This Privacy Policy explains how The Great Recap (“The Great Recap,” “we,” “us,” or “our”) collects, uses, and protects your information when you use thegreatrecap.com to design, preview, and order a personalized recap keepsake book (including the builder at /customize).
Quick summary. We run the builder on Supabase (authentication, database, storage, and server-side functions). The photos, moments, and text you provide are used to design and print your book and to save in-progress drafts so you can resume. We use Stripe to process payments and a print-on-demand partner to manufacture and ship your order. We do not use your uploads to train our own AI models. Some content is sent to third-party AI providers to generate artwork and text — see our
AI Policy.
1. Information we collect
Depending on how you use the site, we may process the following categories of information:
1.1 Account and authentication
- Email sign-in (optional): the email address you enter for one-time passcode (OTP) verification and order updates, plus session tokens issued by Supabase.
- Sign-in with Google (where offered): identifiers and basic profile fields (such as email and name) provided by Google through Supabase Auth.
- Anonymous session token: a random identifier used to link an in-progress draft to your order, even before you sign in.
1.2 Content you add in the builder
- Photos and moments you upload, along with dates, captions, locations, and notes attached to them.
- Recap details: the recap type (e.g., a year in review, a trip, a wedding, a memorial), the people featured, titles, and the time period covered.
- Story and message text: headlines, descriptions, and any custom back-cover message or dedication you write.
- Cover and layout choices: cover artwork prompts, style selections, format, page count, and quantity.
- Generated previews: the cover and interior artwork produced for your book so you can review and approve it.
1.3 Order and payment information
- Shipping details: recipient name and postal address used to print and deliver your book.
- Contact email: used to send order confirmations, proofs, and shipping updates.
- Payment information: card and billing details are collected and processed directly by Stripe. We never receive or store your full card number; we retain only non-sensitive references (such as a Stripe session or payment identifier and the amount) for reconciliation.
1.4 Technical identifiers
- Browser storage: we use
localStorage to keep your draft and a temporary visitor identifier so the builder works across refreshes.
- Server logs: our hosting and Supabase infrastructure create standard access and error logs (for example IP address, timestamps, and request paths) for security and reliability.
2. How we use your information
- To design and generate the cover, interior pages, and text suggestions for your book through server-side AI pipelines.
- To save your progress: draft content (including embedded image data) is written to Supabase so you can resume later on that browser or account.
- To fulfill your order: produce, print, and ship your book through our print partner, and keep you updated by email.
- To process payments and prevent fraud, and to keep records required for tax and accounting.
- To authenticate requests, enforce row-level security, and prevent abuse.
- To improve reliability (for example, debugging failed generations from server logs) and respond to support requests.
3. Where data is processed and stored
The Great Recap is built on Supabase (hosted PostgreSQL, authentication, storage, and Edge Functions). Data is processed in the regions configured for our Supabase project. To deliver the service we also transmit relevant data over TLS to: third-party AI providers for artwork and text generation (see the AI Policy); Stripe for payments; a print-on-demand partner to manufacture and ship books; and an email provider to deliver transactional messages.
4. Legal bases (EEA / UK visitors)
Where GDPR applies, we rely on contract (providing the builder and fulfilling the order you requested), legitimate interests (securing accounts, debugging, and preventing fraud), legal obligation (keeping financial records), and, where required, consent. You may withdraw consent where processing is consent-based without affecting the lawfulness of prior processing.
5. Retention
- Draft content persists until you overwrite it with a newer save, you ask us to delete it, or we run a data-lifecycle program — whichever comes first.
- Order records (including the finished book files, shipping details, and payment references) are retained as long as needed to fulfill the order, handle reprints or support, and meet tax and accounting obligations.
- Server logs are retained for a limited period consistent with security and operational needs.
- Local-only state that never synced remains only in your browser until you clear site data.
6. Sharing
We do not sell your personal information. We share data only with:
- Service providers that power the product: Supabase (hosting/database), AI generation providers, an email provider, Stripe (payments), and our print-on-demand and shipping partner.
- Authorities when required by law or to protect rights, safety, and security.
- Successors in the event of a merger, acquisition, or asset sale, subject to this policy.
7. Security
We use industry-standard measures appropriate to the service: TLS in transit, access controls on the database, authenticated APIs, and server-side secrets for payment and AI keys. No method of transmission or storage is 100% secure; if you believe your account has been compromised, contact us using the email below.
8. Children’s privacy
The service is intended for adults creating gifts and keepsakes. If you are under 16 (or the age of digital consent in your region), do not use the service without a parent or guardian. If we learn we have collected personal information from a child in violation of this policy, we will delete it. You may include photos of children in a book you create, provided you have the right and consent to do so.
9. Your choices and rights
- Access / correction: much of your project data is visible and editable inside the builder while you work.
- Deletion: you may request deletion of account-held data by contacting hello@thegreatrecap.com with “Privacy” in the subject line. Some records may be retained where law requires (for example tax or fraud-prevention records, or where an order has shipped).
- EEA / UK rights: you may have the right to object to, restrict, or port certain data, and to lodge a complaint with your supervisory authority.
10. International transfers
If you access the service from outside the country where our servers and partners operate, your information may be transferred across borders. We use safeguards consistent with applicable law (for example, standard contractual clauses where required).
11. Changes
We may update this policy from time to time. We will post the new “Last updated” date at the top, and may highlight material changes in-product where practical.
12. Contact
Questions about this policy: hello@thegreatrecap.com
