StorySub

Security

Updated October 9, 2026

Security starts with knowing where your content is and who can access it. Here are the measures StorySub uses.

Sign in with Apple

The app uses Sign in with Apple. The server verifies the received identity's signature, audience, and validity and uses a one-time challenge to finish sign-in. StorySub never receives your Apple password.

Protected sessions

Your app access token is stored in the iPhone Keychain. On the server, a hash identifies the session, which has a limited lifetime and can be revoked. Credentials needed to revoke Apple sign-in access are stored encrypted.

Files and processing

Public communication uses HTTPS. Copies in object storage use temporary signed URLs. Editing requests are linked to your account, and task access requires specific credentials. Cloud editing requires authorized servers and providers to process your content; it is not end-to-end encryption.

Server-verified purchases

Your balance is calculated on the server. Purchases are validated using Apple signatures and the App Store Server API, linked to your account, and recorded once. Submitting the same transaction again does not generate more credits.

Control over your account

Go to Projects → My account to change your name, check credits, sign out, or delete your account. Pro access is an authenticated, logged administrative action. There is no hidden gesture to unlock processing.

Report a problem

If you find a possible security problem, email [email protected] with a description and steps to reproduce it. Do not send passwords, session tokens, or other people's files. No service can promise zero incidents; we investigate reports to fix issues and protect users.