Privacy policy

Privacy Policy and Notice at Collection

Effective Date: October 1, 2026

Stone Kite Inc., a Delaware corporation ("Stone Kite," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy and Notice at Collection ("Privacy Notice") describes how we collect, use, disclose, and retain personal information when you use our corporate website, the Stone Kite fan platform, our online store, and related services (collectively, the "Services").

A separate, shorter notice covers our official Discord server. If you join our Discord community, please also read the Discord Member Privacy Notice at https://store.stonekite.com/pages/discord-member-privacy-notice. Our Cookie Notice describes the cookies and similar technologies used across the Services.

This Privacy Notice is drafted to describe the rights available under United States state privacy laws (including the California Consumer Privacy Act, as amended) and under the EU and UK General Data Protection Regulation for visitors located in those regions.

Section 1. What We Collect

We collect the following types of personal information, depending on how you use the Services. We collect this information directly from you, automatically when you use the Services, and from the service providers that operate parts of the Services (such as our sign-in, store, and community providers).

Account Information. When you create an account, we collect your email address and an identifier from the sign-in provider you use (for example, a Google account identifier). We assign your account an internal identifier and a member number, and we record your country based on your signup locale. We ask for your date of birth at signup to determine whether you can hold an account. We keep only an age bracket derived from your date of birth, not the date itself.

Updates Signup Without an Account. If you give us your email address on a "notify me" or waitlist form, we hold that address, your consent choice, the version of the consent text you were shown, and a timestamp. Nothing else.

Reading Activity. When you read on the platform, we record which pages you view, how long you spend, and your reading progress (including panel-by-panel progress in guided mode); session summaries describing the shape of each reading session; and daily activity records showing which parts of the Services your account used. We use this to make the product work (for example, resuming where you left off), to measure and improve it, and as described in Section 2. Aggregate statistics derived from reading activity do not identify you.

Orders and Purchases. When you place an order, including the free digital claim, we record the order, the product, the amounts, the payment method type, and the payment provider's name. For shipped orders, we collect your name, phone number, and shipping and billing addresses. This contact information is held in an encrypted vault under a key unique to you, and we do not use it to link accounts, infer identities, or make automated decisions; it exists so we can fulfill your order, support you, and answer data requests. We never receive or store your card number or other payment instrument details. Payments are processed by our store's payment provider, and card data stays with them. If you buy from our store, the store provider assigns you a customer identifier, which we link to your account when the order is tied to your account.

Discord Community. If you link your Discord account, we record your Discord user identifier. Our community tooling records participation metadata only: that you sent a message and in which channel (never the text of the message), reactions, joins and leaves, voice channel state, invite attribution, and audit entries. We never collect or store the text of your Discord messages. The Discord Member Privacy Notice covers this in full.

Website Analytics. We use an analytics service with a per-visitor token that is not your member number or internal account identifier. The token carries across our corporate site, platform, and store so we can understand how visitors move between them. For visitors in the EU and UK, analytics storage remains off until you consent, as described in the Cookie Notice.

Public Social Content (Including From People Who Are Not Our Users). We collect and analyze public posts that mention our stories from platforms such as Bluesky, Reddit, YouTube comments, and news feeds. Authors of these posts may have no relationship with Stone Kite. We use this content to understand public reception of our work. We retain it for 24 months, apply de-identification in our analysis practices, and use automated classification to sort it. No decision producing legal or similarly significant effects is made about anyone based on this analysis.

Consent Records; Logs. Each consent choice you make is stored with the exact version of the text you were shown, the time, and the source, and we keep these records as proof of what was agreed, including after an erasure request. Service logs are kept for 30 days under a standing rule that no personal data enters logs.

What We Never Collect. Payment instrument details. The text of Discord messages. Precise geolocation. Biometric information.

Section 2. How We Use Personal Information

We use personal information to: provide the Services (your account, library, reading position, and orders); improve our products; perform analytics and measurement; personalize and recommend content; conduct research and development; prevent fraud and abuse; provide support; send marketing communications, only where you have consented; and share de-identified, aggregated information (never information that identifies you) with affiliates and partners, including contributors to our stories.

For visitors from the EU or UK, our legal bases are: performance of a contract (providing your account, library, claims, and orders); legitimate interests (product analytics and improvement, fraud and abuse prevention, and understanding public reception of our work, in each case balanced against your rights); consent (marketing communications, non-essential cookies and analytics storage in the EU/UK, and any future ad-audience sharing); and legal obligation (financial record-keeping and responding to lawful requests).

Section 3. Profiling and Automated Decisions

We compute layered measures from your activity: session summaries, daily activity, and aggregate cohort statistics. After launch, we plan to introduce a per-account behavior profile used for prediction and recommendation. We will update this Privacy Notice before that profile is introduced.

No decision with legal or similarly significant effects is made about you solely by automated means. Accounts we know belong to minors are never profiled and never have advertising storage enabled.

Section 4. How Consent Works Here

Consent is separate per purpose: email marketing, ad-audience sharing, and any future profiling choices are distinct. In the United States, the box to receive marketing emails may be checked when you sign up; you can uncheck it before you continue, and you can unsubscribe from any email at any time. Everywhere else, no consent box is pre-checked. Your choice is stored with the version of the text you accepted, and never-asked is recorded differently from asked-and-declined. For EU and UK visitors, analytics storage is off until you consent, and events recorded before consent are not joined to your account if you decline. Consent to analytics or marketing is never a condition of the free digital claim or of any purchase.

Section 5. Minors

You must be at least 13 to create an account. We ask your age neutrally at signup and store only an age bracket. Our Services and content are not directed to children, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it. Known minors are excluded from profiling and advertising storage as described in Section 3. If any of our content is ever directed to children, we will make a verifiable parental consent determination under the Children's Online Privacy Protection Act before it ships.

Section 6. How Long We Keep Personal Information

Reading detail (raw spans): 90 days; only derived summaries are kept after that.

Session summaries, daily activity, cohort statistics: indefinite (aggregate and account-level summaries).

Contact details in the order vault: for as long as your account exists, then destroyed by key destruction; order records survive with your details redacted.

Consent records: retained through erasure as the record of what was agreed and when.

Financial and order records: statutory retention periods; customer detail redacted, transaction record kept.

Email suppression records: not deleted; the suppression record is the proof an opt-out was honored.

Updates-list contacts who never create an account: 24 months from your last consent-bearing interaction, then destroyed except a suppression record.

Discord participation metadata: raw events 12 months; aggregate rollups indefinite.

Website analytics: 14 months at the provider.

Operational logs: 30 days (no personal data enters logs).

Backups: encrypted and retained for a limited period.

Section 7. How We Share Personal Information

We share personal information only with the service providers that operate the Services for us: authentication, cloud hosting and database, web analytics, data warehouse, email delivery, our store and payment providers, and Discord for community features. Each provider receives only what its role requires and is subject to contractual privacy and security requirements. A current list of our providers is available on request.

We do not sell your personal information. Syncing marketing audiences to advertising platforms is "sharing" under California law; we do not do this today, and we will not do it without your separate ad-sharing consent. You can opt out of sale or sharing at any time through the request channel described on our Your Data Rights page at https://store.stonekite.com/pages/your-data-rights.

We may also disclose personal information to comply with law or lawful requests, to enforce our Terms, to protect the rights, safety, and property of Stone Kite, our users, or others, and in connection with a merger, acquisition, financing, or sale of assets, to the extent permitted by law.

Section 8. Notice at Collection (California)

The categories of personal information we have collected in the preceding 12 months (and collect today), the purposes, and the categories of recipients are: identifiers (email address, sign-in provider identifier, member number, Discord user identifier, IP-derived country) - collected from you and our providers, used for the purposes in Section 2, disclosed to the service providers in Section 7; commercial information (orders, claims, entitlements) - same purposes and recipients; internet or other electronic network activity (reading activity, session and daily summaries, analytics events, Discord participation metadata) - same purposes and recipients; customer records (name, phone, shipping and billing addresses, for shipped orders) - order fulfillment and support, disclosed to our store and fulfillment providers; and inferences (session and cohort-level measures; account-level profiles only as described in Section 3). Retention for each category is stated in Section 6. We do not sell personal information and do not share it for cross-context behavioral advertising without consent; we do not collect sensitive personal information as defined by the CCPA.

Section 9. International Transfers

We operate from the United States, and information we collect is processed in the United States. Where personal information moves from the EU or UK to the US, we rely on adequacy decisions (including the EU-US Data Privacy Framework where a provider is certified) or standard contractual clauses with each provider.

Section 10. Your Rights

Depending on where you live, you have the right to: access the personal information we hold about you (including a machine-readable export); correct inaccurate information; delete your information; object to certain processing, including profiling; portability; and, under California law, to opt out of sale or sharing and to not be discriminated against for exercising your rights. EU and UK visitors also have the right to withdraw consent at any time and to lodge a complaint with a supervisory authority.

Our Your Data Rights page at https://store.stonekite.com/pages/your-data-rights describes how to submit a request, how we verify it, and how long it takes. We respond to verified requests within one month (GDPR) or 45 days (CCPA), with extensions where the law allows and notice to you if we need one.

What erasure reaches, stated plainly: erasure works by destroying your personal encryption key, which makes your personal data permanently unreadable in our production systems. Some things survive erasure by design or by law: consent records; email suppression records; transaction records held under financial record-keeping requirements (with your personal detail redacted); and content held by Discord itself - the text of messages you posted on Discord belongs to Discord, not us, and unlinking removes our connection and our participation metadata but does not delete anything Discord holds.

Section 11. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption of order contact details under per-person keys, exclusion of personal data from our transaction ledger and operational logs, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Section 12. Changes to This Notice

We version this Privacy Notice. Your consent records reference the version you were shown, so a later change never silently rewrites what you agreed to. We will announce material changes on the platform before they take effect.

Section 13. Contact Us

Privacy questions and requests: privacy@stonekite.com. Postal: Stone Kite Inc., PO Box 858, Santa Monica, CA 90406, United States.