Privacy Policy

Sepia Books ("we", "us", or "our") is committed to protecting the privacy of everyone who uses our service. This Privacy Policy explains what information we collect, how we use it, and your rights with respect to that information.

Account holders provide the following when signing up:

• Your name and email address (used for login and account communication)
• The name you give each project, and the email addresses you approve to add content to its Archive
• Your preference for marketing communications

Contact and support form submissions include your name, email address, and the message you provide.

Archive content — the emails, photos, PDFs, social media posts (their words, photos and videos, with the details kept beside them, such as dates, places and map locations, and tagged people) and blog posts you forward, CC, upload or import — is retained so it can be printed into a book, for as long as your account is active. From a Facebook or Instagram download we also keep, for the same purpose, the rest of what you wrote and did there that a book could hold: your notes and comments, your posts in groups and on other people's profiles, your events, the cities you checked into, the posts you saved (with what their authors wrote), your birthday photos, your profile details, and your profile pictures and cover photos.

When you import Facebook or Instagram posts, the posts you choose come into your Archive, and we keep a private copy of your download, whole, so we can correct or re-import your posts later and take your profile pictures and cover photos from it to print on your book's title page. That includes everything Facebook or Instagram put in it: your posts, with their words, photos and videos and the details kept beside them, such as dates, places and map locations, tagged people, comments, and the internet address a photo was uploaded from; your messages, with what the people you talked to wrote and the photos and videos you sent each other; your profile and contact details; your friends and followers, and the phone contacts you synced; your likes, reactions, groups, events and Marketplace activity; your search and activity history; ad information; your payment details and addresses; any ID-verification details you gave Facebook; and your login and security records, with the internet addresses and devices you signed in from. The copy is deleted when you delete the project or your account.

When you import a blog, the posts you choose come into your Archive, and we keep a private copy of the files you gave us, whole, so we can correct or re-import your posts later. From a Google Takeout download, that includes everything Blogger put in it: every blog on the account, with its posts, drafts, pages, readers' comments, videos, settings (among them the blog's email-posting address) and its followers' names; your Blogger profile, with your email address and whatever else you filled in on it; the comments you left on other people's blogs; your Blogger photo albums; and anything else in the download, such as files from other Google products you chose to include. From WordPress, the copy is the export file, or every file in the .zip you dropped; a WordPress export holds your posts with their drafts, pages, private and password-protected posts and readers' comments, each commenter's email and internet address, the names and email addresses of your site's users, and any messages people sent through your site's contact forms. The copy is deleted when you delete the project or your account.

When you add an iPhone photo saved in HEIC format — on the upload page, to an email, or as a book cover or title-page photo — we convert it to JPEG for your Archive and keep a private copy of the photo as you chose it, with what your phone saved in it, such as when and where it was taken, so we can convert it again if our conversion improves. The copy is deleted with the photo, or when you delete the project or your account.

Order and shipping details — the recipient name, address and phone number you provide for a printed book — are shared with our print partner only to produce and ship that order.

We use the information we collect to:

• Operate the Service — saving what you forward, CC or upload into your Archive, and rendering and printing the books you order
• Send transactional emails, such as welcome messages, Archive confirmations, proof-ready notices and order receipts
• Respond to support and contact requests
• Send product and service updates to account holders who have opted in
• Monitor for abuse and maintain the security of the Service

We do not sell, rent, or trade your personal information to third parties.

The core function of Sepia Books is to keep the emails, photos, PDFs and files you choose to save in one Archive and to compile them into a book when you order one. Content reaches your Archive only when you (or an address you have approved) forward or CC it to your Archive addresses, or upload it. We do not read or analyze Archive content beyond what is necessary to store it, render it into a book and support you.

Approved senders can add emails to a project's Archive by forwarding them to the project's Save-to-Archive address (prefix save-), or by copying an Archive address (Cc or Bcc) on an email they send. Either way, the content may include messages originally sent by or to third parties who haven't directly consented to having their messages stored in our service — for example, a message you received from a friend or colleague, or an email you sent to a small group. By adding an email to the Archive, the approved sender takes responsibility for the appropriateness of the Archive entry. Owners can delete Archive entries at any time from the Archive page; deletion removes the row, the stored HTML, the source .eml, and any attachments from our storage.

We rely on the following third-party providers to operate the Service:

• Supabase — authentication and database storage
• SendGrid (Twilio) — outbound email delivery
• Cloudflare — inbound email routing, infrastructure, and the bot check (Turnstile) on our sign-up and contact forms
• Stripe — payment processing
• Vercel — web hosting and privacy-friendly aggregate analytics
• Sentry — error monitoring; receives diagnostic context (including your account email) when an error occurs during your session, so we can triage and fix issues

These providers access your data only as necessary to perform services on our behalf and are contractually required to keep your information confidential.

We retain your account information and Archive for as long as your account is active. If you delete your account, the following are permanently removed from our database immediately:

• Your account name and email address
• Every project's name, approved sender addresses and settings
• All Archive and message content
• Any additional login you invited onto a book

Approved sender addresses are also removed when you delete them from the Approved Senders page.

Data retained by third-party providers. Some data lives outside our database with the providers we use to deliver the Service. We cannot delete this data on your behalf, but we minimize what flows to each provider:

• Stripe retains payment transaction records — including the billing information you provide during checkout, payment amounts, and timestamps — for the period required by financial-records regulations (typically seven years). We pass only an internal identifier to Stripe with each charge; we do not share your account name or email with Stripe ourselves.
• SendGrid retains email delivery event logs (sent, delivered, bounced) for 30 days. After 30 days these logs are automatically purged. We do not maintain a separate contact list with SendGrid.
• Supabase may retain authentication records briefly after an account is deleted; these are purged within Supabase's internal retention window.
• Cloudflare processes inbound emails in transit and does not retain message content beyond the short operational delivery window required to forward them.
• Sentry retains error events — including the affected user's account ID and email plus relevant request context — for the period defined in our Sentry plan (typically 30 to 90 days), after which events are automatically purged.

If you have questions about data held by these providers or wish to exercise rights under applicable data protection laws (such as GDPR or CCPA), please contact us and we'll help coordinate the appropriate request.

Some deployments of the Service offer an optional email list: a broadcast address that delivers an email to a set of subscribed members. Where that feature is enabled, list members provide only their email address when joining, do not create accounts, can leave at any time by clicking the leave link included in every broadcast email — upon which their address is immediately removed from that list — and are removed with the account holder's data on deletion. Broadcast content is not read or analyzed beyond what is necessary for delivery and logging.

We use session cookies to keep you logged in while using the Service. We do not use third-party tracking cookies or advertising trackers.

We use Vercel Web Analytics to understand aggregate traffic and conversion patterns on our site. Vercel Analytics does not use cookies and does not collect personally identifiable information.

Marketing attribution. When you arrive from one of our own ads or referral links, we record the campaign or referral information from the web address (for example, which ad or link you came from) in your browser's local storage — not cookies. If you later create an account or place an order, we attach that information to your record so we can measure which of our marketing efforts are working. This data stays within our own systems; we do not use an advertising pixel and we do not share it with Facebook, Google, or any ad network. It contains no information about your emails or personal messages.

Email open tracking. Emails we send may include a small invisible image that lets us tell whether the message was opened. We use this only in aggregate, to monitor deliverability and maintain our sender reputation so our emails reach the inbox. You can prevent it by configuring your email program not to load remote images.

We take reasonable measures to protect your information, including encrypted storage of passwords and secure HTTPS connections. However, no transmission over the internet is completely secure, and we cannot guarantee the absolute security of your data.

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this page. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy or how your data is handled, please reach us through the Contact page.