Sunday Box

Privacy Policy

Last updated 9 November 2026 · Version 2026-11-09

Who we are

Sunday Box ("we", "us") is a family recipe box at sundaybox.app. Questions about this policy, or about your information, go to privacy@sundaybox.app.

How we build for privacy

We design Sunday Box so that protecting your information is the default, not a setting you have to find:

• Private by default. Recipes, photos and recordings are private to your recipe box. There are no public profiles, public recipe pages or search across other people's recipes.
• Only what we need. We ask for a name, an email and a password. We don't ask for your address, birthday or phone number, and we don't use advertising or tracking cookies.
• Kept only as long as needed. Photos of your shelves are deleted once a pantry scan is reviewed, sign-in records after 12 months, and backups after 30 days (see How long we keep things).
• Used only for Sunday Box. We use your information to run and improve Sunday Box, and for nothing unrelated to it.
• In your control. You can delete any recipe, photo or recording, or your whole account, yourself, whenever you like.
• Protected throughout. Encrypted connections, scrambled passwords, private file storage and a permission check on every request (see Security).

What we collect

• Your account: your name, email address, a scrambled (hashed) version of your password, the picture or initials you choose, your settings, and when you agreed to these terms.
• What you add: recipes, photos of recipe cards, cookbook pages and dishes, photos of people, video clips, voice notes, stories, notes, ratings, sources, links, menus and shopping lists.
• Your pantry: photos of your cupboards, fridge or shelves when you scan them, and the list of what's in your kitchen. The photos are deleted once you've reviewed the scan.
• What others send you: when you ask someone for a recipe or a memory, we keep their reply, their name and how they say they're related, and any photos, videos or recordings they send. Recipes and copies people send you land in your Inbox.
• Your family and friends: who is in your family group, who you've invited, and the names and optional phone numbers or emails you enter for friends and contributors. We use these only to send the invites and asks you choose to send.
• Notes you send us: suggestions, questions and bug reports from Account → Help, with the page you were on and your browser type, so we can help.
• Plans and payments: your plan, when it's paid through, and your scans. When paid plans start, our payment processor (Stripe) handles card details. We never see or store your full card number.
• Sign-in records: when you sign in, your IP address and the time, so you and we can spot misuse.
• How the product is used: each time Sunday Box reads something for you, what kind of read it was and what it cost, so we can count scans. When a read becomes a recipe, we keep what was read next to what you saved, so we can see where reading needs to improve.

We use one cookie, to keep you signed in. We don't use advertising or tracking cookies, or analytics that follow you around the web. We don't collect precise location, government ID numbers, financial account details (beyond what Stripe handles) or health information, and we don't use voice recordings or photos to identify anyone.

How we use it

• To store your recipes and show them to you and the people you share them with.
• To read recipes, pantry photos and spoken notes, when you ask.
• To send you emails you need: password resets, invites and asks you choose to send, receipts, and important changes to the service. We'll only send news or tips if you opt in.
• To keep Sunday Box secure, prevent abuse, and fix problems.
• To improve Sunday Box. We use product data and usage, such as how well a recipe was read and the corrections people make, to make reading recipes and the rest of the product work better. This stays within Sunday Box and the companies that help us run it, and we never sell it.
• To count scans and, when paid plans start, to bill you.
• To meet legal obligations, such as tax records and answering valid legal requests.

How AI reading works

When you add a recipe from a photo, a web page, a video post, a pasted reply or a spoken note, or scan your pantry, and ask us to read or tidy it, we send that photo or text to Anthropic, whose AI turns it into a recipe card or a pantry list. Anthropic processes it for us under its commercial terms, which don't allow it to train its models on what we send. We don't send your other recipes, your stories or your account details. Typing a recipe in yourself never involves AI.

AI can misread things. Always check quantities, temperatures and allergens before you cook.

Who can see your recipes

Nothing on Sunday Box is public: there are no public profiles, recipe pages or search across other people's recipes.

• You. Recipes you add on your own account are private to you.
• Your family group. In a family, the family's owner owns the family's recipes and pantry, and every member can see and edit them.
• People you ask. A link you send to ask someone for a recipe or memory shows them that recipe's name, the question and, if you choose, its original card photo.
• People you send a recipe to get their own copy, with its story and where it came from. Once given, their copy is theirs.
• Our administrator can see account details, sign-in records, notes you send us and usage to run the service, and looks at your recipes only to improve how recipes are read, when you ask for help, or to deal with a report of abuse.

Companies that help us run Sunday Box

We share information only with companies that process it on our behalf, under contracts that limit what they can do with it:

• Railway hosts the app and its database (United States).
• Cloudflare R2 stores our nightly off-site backups and large video files, in private storage.
• Anthropic reads photos, links and text you ask us to read (see above).
• Resend sends our emails.
• Stripe will process payments when paid plans start.

Some features ask other services for public information, without sending anything about you:

• When you add a YouTube, TikTok or Instagram link, we ask that site for the post's public caption and cover image. We send them only the link.
• To sort your pantry and shopping list, we look up food names (like "penne" or "Barilla") in the US Department of Agriculture's public food database. We send only the food name.
• When you use Say it to speak a note, your browser or phone turns your speech into text using its own speech service (for example Apple's or Google's), under that company's privacy terms.

We don't sell or share your information

We don't sell your personal information, and we don't "share" it for cross-context behavioural advertising, as California law uses those words. We haven't done so in the past 12 months. We don't use sensitive information to infer things about you. Because we don't sell or share, there's nothing to opt out of, but we honour a browser's Global Privacy Control signal anyway. We'd only disclose information if the law requires us to, to protect someone's safety, or as part of a sale of the business, in which case this policy would still apply to it.

People in your stories

Family recipes often come with names, photos and voices of people who aren't on Sunday Box, including people who have passed away. Please only add what you have the right to share. Anyone who appears in a recipe can ask us to remove their name, photo or recording by writing to privacy@sundaybox.app, and we'll work with the recipe's owner to do it.

How long we keep things

• Your account, recipes, photos, recordings and notes you sent us: for as long as you keep your account, or until you delete them.
• Photos of your shelves from a pantry scan: deleted once you review the scan, or after 30 days if you don't.
• Off-site backups: 30 days, then they're replaced.
• Sign-in records: 12 months.
• A record that an account was deleted (its email, the date and what was removed): 12 months, so we can show the request was carried out.
• Payment records: as long as tax law requires (usually 7 years), kept by Stripe and in our accounts.

If your plan ends, we keep your recipes. You can still view, edit, print and export them.

Deleting your account

You can delete your account yourself at any time: go to Account → Profile → Delete my account and enter your password to confirm. It happens straight away. You can also email privacy@sundaybox.app from the address you sign in with, and we'll confirm it's you and do it.

• We delete your account, your name, email, picture and sign-in records, notes you sent us, and the recipes, photos, recordings and pantry you own.
• If you're a member of someone else's family, the recipes you added belong to the family's owner and stay in their book. Things you wrote are shown as from "a former member", and you can ask us to remove them too.
• If you own a family with other people in it, they get 30 days to keep their own copy of the family's recipes, on a free account or a plan of their own, and then the family's recipes are deleted. Until the app can do this for you, email us and we'll do it with you.
• Copies of recipes you already sent to other people are theirs and stay with them.
• Deleted data leaves our backups within 30 days, and we tell the companies that help us run Sunday Box to delete anything of yours they hold.
• We keep only what the law needs: the deletion record above and any payment records.

You can also delete any single recipe, photo, memory or recording yourself, at any time.

Getting a copy

You can download any recipe as a PDF or data file from the recipe itself. To get everything in your account at once, email privacy@sundaybox.app. A Download my data button is coming to the Account page.

Your rights, including in California

Wherever you live, you can ask us to:

• Know and access what personal information we have about you, where it came from, why we use it and who we've given it to;
• Get a copy of it in a format you can take elsewhere;
• Correct anything that's wrong (most of it you can edit yourself);
• Delete it (see Deleting your account); and
• Opt out of any sale or sharing, though we don't do either.

We won't charge you, give you a worse service, or treat you differently for using these rights. To ask, use the Account page or email privacy@sundaybox.app. We'll check it's you by asking you to confirm from the email address on the account, or by your password. Someone you authorise can ask for you, with your signed permission, and we may check with you directly. We answer within 30 days, and always within the 45 days California law allows. If we can't do what you ask, we'll say why, and you can appeal by replying to our answer; if you're still not happy, you can contact your state's attorney general or privacy agency. California, and states including Colorado, Connecticut, Virginia and others, give residents these rights by law; we give them to everyone.

For California residents, the categories in What we collect are identifiers (name, email, IP address), customer records, commercial information (plan and payments), internet activity (sign-in records and use of Sunday Box), and audio, photos and video you add. We collect them from you, from the people you ask for recipes, and from your device, for the purposes in How we use it, and we keep them for the times in How long we keep things. We disclose them for business purposes only to the companies listed in Companies that help us.

Children

Sunday Box accounts are for people 13 and older, and paid plans are for adults. We don't knowingly collect information from children under 13. If you think a child under 13 has made an account, write to us and we'll delete it. Family photos may show children; the person who adds them is responsible for having permission.

Security

Sunday Box uses encrypted connections (https), stores only scrambled passwords and sign-in tokens, keeps your files private behind your sign-in, and checks every request against who's allowed to see a recipe. No system is perfectly secure; if we learn of a breach that affects you, we'll tell you promptly.

Where your data is

Sunday Box is run from the United States, and your information is stored and processed there.

Changes to this policy

If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect, and ask you to agree again where needed. The date at the top shows the latest version.

Terms of Service · Back to Sunday Box