Here is what we know. It is not a policy yet.

What the internal build currently does

• Precise walking location and the accepted route trace are handled on the iPhone for navigation, resume, and the local Library. Apple and MapKit may process route endpoints to provide maps and walking directions. Current story, narration, cover, Daily-comparison, and optional analytics requests do not include route geometry.
• Cloud story creation, ElevenLabs narration, generated-cover processing, and Daily-choice contribution are separate controls that default off. Optional pseudonymous product analytics is a fifth, separate, off-by-default choice.
• The app can delete one completed story or all local app data. Its story-history export omits precise coordinates, audio, cover files, the active checkpoint, and the analytics identifier.
• Learned walking pace stays local. The build stores aggregate timing evidence for resume and discards raw pace samples rather than uploading them.

Short-lived protection for Daily and optional analytics

This protection is approved for the next backend update and is not a claim about the currently deployed service. It takes effect only after that update is deployed and verified.

• Daily and optional analytics endpoints will use a keyed, one-way network identifier to limit abuse. The identifier rotates hourly and the rate-limit record expires within 1 hour. Separate global request counts expire within 24 hours and contain no network identifier. This is a short-lived anti-abuse identifier, not anonymous data or a permanent device identifier.
• The limiter does not retain the raw IP address, put either the IP address or network identifier in product events or application logs, or use the identifier to join Daily choices to analytics events. Infrastructure providers may separately process network information to deliver and secure requests.
• This request protection is separate from product analytics consent. Optional product analytics remains off by default, and neither analytics nor Daily requests include the walking route or precise location.

Private generation recovery

These retention controls are implemented in the generation-reliability update. They apply to new requests after that backend update is deployed, not retroactively to earlier failed attempts.

• The exact generated response, which can contain story prose, is kept privately for up to 7 days so an operator can recover a paid result after validation or delivery fails. It is separate from ordinary application logs, has no public recovery endpoint, and is not published to the Library by being retained.
• A separate private generation receipt is retained for up to 180 days for reliability and cost reconciliation. It records technical identifiers, outcome, timing, model, available token usage, and quota exposure; it does not contain the premise, prompt, or story prose. An unknown cost remains unknown rather than being reported as zero.
• These are Booka recovery-store limits, not a claim about AI-provider retention, backups, published Library releases, or account deletion. Those have separate operating and policy requirements.

Approved private narration recovery update

The owner has approved a private recovery store for generated narration, with recovery access for up to 7 days. It is implemented and tested locally, with final rollout qualification still required; this is not a claim about the currently deployed service.

• The store is intended to recover an already-paid narration result after interruption or restart without automatically buying another synthesis. Retention does not publish the audio, grant another listener access, or make a protected preview an offline download.
• This Booka recovery limit is separate from audio deliberately saved to the local Library and from ElevenLabs or infrastructure-provider retention. At the seven-day limit, recovery access ends and audio becomes eligible for the next daily cleanup; failed cleanup can delay physical deletion. Separate no-audio receipts remain for up to 180 days to prevent uncertain or expired identical account/content purchases from being repeated automatically. Server cleanup and final deployed behavior must be verified before the public policy describes this as active.

Local test diagnostics in updated internal builds

The diagnostic packet is implemented for the next qualified internal app build; it is not included in Build 15. It is separate from optional product analytics and is never uploaded automatically.

• The iPhone keeps at most the latest 50 test attempts for a rolling 30 days. Limits are enforced when the store is loaded, written, or exported. Packets contain technical request and story identifiers, engine version, outcome, and available aggregate measurements—not story titles, prose, premises, choices, precise GPS, account details, credentials, or provider-response bodies.
• Profile offers an explicit JSON export for sharing a test packet. Sharing is your action; the app removes its temporary export when the share sheet is dismissed. The copy you choose to send is controlled by the destination you select.
• Clear test diagnostics removes the local diagnostic store and temporary exports. Delete All Local Data removes them too. Missing audio-gap or narrated-duration measurements are labeled unknown, not inferred.

Creator Suite storage

• Creator access uses Sign in with Apple and Supabase Auth. Supabase processes an account identifier and session data so the site can check an invite-only access list. The site does not use an Apple relay email or profile field as the durable authorization key.
• Ordinary Creator drafts, edits, autosave, and named snapshots stay in this browser. They do not send prose to an AI model, voice service, image service, or analytics service. The active owner’s separate, disclosed Create review revision action copies a frozen draft and declarations to Booka’s private publishing service.
• Prepare voice and cover is another deliberate owner action. After approval, the exact frozen story text and selected voice pass through Booka to ElevenLabs, and the approved cover is uploaded to Booka. Booka stores the prepared audio and cover for the private release. Preparing this media does not send the manuscript to a prose-writing model or automatically add it to the listening Library.
• Story Lab is a separate, explicitly approved text-generation workflow. When enabled, the selected setup and any supplied premise pass through Booka and Vercel AI Gateway to OpenAI. Its private job records and results are separate from browser-local drafts and are not public merely because generation finished.
• Signing in does not move a draft between browsers or from the earlier prototype address. A creator must deliberately export and import a draft file to move it.
• A creator can download a versioned JSON draft or Markdown review file. Import is limited to a 2 MB JSON package and is treated as untrusted and unreviewed.
• Clearing browser storage can remove drafts. Deleting a browser-local draft does not erase a separately created immutable review revision or published release. Private review and owner-preview access do not enable public Creator uploads or self-publishing.

What must be settled before publication

The public policy still needs verified operator and contact details, launch territories and audience position, exact server and provider retention, vendor terms, backup behavior, App Store privacy answers, account export, deletion and revocation behavior, and owner or counsel approval. Until those are complete and tested against the release build, this page is only an engineering status record.