Privacy Policy

Last updated 1 September 2026

StoryPoint is a mobile app that shows local history, cultural heritage and heritage trails based on where you are. This policy explains what information we process, why, and what rights you have.

1. Data controller

Northern Lights Web AS (Norwegian org. no. 930 905 771) is the data controller for personal data in StoryPoint. Contact us at [email protected].

2. What information we process

• Account details: email address and password (stored encrypted as a hash), plus your name and profile picture if you choose to add them. Parts of the app can be used without an account.
• Location: the app uses your location in the foreground to show nearby points, check in at places and anchor AR content. Location is only shared when you have granted permission in the operating system, and the app does not track you in the background. When you check in or progress through a story, the coordinates for that moment are stored.
• Activity in the app: visits to points, quiz answers, progress on heritage trails, treasure hunts and stories, trading cards you have earned, and content you have unlocked with QR or access codes.
• Usage statistics: events such as a point being opened or a story being completed, tied to an app-generated session. Without a login the statistics are anonymous.
• Camera: the AR features use the camera to show content on top of your surroundings. The camera feed is processed locally on the device only and is never stored or sent to us.

3. Why we process the information

• Providing the service (contract): your account, progress, trading cards and unlocked content are the product itself.
• Location-based features (consent): you control location access in the operating system and can withdraw it at any time.
• Statistics for content partners (legitimate interest): municipalities, museums and other partners see aggregated statistics for their own content, for example the number of visits per point. Partners never see your identity.

4. Where the information is stored

All data is stored with DigitalOcean in Frankfurt, Germany (EU/EEA). Images and media are delivered through DigitalOcean's CDN. We never sell personal data, and we use no advertising networks.

The map in the app is loaded from open map services (OpenFreeMap and CARTO). When map tiles are fetched these services see your IP address, as all web services do when handling a request.

5. How long we keep it

The information is kept for as long as you have an account. If you delete your account (from the profile page in the app, at storypoint.no/delete-account, or by contacting us) your account, login sessions, visits, quiz answers and memberships are deleted permanently. Usage statistics are detached from your identity and kept in anonymized form only. Content you have created on behalf of an organization belongs to the organization and remains, but without any link to you.

6. Your rights

You have the right to access, rectification, erasure, restriction and data portability under the General Data Protection Regulation (GDPR). Contact us by email and we will respond without undue delay. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).

7. Children

StoryPoint can be used by school pupils, for example as part of a school activity. Creating your own account requires that you are at least 13 years old. Children under 13 can use the app without an account, in which case no personal data about them is stored.

8. Changes

If we make significant changes to this policy we will notify you in the app. The current version is always available on this page.

9. Contact

Northern Lights Web AS
[email protected]