Privacy policy

Last updated 18 October 2026

This explains what we collect, why, and what you can do about it. We've kept it in plain English. If anything here isn't clear, email [email protected] and ask.

Who we are

Since Sunday is operated by Since Sunday. We are the data controller for the information described below.

What we collect

• Your account: your name, email address, and a hashed version of your password. If you sign in with Google, we get your email address, name and Google account id instead - never your Google password.
• What you write: the moments you send for each book and who was in each one, the first names of the children the books are for, and the names of any grown-ups or pets you choose to add.
• Delivery details: the recipient name and postal address for each home you send books to.
• Your mobile number, if you give it: used only to text you a link when a new prompt opens, plus a record of each text we've sent you.
• Payments: a record of what was charged and when, plus Stripe's reference for the card. We never see or store full card numbers.
• Your books: the pages we generate, so you can look back at them in your account.
• Character drawings, if you make them: a description you write of someone, and the drawing we make of them. If you upload a photo to make that drawing, we use it once and then delete it - see below.
• If you apply to be an affiliate: your name, email address, the social media handles and website you give us, roughly how many followers you have, and anything you tell us about yourself. You don't need an account to apply.
• Technical basics: the IP address you signed up and signed in from, and counts of failed sign-in attempts, which is how we keep people from guessing passwords.

Children's information

We deliberately ask for as little as possible: first names only. We don't ask for children's birthdays, schools or anything else about them, and children don't have accounts. We never require a photograph. If you choose to upload one to make a character drawing, it is shrunk and stripped of its metadata (such as location) as it arrives, kept privately only until the drawing has been made - usually a few minutes, and never more than an hour - and then permanently deleted. We keep the drawing, not the photo. Their first names appear on the cover and in the scenes, because that's the point of the book. If you'd rather a book used a nickname, use one - we don't check it against anything.

Why we use it

• To make and post your books, and take payment - we need this to perform our contract with you.
• To keep the service secure - rate limiting, fraud prevention and abuse investigation, which is our legitimate interest in the service not being wrecked.
• To email you about your account - verification codes, password resets, and notices about your plan or these policies. Also part of performing the contract.
• To text you when a new prompt opens - only if you've given us a mobile number and left texts switched on. You can turn them off, or remove your number, in your account at any time - or reply STOP to any text.
• To consider your affiliate application and reply to it - you asked us to, so this is a step towards an agreement with you. We look at the public profiles you point us to. If we work together, we use the same details to run that arrangement and pay you.
• To meet legal duties - keeping records of what we charged for tax purposes.

We don't sell your information, and we don't use it to advertise to you.

Who else sees it

We use a small number of companies to run the service. Each one only gets what it needs:

• Stripe - card details and payment records.
• OpenAI - your moments and the names of the people and pets in them, to draft the scenes for a book, and any description or photo you give us for a character drawing, to make that drawing. Under our agreement they don't use it to train their models. They may keep what we send them for up to 30 days to check for misuse, and then delete it, unless the law requires them to keep it longer.
• Postmark - your email address and the contents of account emails we send you.
• Our text message provider - your mobile number and the text we send, if you've turned texts on.
• Our printing and postal partners - the finished pages and the delivery address.
• Simple Analytics - which pages are visited and where visitors came from, to count visits. It uses no cookies and doesn't collect anything that identifies you.
• Our hosting and network providers - they hold the server and the database, and see traffic in transit.

We'll also hand over information if the law requires it, and we'd tell you if that happened unless we were forbidden from doing so.

Where it goes

Some of those companies are based in the United States. When information leaves the UK we rely on the UK's approved transfer mechanisms - an adequacy decision where one exists, and the UK International Data Transfer Agreement or Addendum where it doesn't.

How long we keep it

• Your account, notes and books: while your account is open.
• After you delete your account: we erase your notes, books and addresses within 30 days.
• Payment records: at least six years after the tax year they fall in, because we have to.
• Sign-in attempt counters: about a day.
• "Remember me" tokens: six months, or until you sign out.
• Photos you upload: deleted from our servers as soon as the character drawing is made, and never kept longer than an hour. OpenAI, who make the drawing, may keep their copy for up to 30 days (see above).
• Character drawings and descriptions: until you remove them, or remove that person from your plan.
• Affiliate applications: if we don't end up working together, deleted 12 months after we last updated them. If we do, kept while we work together, and records of what we paid you kept for six years, like other payment records.
• Backups: fourteen days, after which the copy is gone.

Your rights

You can ask us for a copy of your information, to correct it, to delete it, to send it to you in a portable format, or to object to or restrict what we do with it. Email [email protected] and we'll respond within a month. It's free.

If you think we've got it wrong, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd like the chance to fix it first.

Cookies

We use a session cookie to keep you signed in, an optional "remember me" cookie so you don't have to sign in on every visit, and a token that protects forms from being submitted by other websites. That's it - no advertising or analytics cookies, and we don't track whether you opened our emails. We count visits with Simple Analytics, which doesn't use cookies at all.

How we protect it

Passwords are stored hashed, never in plain text. The site is HTTPS only. Sign-in tokens are stored hashed, so a copy of the database can't be replayed as a login. Backups are taken daily.

Changes

If we change this policy, the date at the top changes, and we'll email you about anything significant.

Contact

[email protected]. Our terms and conditions cover the service itself.