Privacy policy

Information we collect

Account information includes your name, email address, preferences, household memberships and invitations. Email sign-in uses a hashed password. Sign in with Apple provides the identity information Apple shares with us.

Content includes recipes, family Memories, stories, photos, notes, conversation messages and generated results. Assistant memory is a separate set of details used for personalization when you enable it. Other members can provide information about you through invitations, household content or group conversations.

We also process subscription and purchase records, AI usage and allowances, notification tokens and preferences, app-verification data, and product-usage events. Technical logs can contain IP addresses, requested URLs, browser or app information, timestamps and errors. Please only share information about other people when you are entitled to do so.

How we use information and AI

We use information to provide Sunday, save and display content, manage access and subscriptions, deliver requested notifications and essential emails, prevent abuse, understand feature use and provide support. We do not sell your information or show advertising.

AI features send relevant messages, conversation history or summaries, authorized household content and permitted assistant memories to providers for replies, recipes, suggestions and other requested features. Safety checks also process messages. Image-generation features can send recipe photos as reference images. Turning assistant memory off does not stop a conversation from using its own history.

When automatic group participation is enabled, visible group messages and author names can be processed to decide whether Sunday should respond, even when no reply is ultimately posted. Local recommendations can send a place you type or your permitted approximate location, a category and a date to AI and search services. The research tool is instructed to exclude names, private circumstances and family schedules.

Who can see your content

Private conversations are available to their owner, not automatically to household members or administrators. Household recipes, family Memories and shared recipe projects are available within the household according to their access rules. Sunday and its service providers process content as described in this policy.

Group conversations are available to their participants. Adding someone requires confirmation that they will see the full history; starting a fresh group is an alternative. Private chats and unshared personal assistant memories are not included in group context.

Recipe share links expose preview information, such as a title and image, to anyone with the link. The recipe itself still requires sign-in and household access. Uploaded and generated images, including family Memory photos and avatars, are served through direct image links. Someone who obtains an image link may be able to view that file without signing in.

Assistant memory and your choices

Assistant memory is optional. Enabling it allows learning from new private conversations; it does not backfill older chats. Personal details stay private unless you explicitly share them or separately enable automatic sharing for that household. Sharing a detail does not expose its private source conversation. Group exchanges are not automatically learned into assistant memory.

You can review, correct, forget and stop sharing details without a subscription. Turning memory off pauses new learning and personal recall in private chats without deleting saved details. Existing household shares can still be used in groups until you remove the share or forget the detail. Turning automatic sharing off stops future automatic shares; existing shares must be removed separately.

Saved assistant-memory content is encrypted in storage. Temporary details stop being used after expiry. Forgetting a detail removes its saved content but does not delete the original conversation, recipe or family Memory. Deleting a source conversation also forgets details learned from it unless you retain eligible details in the deletion review.

Optional approximate location

Device location requires separate Sunday and device permissions. You can type a city, district or public venue instead. Sunday uses approximate location for the current private-chat request, not background tracking or group conversations.

Temporary coordinates are encrypted, expire after 15 minutes and are cleared when the request completes. They are not added to chat history or assistant memory. A place you type, and location-related text in a reply, remain in the conversation until you delete it. You can revoke permission in Settings.

Service providers and international processing

Our application servers are hosted by Hetzner in the Helsinki region of Finland. External providers also receive information for the functions described below; hosting in Finland does not mean all processing stays in the EU/EEA.

We use services from OpenAI, Google Gemini and TypeSafe to provide Sunday’s AI features. We do not opt customer content into model-training programs. These providers can retain information for operational, safety or legal purposes under their applicable terms.

Postmark processes recipient addresses, email content and delivery information for verification, invitations and other service emails. Apple handles Sign in with Apple, App Store purchases, push delivery and App Attest verification. We receive purchase records needed to manage access, rather than your full payment-card details.

Gravatar, operated by Automattic, provides avatar images. Avatar and account-settings lookups can send a hash of an email address and the requesting device’s connection information to Gravatar. This hash is an identifier, not anonymous information. Opening account settings can check Gravatar availability even when initials or a custom avatar are selected.

Some providers process information outside the EU/EEA, including in the United States. Transfer mechanisms described in the Google and TypeSafe processing terms include European Commission standard contractual clauses and, where applicable, the EU–US Data Privacy Framework for eligible transfers to certified organizations. The mechanism depends on the provider and destination. Contact us for details about a particular transfer and a copy of the applicable safeguards.

Cookies and analytics

The website uses cookies to keep you signed in and remember your household, language and completed introduction. Sign-in, household and language cookies can last up to one year; the introduction preference can last up to five years. Temporary Apple sign-in cookies last up to ten minutes. Your browser or device also stores appearance preferences. You can clear these through its settings, which may sign you out or reset preferences.

We use Pirsch for website statistics. It processes page paths, referrers, browser/device information and approximate city or country. It uses the IP address to derive a daily, site-specific visitor identifier without analytics cookies. Pirsch states that it does not store the IP address or recognize visitors across different websites.

Separately, Sunday records product events such as onboarding progress, recipe views, paywall interactions and purchases. These can be linked to your account and household and include platform, app version, subscription state and allowance information. The defined product-event fields do not include conversation text, recipe content or family Memory content.

Why we may process your information

We rely on our contract with you to provide requested account, content, AI and subscription services.

We rely on consent for optional assistant-memory learning, automatic household sharing and device-location features. You can withdraw it through the relevant controls.

Security, abuse prevention, support and product analytics serve our legitimate interests in operating and improving Sunday. You can object to this processing.

We process records required for accounting or other statutory duties to meet our legal obligations.

Keeping and deleting information

Account content and conversation history are kept so you can return to them until removed through the applicable controls. Deleting a conversation does not delete separately saved recipes or family Memories, or reset used AI allowances.

Account deletion removes your account, access and owned private AI conversation history. Shared household content can remain for other members, and group messages can remain without your account attribution. Deleting a recipe does not necessarily remove its stored image files. Contact us to request removal of a specific file. Copies made by other people are outside these deletion controls.

Usage, billing, product-event and deletion records can remain for accounting, allowance enforcement, security and service analysis. Removing your account removes direct account links from product events, but household-related records can remain. These records do not all have a fixed automatic expiry. Contact us about a specific access or deletion request; legal record-keeping obligations may limit deletion.

App-verification challenges and registration tickets expire after five minutes. Used tickets are deleted during signup; expired records are scheduled for hourly cleanup. Approximate device location follows the 15-minute limit described above.

Server request logs are rotated daily when active, keeping up to 14 archived files. Application logs are rotated weekly when active, keeping up to two archives. These are archive limits, not a guarantee that every log entry disappears after a fixed number of days. Daily backups are kept for seven days. Deleted information may remain in these copies until they are replaced. Service-provider records follow the retention terms described below.

Under OpenAI’s standard API policy, abuse-monitoring logs can retain content for up to 30 days, subject to stated exceptions; some API features have separate storage. Google and TypeSafe describe additional service and abuse-prevention retention in their terms. Postmark’s retention policy distinguishes email content and delivery history from longer-lived statistics and suppression records. Not using content for training does not mean it is never stored.

Your rights

Use the available controls or contact us to request access, correction, a portable copy or deletion of your personal information. Where the GDPR applies, you can also request restriction, object to processing based on legitimate interests, and withdraw consent. Withdrawal does not change the lawfulness of earlier processing. These rights have conditions and exceptions, including legal record-keeping duties.

You may complain to your data protection authority, including the Swedish Authority for Privacy Protection (IMY).

Changes and contact

We update this date when the policy changes and notify you of meaningful changes. For questions, rights requests or details about our providers and retention, write to contact@usesunday.app.