Privacy Policy

When you sign up, order and use your library, we collect:

• your account email and name;
• your family name and an optional phone number;
• your home address for pickup: street, suburb, state and postcode;
• for each item you order, your child's name, their age or school year, an estimate of how many pieces you have, and any notes you add;
• for a photobook, its cover title and whether you'd like a photo of your child or a message in the book;
• your choice about your originals, and your choice about social media;
• the scans of your items, with their titles, child tags and original file names;
• messages you send through the contact form or sign-up enquiries: your name, email, suburb, postcode and message;
• your payment, which is handled on Stripe's own checkout: we never see your card number, and we keep only the payment and invoice references.

Technically, we use only the cookies needed to keep you signed in and to protect our forms. We run no analytics or advertising trackers. Our host keeps server access logs (IP address and browser details) for 7 days.

We use your information to run your orders, pickups and deliveries, host your library, answer your messages, bill you, and keep the records tax law requires. We do not sell it, and we do not use it for advertising.

Your child's name and age come from you, when you place an order. Scans can show handwriting and sometimes faces.

We never post your child's work publicly unless you said yes at checkout, and you can withdraw that at any time.

If you share a batch, anyone holding the link sees that batch's viewing copies, its title and the child tag until the link expires after 7 days. Your original files are never shared.

A few services handle your information for us:

• Fly.io hosts the site on servers in Sydney. Fly may process account information in the United States.
• Tigris stores your scans and our database backups in a global bucket, so copies may be held outside Australia, including in the United States.
• Stripe processes payments, in Australia, Ireland, the United States and India.
• Resend delivers our emails from the United States and keeps message content for 30 days.
• WattleAddr suggests addresses as you type your pickup address.
• Our printing partners receive the scans and text needed to print your book.

Your scans are kept for 12 months after your library locks, then deleted. Account and order records are kept while you are a customer, and then for as long as tax law requires (five years). Enquiries and messages are kept until we have answered them. Deleted information can remain in our backups for up to 30 days before it is gone for good.

• Everything is encrypted in transit.
• Your files and our database backups are encrypted at rest by our storage provider.
• Our staff sign in with a password and an authenticator code.
• Families sign in with single-use email links.
• We use no third-party analytics.

You can ask to see, correct, export or delete your information, or change your social media answer, by sending us a message. We reply within 30 days.

Contact us first and we will do our best to put it right. If you are not happy with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

When we change this policy, we will update the date at the top.