Privacy Policy

sendUnsaid is a private video space. We treat your videos as some of the most personal data on the internet and design the service accordingly.

What we collect

• Account data — your email, name, and (optionally) profile photo.
• Space content — videos, notes, and tags you create.
• Billing data — handled by Stripe; we store a customer reference and subscription status, not your card.
• Operational logs — IP, user agent, and request timing for security and debugging.

How we use it

• To store and play back your videos for you.
• To deliver shared videos to recipients you explicitly authorize.
• To bill you for paid plans.
• To send transactional emails (sign-in, password reset, share notifications).

We do not sell your data, train AI models on your videos, or use them for advertising.

How videos are stored and shared

Videos are stored in a private, access-controlled bucket. Playback uses short-lived signed URLs. Share links you create can be password-protected and have an expiry you choose; recipients only see the specific video you shared.

Subprocessors

• Lovable Cloud / Supabase — database, authentication, storage.
• Stripe — payments.
• Cloudflare — hosting and CDN.

Children (COPPA)

sendUnsaid is intended for adults (18+) recording videos for the children and loved ones in their lives. Children do not create accounts and the service is not directed to children under 13.

Because parents may record videos of their own children, we comply with the Children's Online Privacy Protection Act (COPPA) as follows:

• At signup, every account holder must affirmatively attest that they are the parent or legal guardian of any child shown in their videos, and consent to that child's image and voice being stored privately in the service.
• All child-related content is private by default. We never display it publicly, never sell it, and never use it for advertising or to train AI models.
• Parents may review, export, or delete their child's content at any time from Settings, or by emailing support@sendunsaid.com.
• We do not collect personal information directly from any child. We do not knowingly allow children under 13 to create accounts. If you believe a child has created an account, email us and we will delete it promptly.

California residents (CCPA / CPRA)

If you are a California resident, you have the right to: know what personal information we collect; access and receive a copy of it; request deletion; and correct inaccuracies. You can exercise these rights directly in Settings ("Export my data" and "Delete account") or by emailing support@sendunsaid.com. We do not sell your personal information and do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising these rights.

Your rights

You can access, export, correct, or delete your data at any time from Settings, or by emailing support@sendunsaid.com. We respond to verified requests within 30 days.

Retention

We keep your content for as long as your account is active. When you delete content or your account, we remove it from primary storage within 30 days and from backups within 90 days. Exception: billing and transaction records held by our payment processor (Stripe) are retained by Stripe for as long as required by US tax and financial recordkeeping law (typically 7 years). We do not control that retention.

Security & breach notification

We protect your data with encryption in transit (HTTPS), encryption at rest, private (non-public) storage with short-lived signed URLs, row-level access controls in our database, and two-factor authentication for our administrators. If we ever discover a security breach that affects your personal information, we will notify you and the relevant US state authorities within the timeframes required by applicable state breach-notification laws.

Changes to this policy

If we make material changes to this policy, we will notify you (in-app or by email) at least 30 days before they take effect and ask you to re-consent.

Contact

Privacy questions: support@sendunsaid.com. See also our Terms of Service.