In PlaceStories you can set a story's general visibility to "private", which means it is only visible to a given user via projects or communities that it is published to. Thus, the visibility of the story inside the project or community will then ultimately decide if a given user can see the story or not.
There was a bug in the system whereby a story whose general visibility was "private", but was published into a project, wasn't visible to any members of the project (apart from the creator). This is wrong and has been fixed.
Also, we are considering changing the term "private" (as applied to a story's general visibility) to something more logical like "controlled".