Privacy Policy
Last updated: 14 October 2026
Nestor.gg ("we") runs DotStories and is responsible ("controller") for the personal data described here. We collect as little as possible, never sell it and never use it for advertising.
1. What we use, and why
| Data | Why | Legal basis |
|---|---|---|
| Email, username, password (stored only as a secure hash), profile picture | Your account and logging in | Contract |
| Name, email and picture from Google, GitHub or X, if you log in with them | Creating your account from that login | Contract |
| 6-digit codes (kept 10 minutes) and password-reset links (30 minutes) | Checking your email address and resetting your password | Contract |
| Comments, likes, saved dot settings (prompt, seed, version), files you upload | Showing them on DotStories and keeping your setup on every device | Contract |
| View counts per dot | Showing how popular a dot is. We only store totals, not who viewed. | Legitimate interest |
| IP address, browser and request details, handled by our host Cloudflare | Delivering the site, security, stopping bots and abuse. Logs are kept for a few days. | Legitimate interest |
| Emails you send to info@dotstories.com, and reports | Answering you and handling reports | Legitimate interest / legal obligation |
2. What we don't get
Dots run in the DotStories app on your own computer. What you make with them (images, music) stays on your computer and is not sent to us. The app downloads software and AI models directly from their sources, such as Hugging Face and PyPI, which see your IP address like any download.
3. Who processes data for us
- Cloudflare (hosting, database, file storage, security, email forwarding). Our database runs in Western Europe and uploaded files are stored in the EU. Cloudflare is a US company; where data is handled outside the EU (for example while delivering pages worldwide), the EU-US Data Privacy Framework, the EU adequacy decision for the UK and the EU Standard Contractual Clauses apply.
- Zoho (ZeptoMail), EU data center: sends the verification codes and password-reset emails.
- GitHub: hosts our open source code and the app downloads.
- Google, GitHub or X: only if you choose to log in with them; their own privacy policies apply.
They only process data on our instructions, under data processing agreements.
4. How long we keep it
Your data stays until you delete your account (Profile → Delete account). Then we remove right away your email, name, picture, password, logins, likes, saved setups and uploads, and the text of your comments (they show as "[deleted]" so replies from others stay readable). What is left is an anonymous placeholder ("Deleted user") that no longer identifies you. Your email, username and social logins are kept only as a one-way hash (a code that can't be turned back into them), so they can't be used for a new account: nobody can pose as you, and banned users can't come back (legitimate interest). Copies in backups are gone within 30 days. We only keep what the law requires, for as long as it requires (for example records of sales and purchases: 7 years, Dutch tax law). Codes and reset links expire after 10 and 30 minutes.
5. Your rights
You can ask to see, correct, delete or receive a copy of your data, object to or limit how we use it, and withdraw consent. Email info@dotstories.com from the address of your account; we answer within one month. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
6. Security
Everything goes over HTTPS, passwords are stored only as salted hashes, the database runs in Western Europe, files are stored in the EU and access to data is limited to what is needed to run DotStories.
7. Age
DotStories accounts are for people aged 16 and over. If we learn that a younger person has an account, we delete it.
8. Cookies
We only use cookies and browser storage that DotStories needs to work, no tracking or advertising. See the Cookie Policy.
9. Changes
If we change this policy in an important way, we tell you on the site or by email.
Contact
Nestor.gg, sole proprietorship (eenmanszaak)
Mercatorplein 36D, 1056 CL Amsterdam, the Netherlands
KvK (Dutch Chamber of Commerce): 94770662 · VAT: NL005107992B34
Email: info@dotstories.com