How Sunday handles your information.

Sunday is a service operated by Sunday Editions. You can reach us at support@sundayeditions.com. This policy explains what we collect when you use Sunday, what we do with it, and what we do not do with it.

To run Sunday, we collect:

• Your name, email, and phone number — provided during onboarding so we can address the brief to you and accept text updates from you.
• The names and ages of the people in your household, and the names and phone numbers of any caretakers you add.
• Calendar events from any Google Calendar you connect — read to show your week and build your morning brief, and written to only when you accept or decline an invitation or create, move, or cancel an event from within Sunday (see “Google Calendar data” below).
• The text content of SMS messages you send to Sunday, and replies caretakers send to Sunday on your behalf.
• Basic technical data — IP address, browser, request timestamps — kept in standard server logs.

We use the information above only to operate Sunday for you:

• To generate your morning brief and deliver it by email.
• To show your calendar and, when you ask, to accept or decline an invitation or create, move, or cancel an event on your behalf.
• To send and receive SMS related to your household — calendar updates from you, confirmations to and from your caretakers.
• To keep your account secure and to debug problems.

The Sunday iPhone app handles a few things directly on your device. This section explains what stays on your phone and what the app sends to Sunday.

• Your device calendar.With your permission, the app reads the calendar on your phone (such as Apple Calendar) to show your family’s week. Those device events stay on your phone; the app does not upload them to Sunday. The one exception is contact birthdays: if your phone keeps a birthdays calendar, the app sends the name and date of each birthday to Sunday so your morning brief can note them. It sends only the name and day, never a phone number or address.
• Face ID and your passcode.If you turn on the app lock, Sunday uses Face ID or your passcode only to unlock the app. That check happens entirely on your phone through Apple’s local authentication. Sunday never receives your Face ID or biometric data.
• Photos you send.When you send Sunday a photo from the app, like a flyer or a screenshot of a schedule, the app uses your camera or photo library only for the photo you choose. That photo is handled as described in “What we collect” above.
• No tracking. The app contains no advertising, analytics, or tracking software, and it does not track you across other apps or websites.

When you connect a Google account, Sunday requests two Google Calendar permissions:

• See the events on calendars you can access — to show your week and compose your morning brief.
• See and edit events on your calendars — so you can accept or decline an invitation, and create, move, or cancel an event, from within Sunday.

Sunday only ever writes to your calendar to carry out an action you take yourself — you tap a response, add an event, move one, or ask Sunday to in your own words. Sunday never changes your calendar on its own, and it writes nothing beyond the change you asked for: declining an invitation sets only your own response; moving an event changes only that event.

Sunday’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar is a Google Workspace API, so the same commitment holds in those terms: the use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Sunday does not use data received from Google Workspace APIs to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. Your calendar is read at the moment your brief is written, and used only to write that brief for you.

With whom we share, transfer, or disclose Google user data. We do not sell Google user data, we do not use it for advertising, and we do not use it to train AI models. We disclose it only to the small set of service providers that process it on our behalf, strictly to operate the features above for you:

• Supabase — stores your encrypted Google OAuth tokens and the calendar details Sunday holds to build your brief.
• Vercel — hosts the application that reads and processes your calendar.
• Anthropic — receives the relevant calendar details, at the moment your brief is written, to compose that brief. Anthropic is contractually prohibited from using it to train its models.
• Resend and Twilio — deliver your brief, which includes calendar-derived content, to you by email or text when you choose those.

We do not transfer or disclose Google user data to any other third party, and never for any purpose other than providing the features you asked for, as described in this policy — except where we are legally required to, or where it is necessary to protect the safety and rights of our users. You can disconnect your Google account at any time from your settings, which stops all further access.

• We do not sell your information to anyone, for any purpose.
• We do not share SMS opt-in data, phone numbers, or message content with third parties or affiliates for marketing.
• We do not use your messages, calendar, or family data to train third-party AI models. Brief generation uses Anthropic’s API under terms that prohibit using your data for model training.

Sunday is built on a small set of vendors who process data on our behalf. Each is bound by their own terms and security practices:

• Supabase — database and authentication.
• Vercel — application hosting.
• Twilio — SMS delivery.
• Anthropic — language model used to generate the brief.
• Google — calendar data, only for accounts you connect.
• Resend — outbound email delivery.

We take security seriously, and use appropriate technical and organizational measures to protect your information — including sensitive data such as Google Calendar data and the details of your household — against unauthorized access, disclosure, alteration, or destruction:

• Encryption in transit. All data moving between you, Sunday, and our service providers travels over encrypted connections (HTTPS/TLS).
• Encryption at rest. Your data is stored with providers that encrypt it at rest. In addition, your Google OAuth tokens are individually encrypted by Sunday using AES-256 before they are written to the database, so they are never stored in plain text.
• Access controls. Access to Google user data is restricted to the application processes that need it to run your brief and the calendar features you use, and to a limited number of authorized personnel for operating and debugging the service. Accounts are protected by our sign-in and session controls.
• Data minimization and deletion.Sunday holds only the data it needs to run for you, and you can disconnect Google or delete your account at any time, which removes the associated data as described in “How long we keep it” below.

Sunday offers an optional SMS program. If you opt in — by checking the consent box when you add your mobile number, or, for caretakers, by replying YES to a one-time invitation — you agree to receive recurring transactional text messages from Sunday about schedule updates, reminders, and confirmations. Every message is generated automatically by the application — from a calendar event, a scheduled job, or an update you submit — and is never relayed person-to-person.

Message frequency varies. Message and data rates may apply. Reply STOP at any time to opt out, or HELP for help. Opting out stops further messages from Sunday to that number.

We do not share mobile opt-in information or phone numbers with any third party or affiliate for marketing or promotional purposes.

We keep your account data for as long as your account is active. If you delete your account, we delete your family record, members, calendar tokens, caretakers, and SMS history within thirty days. Server logs are retained for up to ninety days for security and debugging.

You can edit your household, caretakers, and preferences at any time from the settings page. You can disconnect your Google Calendar from the same page. To delete your account or request a copy of your data, email support@sundayeditions.com.

Sunday is built for parents. The service is intended for adults (18+). We do not knowingly create accounts for anyone under 18. The names and ages of children are stored only so Sunday can address them by name in the brief; we do not market to children or contact them directly.

We’ll update this page if anything material changes about how Sunday handles your information, and we’ll note the new date at the top. If a change affects how we use existing data, we’ll email you before it takes effect.

Questions, requests, or concerns — write to support@sundayeditions.com.