purpose of delivering the page).
Data from third-party trackers, advertising pixels, or social media widgets. Sandstories does not embed any of these.

3. Cookies and local storage

Sandstories uses your browser’s localStorage to remember your license key and your device ID across sessions. This is not a tracking cookie — it is a local file stored on your device that only the Sandstories app on that same device can read. You can clear it at any time through your browser’s settings.

4. Who we share data with

We use these third-party providers:

Stripe — for payment processing
SendGrid — for sending license-key emails
Netlify — for hosting the platform

Each of these providers has signed a data processing agreement and is contractually prohibited from using your information for their own purposes. We do not sell your data, ever, to anyone.

5. Your rights

You may at any time:

Request a copy of all data we hold about you.
Request that we delete your data, subject to any legal retention requirements.
Request that we correct any inaccurate data.

To exercise any of these rights, email Hello@sandstories.app.

6. International users

Sandstories is hosted in the United States. If you use the platform from outside the U.S., you understand that your information will be transferred to and processed in the U.S. We do our best to honor data-protection laws of every jurisdiction we serve.

7. Children

Sandstories is purchased by licensed practitioners — adults — for use in their professional practice. The platform itself does not collect any information from minor clients. Practitioners using Sandstories with minors must follow their own jurisdiction’s consent and privacy requirements.

8. Changes to this Policy

Material changes will be communicated by email to the address on file with your license. The current version is always at sandstories.app/privacy.html

9. Contact

Privacy questions? Email Hello@sandstories.app

The complete Sandstories Clinician Legal Pack—including the PHI-Free Use Statement, Terms of Service, Privacy Policy, Acceptable Use Policy, and FERPA Compliance Notice—is available as a single, portable PDF for your records.

Download Clinician Legal Pack (PDF)

Note: This document is provided for informational purposes and does not constitute legal advice.