Privacy

Lunchbox Notes is for leaving notes for a few people you love. It is not a social network: nobody can search for you, and you only connect with people who gave you their code. This page says what we store, why, who can see it, how long we keep it, and what you can ask us to do with it.

We wrote it in plain language on purpose. If something is unclear, ask us. The person or company named below is responsible for this policy and for how your data is handled.

Who we are

Lunchbox Notes is run by Sailstead LLC, Las Vegas, Nevada, USA. We decide what data the app uses and why (in data-protection terms, we are the “controller”).

• Email: contact@lunchboxnotes.app. This is also our point of contact for authorities and for reports of illegal content.

Grown-ups and kids

There are two kinds of people in the app:

• Grown-ups sign in with their email address. Only grown-ups create accounts.
• Kids use a device that a parent or guardian sets up with a code. A kid has no email address, no password and no picture. The only name we have for a kid is the one their grown-up typed. Kids’ lunchboxes are for kids who are 13 or older; the app asks everyone’s age once when an account or a kid’s lunchbox is made, and keeps only that the question was answered, not the age. We do not knowingly collect information from children under 13. If you believe a child under 13 has a lunchbox, write to us and we delete it.

What we store

Your account

• Your email address, to send you a sign-in code. We don’t send you anything else unless you also joined the waitlist.
• The name you give yourself and, if you add one, a picture. You can pick it from your photos or take one with the camera. The app also opens your photos or the camera when you take or choose a photo for a note, and for nothing else.
• Your time zone, so dates and times look right.
• Your connect code, the code and link friends use to connect with you.

What you make

• Notes: the words, the paper, stickers and drawings, the photos you took or chose for it, and the picture of the finished note that the app makes to show it. A photo loses its location and other details from the camera on your phone, before it is uploaded.
• Drafts of notes you have not sent yet.
• Reactions to notes, and chat messages under notes.
• Your connections: who you are friends with, who writes for you, whose lunchbox you write for, and the nicknames you give people.
• Share links for notes you choose to share.
• Blocks and reports, when you use them. A report keeps a copy of what was reported, so it can still be looked at if the original changes.

From your phone

• Notification tokens, one for the app and one for the widget, so we can tell your phone that something arrived.
• A sign-in token, kept on your phone so you stay signed in. The widget gets a copy so it can fetch your notes.
• The widget’s copy of your latest notes, the names of the people who wrote them and their pictures. This stays in the app’s storage on your phone; it is not sent anywhere.

We don’t collect your location, your contacts, photos you didn’t pick, or any advertising identifier.

Our servers’ logs

Our providers keep short technical logs of requests (such as IP address, time and the page or function asked for), to keep the service running and secure.

The waitlist

If you join the waitlist on this site we store your email, your phone type, which page you signed up on, and an invite code if you came from someone’s link. We use it to send you one email now and one when the app is out. Every email has a link to leave the list.

Why we use it, and on what basis

What	Why	Legal basis
Email, name, picture, time zone, connect code	To run your account and show you to the people you connect with	Our agreement with you (the terms)
Notes, drafts, drawings, photos, reactions, chat messages, connections, nicknames, share links	To deliver what you send and keep what you receive	Our agreement with you
A kid’s name, notes, drawings, photos, reactions and messages	To run the kid’s lunchbox	The consent of the parent or guardian who set it up
Notification tokens and the widget copy	To tell you when something arrives and show it on your home screen	Our agreement with you; you can turn notifications off at any time
Blocks, reports, account pauses, moderator actions	To keep people safe and to act on illegal content	Our legitimate interest in a safe service, and our legal duties
Server logs	To keep the service secure and fix problems	Our legitimate interest in a working, secure service
Usage analytics (which features are used, never what you write)	To see what works in the app and what to fix	Our legitimate interest in improving the app
Waitlist	To tell you when the app is out	Your consent, which you can take back with the link in any waitlist email

We don’t sell your data. The app has no advertising or tracking code in it, and we don’t build advertising profiles of anyone. The only analytics are the usage analytics below. If that ever changes, this page will say so first.

Crash reports. When the app crashes or hits an error, it sends a report to Sentry so we can fix it: the kind of error, where in the app it happened, the app version and the phone model and iOS version. Before it leaves your phone the report is scrubbed: no email address, no note or message text, no names and no screen content. The report is not linked to your account and is not used for tracking. Sentry keeps these reports for 90 days.

Usage analytics. On a grown-up’s phone, the app tells PostHog which features are used, so we can see what works and what to fix: for example that a note was sent, what paper it was on, how many stickers and photos it had and how long the message was, that the app fetched the list of papers and how many there were, or that a filter was changed. Each event carries a random id tied to your account (not your name or email), the app version, the phone model, iOS version, language and time zone. It never carries what you write, who you write to, names, email addresses or what is on your screen, and there are no screen recordings. PostHog is set not to keep your IP address or work out where you are. Nothing is sent from a kid’s device. PostHog can store this data in the United States; it is not used for advertising or to track you across other apps.

Who can see what

What	Who sees it
A note	The person who wrote it, and the person it was sent to. If either of them is a kid, also the grown-up who manages that kid. Other people who write for the same lunchbox don’t see it
Reactions and the chat under a note	The two people the note is between. If either is a kid, also their grown-up, who can read the chat but not write in it
Your name and picture	People you are connected with, the grown-up of a kid you write for, and anyone who opens your connect link
A kid’s name	Only the kid’s grown-up and the people who write for the kid. The grown-up’s other friends don’t see the kid, or that there is one. If the grown-up shares the kid’s writer code, anyone who enters it sees the kid’s name and their grown-up’s name
Your connect code	Only you, and whoever you give it to
Nicknames	Only the person who gave them (and, for a kid, their grown-up)
A shared note	Anyone with the link, for 30 days or until you stop sharing it
Something that was reported	The small team that handles reports

The app does not tell someone when you have read their note: there are no read receipts.

Our own access. The service is run by a very small team. We look at stored content only when it has been reported to us, when you ask us to, or when we need to fix something. The people who handle reports can see the reported content and the pictures that go with it.

Kids

A kid’s lunchbox is created by a grown-up in the app, and the kid’s device joins it with a code. By adding a kid, the grown-up confirms that they are the kid’s parent or legal guardian, that the kid is 13 or older, and agrees to us handling the kid’s name, notes, drawings, photos, reactions and messages as this page describes.

• No email, no picture, no password. The kid’s device signs in without any personal details.
• Only people the grown-up chooses. Nobody can find a kid in the app, and the grown-up’s friends don’t see their kids. Another grown-up can write for a kid only when the kid’s grown-up adds them, or says yes after they entered the writer code the grown-up gave them.
• Kids can write back. A kid can send notes only to the grown-ups who write for them; nobody else.
• Photos go only to the grown-ups they write to. A kid can take or choose photos for a note. They go only to the grown-ups who write for the kid, and the kid’s grown-up sees the photos on the notes their kid sends (not a draft’s). A photo can reach a kid’s lunchbox only on a note from a grown-up their grown-up approved, and their grown-up sees that too. Our word filter can’t read a photo; blocking and reports cover photos as they cover any note.
• The grown-up can see. They see the notes in their kid’s lunchbox and the notes their kid sends, can read their kid’s chats (read only), and can see and lift the blocks their kid made.
• No ads, no analytics, no tracking. A kid’s device sends no usage analytics, and the app has no ads or tracking for anyone. Crash reports (above) carry no content and no identity, for kids or anyone else.
• Younger kids. If you ask us to tell you when a version for younger kids is ready, we keep that on your account (that you asked, and when; nothing about the kid) until we have told you or you delete your account.
• Deleting. A kid’s device can’t delete notes, messages or the lunchbox; it removes only the photos it uploaded, once their note is sent or a draft is thrown away. When the grown-up deletes their account, their kids’ lunchboxes are deleted with it, including the notes and messages the kids wrote and the photos they took. To remove or correct something about your kid without deleting your account, write to us.

Shared notes

You can share a note you wrote, or a note in your own lunchbox, as a link. Anyone who has the link can see the picture of the note, its words, the writer’s name and the date, for 30 days. Tap Stop sharing on the note to end it sooner. Messaging apps may keep their own preview of the picture and text after the link stops working. Kids’ devices can’t create share links, and a note a kid sent with a photo can’t be shared by link.

Notifications

When something arrives, the notification shows the writer’s name (or the nickname you gave them) and the note’s words, the message, or the reaction, on your lock screen. Anyone who can see your phone can see it. You can turn notifications off, or hide their previews, in your phone’s Settings. The widget also shows your latest notes on your home screen.

Services we use

These companies run parts of the service for us and only process data to do that:

• Supabase: our database, sign-in, file storage (notes, pictures) and the functions that send notifications. Your data is stored in the United States (East US, Northern Virginia).
• Cloudflare: this website, the pages for shared notes and invites, our email forwarding, and a check that stops bots on the waitlist form (Turnstile).
• Apple Push Notification service: delivers notifications to iPhones. Apple receives the notification’s text and your device’s notification token.
• Resend: sends our emails (sign-in codes and the waitlist emails).
• Sentry: receives crash reports (see above), stored in the United States.
• PostHog: receives usage analytics from grown-ups’ phones (see above), stored in the United States.
• Google Analytics: counts visits to this website (which pages are opened and where visitors come from) and sets cookies; it is not in the app. Where the law asks for your consent first (the EU and the rest of the EEA, the UK and Switzerland), it only runs after you say “Okay” to the cookie notice, and “No thanks” loads nothing from Google. Elsewhere it counts visits right away, and you can say no any time. To tell which, this site asks Cloudflare which country your visit comes from; we don’t keep it. Your choice is kept in your browser; change it any time with the Cookies link in the footer below. Google processes this in the United States.

Some of these providers handle data outside your country, including in the United States. Where the law requires it, we rely on their data-processing terms and the standard contractual clauses.

How long we keep things

• Your account and what you made stay until you delete your account.
• Notes are not deleted when they are replaced or taken out of your Memory box; they stay until the account is deleted (see below for what stays with others).
• Reactions and chat messages stay until the account is deleted. When you remove a chat message it shows as “Message removed” at once, and its text is cleared from our servers after 30 days.
• Drafts, including ones you discard, stay until you send them or delete your account.
• Photos you put on a note are kept on their own only while it is a draft. When the note is sent, its picture carries them and the separate copies are deleted; throwing a draft away deletes its photos. A copy left over (for example when the app closed during an upload) stays in your own storage, where nobody else can open it, until your account is deleted; a kid’s, until their grown-up’s account is deleted.
• Share links stop working after 30 days, or sooner if you stop sharing. The record of the link is deleted 90 days after that.
• Kid device codes stop working after 7 days. Your connect code works until you get a new one.
• Notification records (what was sent to which device) are deleted 30 days after sending.
• Reports are kept while we handle them. 90 days after a report is closed, the copy of the reported content and the reporter’s comment are cleared.
• Account pauses last until they are lifted. The record of moderation actions (what a moderator did, to which account, and why) is kept for as long as the service runs.
• After your account is erased we keep a bare record (an id and dates, no name or email) that it was erased for one year, so we can show the deletion happened.
• Server logs are kept by our providers for a short time, usually days.
• Waitlist entries are kept until the app is out and we have sent the launch email, or until you ask us to delete yours.

Deleting your account

Delete your account in the app: Profile → Delete account, then type DELETE. You are signed out at once and your account is closed. It is erased after 14 days; sign in during that time to keep it. You can also ask by email. What is deleted and what stays.

In short: your profile, picture, sign-in, lunchbox, the notes in it, your drafts and photos, your kids’ lunchboxes and photos, friends, nicknames, blocks, codes and share links are erased. Notes, reactions and chat messages you sent to others stay with them, shown as from “Someone who left” instead of your name. A name or signature written on a note, or a photo on it, is part of its picture, so it stays on it.

Your rights

You can ask us to:

• See the data we have about you, and get a copy of your notes and messages.
• Correct it. You can change your name and picture yourself in the Profile tab.
• Delete it, in the app or by email (how).
• Restrict or object to how we use it, and take back a consent you gave.

Write to contact@lunchboxnotes.app from the email address you sign in with. We answer within a month. A parent can do all of this for their kid.

If you think we handle your data wrongly, you can complain to the data-protection authority where you live or work. We’d be glad to hear from you first.

Security

Every request is encrypted in transit. Rules on our servers decide who can read each note, message and picture; stored files are private and only reachable through short-lived links. Anyone who can unlock your phone can open the app, so keep your phone locked.

Changes

When this policy changes, we update this page and the date at the top. If a change affects how your data is used, we tell you before it applies.

Contact

contact@lunchboxnotes.app. A person reads every email.