Privacy policy

The sky and moon generators run without signing in. The date, time and place you type are used to compute a sky and are not stored against you. Place names are resolved to coordinates by OpenStreetMap's Nominatim service, and that request is made by our server rather than your browser — so the place you searched for is not tied to your IP address by anyone but us.

We store, in a database we run:

• Your account — email address, display name if you give one, and your password hashed with scrypt. The password itself is never stored and cannot be recovered from the hash.
• The keepsake's contents — the chapters you write, the dates, places and photos you add. Yours, and visible only to the people you invite.
• Your order — which tier you bought, the email it was bought with, and a reference to look it up with Paddle. We never see or hold your card details.

Every keepsake is isolated at the database level, not just in the application: rows carry the keepsake they belong to and the database refuses to return them outside it. A bug in one page cannot spill one couple's chapters into another's.

The private notes two people leave each other are encrypted in your browser before they are sent. The key comes from a passphrase only you two know, stretched with 600,000 rounds of PBKDF2 and used to unwrap a per-keepsake data key; what our server receives and stores is ciphertext, an initialisation vector, and a salt.

None of those is a secret on its own, and no combination of them is a key. Someone holding a complete dump of our database and every environment variable the app has could not read a single note. The consequence is worth stating plainly: if you both forget the passphrase and lose the recovery code, we cannot recover those notes for you — not as policy, but as fact.

If you turn on alerts for new notes, your browser registers a push token with Google's Firebase Cloud Messaging and we store it against your account so we know where to send. The push itself carries no words — only that something arrived — so the note stays encrypted even in transit to your lock screen. Turning alerts off in your browser stops them; ask us and we will delete the token.

It stores your name, email, message, which page you came from, and your IP address. The first four so we can reply and know what you were looking at; the IP only for tracing spam runs after the fact. We do not add you to a mailing list — there isn't one.

Two measurement tags, and neither one loads until you say so. Google Analytics 4 counts page views and where visitors arrive from, which tells us which pages are worth writing more of. A Pinterest tag counts the same handful of moments for visits that arrive from a pin — it is not switched on today, and the page will simply not load it while there is nothing to load.

Neither is used for advertising, we do not sell or share the data, and nothing inside a keepsake — chapters, notes, photos — is ever sent to either of them. The events we record carry no parameters at all: they are counts of things happening, with no address, no keepsake name and no link back to a person. The keepsake pages themselves — /personal, /studio, /enter, /claim and /redeem — report nothing whatsoever, because a keepsake's address is the thing that opens it.

One cookie that matters: the sign-in session for a keepsake, set when you sign in, marked HttpOnly and Secure so scripts cannot read it, and expiring on its own. Signing out clears it.

One more records your answer to the analytics question: consent, set to analytics or essential, kept for twelve months. It holds nothing but that word — no identifier, nothing that says who set it. Until it exists, no analytics tag is loaded at all.

To change your mind, delete the consent cookie for this site in your browser's settings and the question will be asked again on your next visit. Choosing Only what's needed costs you nothing here — every part of the site works the same either way. If you allowed analytics and then withdraw it, the tag stops loading from your next page onwards.

Four companies, each doing one job, and none of them given more than that job needs:

• Paddle — takes the payment as merchant of record and holds the billing details we never see.
• Google Cloud — runs the servers and the database, and delivers the push alerts.
• Resend — sends the emails we send you, such as the link to claim a keepsake.
• OpenStreetMap — turns a place name into coordinates. It receives the place, and nothing about you.

That is the whole list. We do not sell personal data, and we have never shared it with an advertiser.

A keepsake and its contents stay for as long as it is hosted — that is the product. Ask us to delete it and we do, within 30 days, including from backups as they roll off. Orders are kept for as long as tax and accounting rules require. Contact messages are kept while the conversation is live and deleted once it is over.

Ask us for a copy of what we hold about you, a correction, or a deletion, and we will do it — within 30 days, and without asking why. Email hello@ourskies.love or use the contact form. If you are in the UK or EU, the rights you have under data protection law apply here whatever this page says.

Not built for or aimed at children under 13, and we do not knowingly collect anything about them. If a child has made an account, tell us and it goes.

If this changes in a way that affects what we do with your data, we will change the date at the top and, where it matters, email the people it affects rather than leaving it to be noticed.