PRIVACY & YOUR INFORMATION
Your stories belong
around the family table
Last updated: 11 October 2026. This notice covers family accounts, existing tests and paid family subscriptions.
Who is responsible?
Loading contact details…
Contact the team about privacy
What we collect and why
We collect your email, family profiles, stories, recordings, photos, captions, optional calendar dates, account access records and support messages. You supply most information; a relative may supply your name, email, relationship or a story or photo that includes you.
We use account and contribution information to provide the service you request, and limited access records to protect it. The intended lawful bases are performance of our service agreement and legitimate interests in running a secure, private family service, including family details supplied by relatives. The operator must confirm these before paid launch. We do not sell family information or use it for advertising.
Only an adult with appropriate parent or guardian permission should add a child’s details or photos. Children do not have their own accounts. Avoid identity documents, school addresses, financial details and sensitive health information. Contact us before submitting sensitive information or if someone objects to appearing in the newspaper.
Printed newspaper interest
If you register interest in printed copies, we store your copy count, delivery region, one-or-several-address preference and launch-email permission against your verified account. We use those preferences to plan the service and your consent to email you when it becomes available. We do not collect a postal address or take payment at this stage. We do not share interest records with printers or advertisers.
You can change your choices or withdraw through the printed copies page. Withdrawing deletes the interest record. Records expire 12 months after the last update and are removed during later interest-list activity; expired records are not used for launch emails. They are also included in your personal-data export and removed when your account is deleted. Manage print interest.
Your account and your family
Each adult signs in with a link sent to their own verified email. Login links work once and expire after 20 minutes. Sessions last up to 30 days; you can log out on one device or all devices from My account. A personal invitation does not open another person’s account.
Your family organiser can add names, email addresses and relationships, and link children and pets to an adult. Children and pets do not need accounts. Only add information you have permission to share. Use a first name or nickname where that is enough; avoid addresses, school details and other sensitive information in profiles.
Who sees what?
Your original updates, recordings, unpublished stories and photos are restricted to your account and the service’s editorial operations. The organiser sees contributor progress and manages the family list. Members can read the finished newspaper after it is released. Editorial checks and final PDF approval happen before release.
Keep family invitation links within your family: someone who receives a shared invitation can join using their own verified email. Family members can download or print released newspapers, so the service cannot recall copies they have already saved.
How the newspaper is made
The application runs on Cloudflare Workers, using Cloudflare to store records and files. OpenAI processes submitted text, voice recordings, photos and newspaper pages for transcription, editorial preparation and quality checks. Resend delivers login links, invitations and newspaper notifications. Our own account system handles family logins.
OpenAI API content is not used for model training by default. That does not mean immediate deletion: provider retention rules still apply. This is not end-to-end encrypted messaging; the service and its processors need to process material to make your paper. Read OpenAI’s API data controls.
Providers may process information outside the UK or EEA. Their processing agreements, transfer safeguards and configured backup retention still need to be recorded and verified before paid launch. We do not claim that information stays only in the UK or that deleting a live file instantly removes every provider copy.
Protection and device storage
Family records and file requests are checked against your account on the server. Storage uses Cloudflare’s encryption, with HTTPS for transport. Login tokens are stored as hashes and session cookies are protected from access by page scripts. Private API responses are marked not to be cached.
The update form also keeps a draft on your device to help recover from a lost connection. Logging out or switching accounts clears that device’s draft cache. Use a device you trust and log out on shared devices.
Your language choice is saved in a preference cookie on this browser for one year. It does not change your account permissions or translate your family’s original stories.
Website measurement
We count a small set of steps, such as opening the sample or completing family setup. On public pages, we also recognise the referring website’s hostname for a fixed list of search and AI services, and count clicks to start a newspaper. We store only daily totals and fixed event names, not full referrer URLs, search queries, visitor identifiers, story content, email addresses, IP addresses or private links in these counters. Measurement uses no analytics cookies or browser storage, and respects browser Do Not Track and Global Privacy Control. We do not link referral counts to individual payments. Counters older than 90 days are removed when new activity is recorded.
Help chat and support requests
The automated helper uses our public help guide, not your private family records. When it needs help matching a question, the question and previous topic may be sent to OpenAI; obvious private links and email addresses are removed first. Do not include sensitive information. Ordinary help conversations are not stored in our support database unless you choose to include one in a request.
A support request stores your contact details, question, replies and any help conversation you choose to include. The editorial support team can read it. Signed-in requests are linked to your account; guest requests use a separate protected browser cookie and cannot be retrieved just by entering an email address. Ordinary requests expire 90 days after the last reply and are deleted during scheduled cleanup or later support activity. Privacy requests stay open until resolved, then are kept for 12 months to record how we handled them. Guest access ends if you clear cookies or sign in or out. Replies currently appear in the help desk, without an email notification.
How long we keep information
Accounts and family profiles
Kept while your account or family uses the service. Account or family closure is handled through a deletion request, including a review of shared information.
Stories, photos and newspapers
Kept as your family archive while you use the service, or until you ask us to remove them. You can delete unsubmitted saved stories yourself. Deleting a draft does not erase an already published edition.
Original voice recordings
Scheduled for deletion from our live file storage 90 days after the edition is published. Unpublished recordings stay available while the paper is prepared. The transcript and newspaper remain in your archive.
Login links and sessions
Login links expire after 20 minutes and account sessions after 30 days. Expired access records are removed during scheduled cleanup and relevant login activity.
Support and privacy requests
Ordinary support requests: 90 days after the last reply. Privacy requests: until resolved, then 12 months. Open privacy requests are not automatically deleted.
Failed recording deletions are retried by scheduled housekeeping. This cleanup does not delete family photos, transcripts or newspapers. Any information retained for a specific legal obligation or dispute is limited to that purpose; we explain applicable exceptions when handling a request.
Deletion handling must cover provider backups and prevent deleted information being restored into normal use. Provider copies may expire separately from the live service; their configured retention is still being verified during this trial.
Backups and recovery
Encrypted application backups contain family records and files. The scheduler attempts daily snapshots and removes copies after seven days. Recovery creates an inactive copy for the editor to inspect, without restoring account sessions or sending messages. These copies use the same storage account; independently stored exports and provider-level recovery arrangements still need to be confirmed.
A verified deletion removes affected application backups and isolated recovery copies before completing. This does not recall copies already downloaded by family members or immediately delete provider-retained copies. Recordings removed from live storage may remain in an existing backup for up to seven further days.
Your rights and deletion requests
You can request access, a copy, correction or deletion; you can also ask us to restrict use, object to processing or withdraw any consent you have given. Some rights depend on the circumstances. We normally respond within one calendar month. If a permitted extension is needed, we explain it within that month.
My account includes a download of your own original files and records. For deletion, the team prepares a concrete scope for you to confirm in your account. Execution is blocked until you confirm it; interruptions can be retried. Shared papers are withdrawn for redaction, while other relatives’ original contributions remain.
Use My account for a verified privacy request, or Help & support if you cannot sign in or are mentioned in another person’s newspaper. We may need proportionate proof of identity. Do not send identity documents through the chatbot. This is a request for the team to review, not an instant deletion button.
Before removal, the team confirms which memberships, private originals, child profiles and shared editions are affected. Removing your information does not automatically delete someone else’s account. We review redaction or removal of shared newspapers and explain what happens to downloaded or printed copies.
If you have a concern
Contact the team so we can investigate. You can also complain to the UK Information Commissioner’s Office or the data protection authority where you live. ICO · AEPD.