Privacy Policy

Effective June 30, 2026 · Sandstories LLC, an Oklahoma single-member limited liability company

1. What we collect

• Email address — provided at purchase. Used to send your license key, refund confirmations, and (rarely) critical security notices about the platform. Never used for promotional emails without your separate opt-in.
• Stripe payment metadata — name, billing address, last four digits of card, transaction amount. Held by Stripe, not by Sandstories. We see only what Stripe shows in the merchant dashboard.
• License activation records — when your license is first activated on a device, a randomly-generated device identifier is stored against your license key so we can enforce your tier’s device limit.
• Optional support correspondence — anything you write to us at Hello@sandstories.app, kept for as long as is needed to resolve your issue.

2. Information from Shop orders

When you buy from the Sandstories Shop, we collect what we need to fulfill your order: your name, shipping and billing address, email address, and the contents of your order. Payment card details are entered with and held by Stripe — we never see or store your full card number. We keep a record of your orders for accounting, tax, and customer-service purposes.

3. What we do not collect

Inside the virtual tray, and during the sessions you run, we still collect nothing about your clients:

• Anything about your clients. Sandstories is PHI-free by design — see the PHI-Free Use Statement for details.
• Session content, for our own use. The figures placed, the sand shaped, the notes typed are never stored or analyzed by us. In a shared telehealth session this content passes between you and your client in real time over an encrypted connection and is discarded when the session ends.
• Browsing behavior, analytics events, page views, click trails, or anything else that would let us reconstruct what you did inside the platform.
• Your IP address (beyond the temporary, automatic logging done by our hosting provider for the purpose of delivering the page).
• Data from third-party trackers, advertising pixels, or social media widgets. Sandstories does not embed any of these.

4. Cookies and local storage

Sandstories uses your browser’s localStorage to remember your license key and your device ID across sessions. This is not a tracking cookie — it is a local file stored on your device that only the Sandstories app on that same device can read. You can clear it at any time through your browser’s settings.

5. Affiliate links

Some pages link to products through affiliate programs, including Amazon Associates. If you follow one of these links, the destination site may set its own cookies and collect information under its own privacy policy. Sandstories receives only an anonymized commission report — never your name, your payment details, or what you personally purchased.

6. Who we share data with

We use these third-party providers:

• Stripe — for payment processing
• SendGrid — for sending license-key emails
• Netlify — for hosting the platform
• Shipping and fulfillment partners — for Shop orders only, the providers who print, pack, and ship your physical products, and the carriers who deliver them; they receive your name and shipping address solely to fulfill your order

Each of these providers has signed a data processing agreement and is contractually prohibited from using your information for their own purposes. We do not sell your data, ever, to anyone.

7. Your rights

You may at any time:

• Request a copy of all data we hold about you.
• Request that we delete your data, subject to any legal retention requirements.
• Request that we correct any inaccurate data.

To exercise any of these rights, email Hello@sandstories.app.

8. International users

Sandstories is hosted in the United States. If you use the platform from outside the U.S., you understand that your information will be transferred to and processed in the U.S. We do our best to honor data-protection laws of every jurisdiction we serve.

9. Children

Sandstories is purchased by licensed practitioners — adults — for use in their professional practice. The platform itself does not collect any information from minor clients. Practitioners using Sandstories with minors must follow their own jurisdiction’s consent and privacy requirements.

10. Changes to this Policy

Material changes will be communicated by email to the address on file with your license. The current version is always at sandstories.app/privacy.html

11. Contact

Privacy questions? Email Hello@sandstories.app