Sancta
Privacy
Effective 26 August 2026
Sancta holds a family’s photographs, a child’s first words and the dates of their sacraments. That is not ordinary data, and we do not treat it as ordinary data. This page says plainly what we hold, what we will never do with it, and what you can do about any of it.
The short version
In plain words
- Your family’s record is private by default. Every entry begins visible to the parents alone. Sharing is something you do on purpose.
- We do not sell your family’s content or your personal information. Not to anyone, at any price.
- We do not use your photographs or your writing to train AI models.
- There is no advertising in Sancta, and no advertising or tracking code in the app or on this site.
- Where a feature recognises faces, it runs on your phone. Face data never reaches our servers.
- You can export everything, free, whenever you like — including after a subscription ends.
- Deleting sends things to a trash that holds them for 30 days. After that, deletion is permanent.
- The account belongs to a parent or guardian, who controls the child’s record. We collect nothing directly from children.
- Write to us at hello@sanctaapp.com. A person reads it.
Everything below says the same things at greater length. If the summary and the detail ever seem to disagree, tell us and we will fix the wording.
Section 1
What this covers
This policy covers the Sancta mobile app, the letters we send by email on a family’s behalf, the pages a recipient of one of those letters can open without an account, and this website.
In this policy, “we” and “us” mean the makers of Sancta; “you” means the person who holds the account; and “your family’s record” means everything kept in the journal — entries, photographs, video, milestones, letters, and the details of a child’s life.
Company name, jurisdiction and postal address are to be published in this section and in Section 12 before launch.
Section 2
What we collect
Your account
An email address, a display name, and the credential you sign in with, handled by our authentication service. That is all an account needs.
Your family’s record
The entries and notes you write; photographs and video you save; milestones and the structured details you enter with them — a baptism’s church, celebrant and godparents, for instance; growth measurements; letters you write and seal for later; comments and reactions from the people you invited; and a child’s name, date of birth and whatever else you choose to add. You decide what goes in. Nothing is required beyond a photograph.
The people you invite
When you invite a co-parent, a godparent or a grandparent, you give us the name and email address you want the invitation or the weekly letter sent to. Please add only people who would expect to hear from you. Any recipient can change how often they hear from us, or stop entirely, from the letter itself.
Replies to the weekly letter
A grandparent can answer a letter simply by replying to the email. We receive the reply, the address it came from and the name on it, and hold it for the parents, who decide whether it becomes part of the child’s record or is discarded.
Payments
Subscriptions are billed by Apple or Google, and their status is managed through RevenueCat. Printed books are paid through Stripe, which also receives the name and address a book ships to. We are told that a payment succeeded. We never see or store card numbers.
Product analytics
Events only — that a screen was opened, that a book was rendered. Never the content of an entry, never a photograph, never anything derived from a photograph. No harvesting of photo metadata, no content classification, no inference about your family. Crash reports are scrubbed of your content before they reach us.
Ordinary technical records
Requests to our servers leave short-lived logs — an address, a timestamp, an error — kept to keep the service running and secure.
This website
If you join the waiting list, we keep the address you gave, the date you gave it, which page it came from, and a short truncated fingerprint of your browser’s user-agent string — enough to notice one script filling the form a hundred times, and not enough to identify anybody. Your IP address is used only for a rate-limiting counter that expires within ten minutes, and is not stored with your address.
We use that address only to write to you about Sancta. It is not sold, not shared, and not added to anything else. The page itself loads nothing from anywhere else: no fonts, no analytics, no tracking pixels, nothing that would tell a third party you were here.
Section 3
What we never do
This list is the Sancta Privacy Pledge, which is also shown inside the app. It binds our own engineering, not only the companies we buy from.
- Sell or licence your content or your personal information.
- Use your photographs, your writing, or a child’s record to train AI models — ours or anyone else’s.
- Show advertising, or share anything with an advertising network. There are no advertising SDKs and no tracking pixels in the app or on this site.
- Run face recognition on our servers. Where person-tagging exists it happens on your phone, using the operating system’s own frameworks; only the name you confirm is stored.
- Read your entries to profile you, to classify you, or to infer anything about your family’s beliefs.
- Mine your photographs for analytics or marketing, in any form.
Private Capture. A photograph taken with Sancta’s own camera can be kept out of your camera roll entirely, which means it never reaches iCloud Photos or Google Photos. Sancta’s local cache is excluded from device backups so that the promise holds all the way down. The honest boundary: a photograph you import from your camera roll has already touched Apple’s or Google’s cloud. The bypass applies to what is captured in Sancta.
Section 4
Children, and who holds the account
Sancta is an app for parents. Accounts are for adults. A child’s record is created and controlled by their parent or guardian, who decides what is saved, who may see it, and when it is deleted. We do not offer accounts to children, we do not collect information from children directly, and we ask children for nothing.
Everything in a child’s record is there because a parent put it there. A teenager may later be invited by their parents to contribute to their own record; that invitation comes from the account holder, who remains in control of it.
Because the subject of the record is a child, we hold all of it to the standard its most sensitive part deserves: private by default, no advertising, no training, no profiling, and no biometric data on our servers at all.
At eighteen, a family can hand the archive to the young adult, who becomes a guardian of their own record.
Section 5
Who can see what
- Every entry starts visible to the parents alone.
- Sharing it — with the whole family circle, or with a named group such as Grandparents or Godparents, or one you make yourself — is an explicit act: one tap as you save, or a quiet review later.
- The birth chapter is held apart. Labour, delivery and the days after are never included in a sharing prompt; they are shared only if you go and share them deliberately.
- A viewer can be sent a link that opens without an account and without installing anything. Those links are signed, and they can be revoked.
- Where a child’s record is linked across two households, entries created while the households were linked stay visible to every guardian household. No one can lock another parent out of their child’s memories.
- We see your content only where we must: to run the service, to investigate a fault you report to us, or where the law requires it. We do not browse family journals.
Section 6
The weekly letter
Grandparents and godparents receive a letter by email carrying what the family chose to share. They install nothing and hold no account. What we keep for them is a name, an email address, how often they would like to hear from us, and a record of which letters have been sent, so that a letter is not sent twice.
Every letter carries a way to change the cadence or to stop entirely, and stopping is immediate. We never use those addresses to market anything. A recipient who writes back is answering the family, not us; the parents decide whether the reply becomes part of the record.
Section 7
Where your record is kept
Photographs and video are stored in Cloudflare R2. The database — accounts, entries, milestones, and who may see what — is Neon Postgres. The service itself runs on Cloudflare Workers. Content is encrypted in transit and at rest, and media is uploaded from your phone straight to storage through a short-lived signed link, so the bytes never pass through our general application logs.
Beyond that we rely on a small number of companies, each receiving only what its function requires:
- Apple and Google — app distribution and subscription billing.
- RevenueCat — whether a subscription is active.
- Stripe — payment for a printed book, and the address it ships to.
- Our print partners — the press file for the book you ordered, and the delivery address.
- Email delivery — the letters and account emails we send on your behalf.
- Analytics and crash reporting — events, scrubbed of your content.
We choose providers on the condition that they act on our instructions and use nothing we send them for their own purposes.
Section 8
How long we keep things
- Deleted entries rest in a trash for 30 days, where a parent can restore them. A daily job then removes them permanently, from the database and from storage.
- A deleted account takes your family’s record out of our live systems. Backup copies age out on their ordinary rotation, and are never used to bring deleted content back.
- Order records for printed books are kept for as long as tax and accounting rules require.
- Letter records — which letter went to which address, and whether it arrived — are kept so that a letter is not sent twice.
- Analytics events contain no content, and are kept in aggregate.
Everything else we keep for as long as you keep your account, because keeping it is the service you asked for.
Section 9
Your controls and rights
These are offered to everyone who uses Sancta, wherever they live:
- See what we hold about you and your family.
- Export all of it, free, in a usable form — including after a subscription ends. This is a promise, not a feature we intend to withdraw.
- Correct anything that is wrong.
- Delete any part of it, or all of it.
- Decide who sees each entry, and change your mind afterwards.
- Stop the letters — any recipient, at any time, from the letter itself.
- Ask a person rather than fill in a form: hello@sanctaapp.com.
We hold your family’s record because you asked us to keep it — that is the service. We send letters because a family asked us to send them. We keep order records because the law requires it. We do not rely on your data for anything else.
Some of these rights also exist in law: under the GDPR in Europe and the United Kingdom, under state privacy laws in the United States, and elsewhere. We do not ask where you live before honouring a request. If you think we have got something wrong, write to us first — and you also have the right to complain to your national data protection authority.
Section 10
Security
- Everything travels over HTTPS, and is encrypted at rest.
- Media is uploaded directly to storage using short-lived signed links.
- Access to production systems is limited to the people who need it to run the service.
- There is no biometric data on our servers, by design — face processing happens only on your phone.
- Sancta’s local cache is excluded from device backups, so a Private Capture photograph cannot leak into a cloud backup by a side door.
No system is perfect. If we ever discover a breach affecting your family’s record, we will tell you what happened, what it touched and what we did about it — promptly, in plain words, and not buried in a footer.
Section 11
Changes to this policy
We will not change this policy quietly. Small corrections — a clearer sentence, a new provider of the same kind — are published here with a new effective date.
Material changes — anything that alters what we collect, who receives it, or what we promise never to do — are announced by email before they take effect, so that you can read them, ask about them, or export everything and leave.
Section 12
Contact
Write to us about anything in this policy — a request, a correction, a doubt. A person reads it, and a person answers.
Postal address and company registration details to be published here before launch.