Privacy

Section 1What this covers

This policy covers the Sancta mobile app, the letters we send by email on a family’s behalf, the pages a letter’s recipient can open without an account, and this website.

In this policy, “we” and “us” mean the makers of Sancta; “you” means the person who holds the account; and “your family’s record” means everything kept in the journal — entries, photographs, video, milestones, letters and the details of a child’s life.

Section 2What we collect

Your account

An email address, a display name, and the credential you sign in with, handled by our authentication service. That is all an account needs.

Your family’s record

The entries and notes you write; photographs and video you save; milestones and the structured details you enter with them (a baptism’s church, celebrant and godparents, for instance); growth measurements; letters you write and seal for later; comments and reactions from the people you invited; and a child’s name, date of birth and whatever else you choose to add. You decide what goes in. Nothing is required beyond a photograph.

The people you invite

When you invite a co-parent, a godparent or a grandparent, you give us the name and email address you want the invitation or the weekly letter sent to. Please add only people who would expect to hear from you. Any recipient can change how often they hear from us, or stop entirely, from the letter itself.

Replies to the weekly letter

A grandparent can answer a letter simply by replying to the email. We receive the reply, the address it came from and the name on it, and hold it for the parents, who decide whether it becomes part of the child’s record or is discarded.

Payments

Subscriptions are billed by Apple or Google and their status is managed through RevenueCat. Printed books are paid through Stripe, which also receives the name and address the book ships to. We are told that a payment succeeded. We never see or store card numbers.

Product analytics

Events only — that a screen was opened, that a book was rendered. Never the content of an entry, never a photograph, never anything derived from a photograph. No harvesting of photo metadata, no content classification, no inference about your family. Crash reports are scrubbed of your content before they reach us.

Ordinary technical records

Requests to our servers leave short-lived logs — an address, a timestamp, an error — kept to keep the service running and secure.

Section 3What we never do

This list is the Sancta Privacy Pledge, which is also shown inside the app. It constrains our own engineering, not only the companies we buy from.

• Sell or licence your content or your personal information.
• Use your photographs, your writing, or a child’s record to train AI models — ours or anyone else’s.
• Show advertising, or share anything with an advertising network. There are no advertising SDKs and no tracking pixels in the app or on this site.
• Run face recognition on our servers. Where person-tagging exists it happens on your phone, using the operating system’s own frameworks; only the name you confirm is stored.
• Read your entries to profile you, to classify you, or to infer anything about your family’s beliefs.
• Mine your photographs for analytics or marketing, in any form.

Section 4Children, and who holds the account

Sancta is an app for parents. Accounts are for adults. A child’s record is created and controlled by their parent or guardian, who decides what is saved, who may see it, and when it is deleted. We do not offer accounts to children, we do not collect information from children directly, and we ask children for nothing.

Everything in a child’s record is there because a parent put it there. A teenager may later be invited by their parents to contribute to their own record; that invitation comes from the account holder, who remains in control of it.

Because the subject of the record is a child, we hold all of it to the standard its most sensitive part deserves: private by default, no advertising, no training, no profiling, and no biometric data on our servers at all.

At eighteen, a family can hand the archive to the young adult, who becomes a guardian of their own record.

Section 5Who can see what

• Every entry starts visible to the parents alone.
• Sharing it — with the whole family circle, or with a named group such as Grandparents or Godparents, or one you make yourself — is an explicit act: one tap when you save, or a batch review later.
• The birth chapter is held apart. Labour, delivery and the days after are never included in a sharing prompt; they are shared only if you go and share them deliberately.
• A viewer can be sent a link that opens without an account and without installing anything. Those links are signed, and they can be revoked.
• Where a child’s record is linked across two households, entries created while the households were linked stay visible to every guardian household. No one can lock another parent out of their child’s memories.
• We see your content only where we must: to run the service, to investigate a fault you report to us, or where the law requires it. We do not browse family journals.

Section 6The weekly letter

Grandparents and godparents receive a letter by email with what the family chose to share. They install nothing and hold no account. What we hold for them is a name, an email address, how often they would like to hear from us, and a record of which letters have been sent so that we do not send one twice.

Every letter carries a way to change the cadence or to stop entirely, and stopping is immediate. We never use those addresses to market anything. A recipient who writes back is answering the family, not us; the parents decide whether the reply becomes part of the record.

Section 7Where your record is kept

Photographs and video are stored in Cloudflare R2. The database — accounts, entries, milestones, and who may see what — is Neon Postgres. The service itself runs on Cloudflare Workers. Content is encrypted in transit and at rest, and media is uploaded from your phone straight to storage through a short-lived signed link, so the bytes never pass through our general application logs.

Beyond that we rely on a small number of companies, each receiving only what its function requires:

• Apple and Google — app distribution and subscription billing.
• RevenueCat — whether a subscription is active.
• Stripe — payment for a printed book, and the address it ships to.
• Our print partners — the press file for the book you ordered, and the delivery address.
• Email delivery — the letters and account emails we send on your behalf.
• Analytics and crash reporting — events, scrubbed of your content.

We choose providers on the condition that they act on our instructions and use nothing we send them for their own purposes.

Section 8How long we keep things

• Deleted entries rest in a trash for 30 days, where a parent can restore them. A daily job then removes them permanently, from the database and from storage.
• A deleted account takes your family’s record out of our live systems. Backup copies age out on their ordinary rotation and are never used to bring deleted content back.
• Order records for printed books are kept as long as tax and accounting rules require.
• Letter records — which letter went to which address, and whether it arrived — are kept so that a letter is not sent twice.
• Analytics events contain no content and are kept in aggregate.

Everything else we keep for as long as you keep your account, because keeping it is the service you asked for.

Section 9Your controls and rights

These are offered to everyone who uses Sancta, wherever they live:

• See what we hold about you and your family.
• Export all of it, free, in a usable form — including after a subscription ends. This is a promise, not a feature we intend to withdraw.
• Correct anything that is wrong.
• Delete any part of it, or all of it.
• Decide who sees each entry, and change your mind afterwards.
• Stop the letters — any recipient, at any time, from the letter itself.
• Ask a person, rather than fill in a form: hello@sanctaapp.com.

We hold your family’s record because you asked us to keep it — that is the service. We send letters because a family asked us to send them. We keep order records because the law requires it. We do not rely on your data for anything else.

Some of these rights also exist in law: under the GDPR in Europe and the United Kingdom, under state privacy laws in the United States, and elsewhere. We do not ask where you live before honouring a request. If you think we have got something wrong, write to us first — and you also have the right to complain to your national data protection authority.

Section 10Security

• Everything travels over HTTPS and is encrypted at rest.
• Media is uploaded directly to storage using short-lived signed links.
• Access to production systems is limited to the people who need it to run the service.
• There is no biometric data on our servers, by design — face processing happens only on your phone.
• Sancta’s local cache is excluded from device backups, so a Private Capture photograph cannot leak into a cloud backup by a side door.

No system is perfect. If we ever discover a breach affecting your family’s record, we will tell you what happened, what it touched and what we did about it — promptly, in plain words, and not buried in a footer.

Section 11Changes to this policy

We will not change this policy quietly. Small corrections — a clearer sentence, a new provider of the same kind — are published here with a new effective date.

Material changes — anything that alters what we collect, who receives it, or what we promise never to do — are announced by email before they take effect, so that you can read them, ask about them, or export everything and leave.

Section 12Contact

hello@sanctaapp.com

Write to us about anything in this policy — a request, a correction, a doubt. A person reads it and a person answers.