Privacy Policy

1. What information do we collect?

Personal information you provide to us

The personal information we collect depends on how you interact with the Services and the choices you make. It may include:

• Name and shipping address. Collected when you claim a season, used to print your book's shipping label and deliver it to you.
• Email address. Collected if you choose to sign in with Apple (you may use Apple's private relay email), if you join our website waitlist, or if you email us. Used for service emails (such as "your season has wrapped"), account security, and responding to you.
• Book photos. The photos you approve for your printed book — approximately 30 per season — plus any photos you later swap in. See Section 2 for a complete description of how photos are handled. Before upload, the app removes the embedded metadata from each photo file — including GPS coordinates. So that we can print the caption on each page, the app separately sends each photo's capture date and a general place name (such as a city and state), worked out on your device; exact coordinates never reach our servers. We use this caption information only to produce your book — to arrange it chronologically and to print the date, day, and place alongside each photo — and for no other purpose.
• Purchase and subscription information. Records of what you purchased, the amount, when, the season it covers, and your subscription status.
• Communications. The contents of messages you send us, such as support emails and feedback.

We never collect passwords. njuta accounts do not use passwords. An anonymous account is created automatically on your device so your books belong to you, and you may optionally secure it with Sign in with Apple.

Sensitive information. We do not intentionally collect sensitive personal information (such as racial or ethnic origin, health information, religious beliefs, sexual orientation, or biometric identifiers), and we do not ask you for any. Be aware that photos you choose for your book may themselves depict or reveal such information about you or others; we process the photos you approve solely to print and ship your book, and for no other purpose.

Payment data. Payments are processed by Stripe, Inc. ("Stripe"), including payments made through Apple Pay. Your card number and payment credentials go directly from your device to Stripe — we never receive, transmit, or store your full card number or security code. Stripe provides us a payment reference (token) associated with your customer record so that we can charge your seasonal subscription, issue refunds, and comply with financial record-keeping laws. Stripe's privacy policy is available at stripe.com/privacy.

All personal information that you provide to us must be true, complete, and accurate, and you should notify us of any changes (in particular, a change of shipping address before your book prints).

Information collected automatically

• App usage analytics. We use TelemetryDeck, a privacy-focused analytics service, to count product events — for example, that a book was claimed, or that a user reached a given step in setup. These signals include an anonymized device identifier (a salted, one-way hash that we cannot reverse to your device or identity) and basic device information such as model, operating system version, locale, and screen size. TelemetryDeck does not receive your identity, your photos, your location, or any advertising identifier; we do not use the IDFA; analytics are not linked to your account; and we do not use analytics for advertising or tracking across other apps or websites. We use this data only to understand and improve the app.
• Server and security logs. Like nearly every online service, our infrastructure automatically records technical information when your device communicates with our servers — such as IP address, request timestamps, and device/OS type — used for security, fraud prevention, rate limiting, and troubleshooting. Our logs are designed to never contain your photos or photo content, and we minimize personal information in them.
• Website information. When you visit njutabook.com, our website host and the third-party services embedded in specific features (our waitlist form and payment checkout) may set strictly necessary cookies and receive standard technical data. See Section 6 and our Cookie Policy.

Application permissions

If you use our app, we request access or permission to certain features of your device:

• Photo library access. Access to your photo library is the core of the product — it is how njuta finds and sorts your season's photos. All of this happens on your device; granting photo access does not send your library to us. You may grant full or limited access, and you can change this at any time in your device Settings. See Section 2.
• Face ID. Used only, and optionally, to lock your own "set aside" photos behind your face on your own device. Face ID matching is performed by iOS on your device; we never receive Face ID data or any biometric information.
• Notifications. Used to notify you when your season wraps and your book is ready to review. Our season-wrap notification is scheduled locally on your device — declining notifications does not affect your order.

We do not request access to your camera, microphone, contacts, or device location.

Information from other sources

We do not collect information about you from public databases, data brokers, marketing partners, social media platforms, or any other outside sources.

2. On-device processing: your photo library

This section describes the complete life cycle of your photos, because it is the heart of both the product and this policy.

On your device. When you grant photo access, njuta scans and sorts your library — analyzing image quality, detecting faces, grouping similar shots, recognizing which people appear most often in your photos, and screening potentially sensitive images out of view — entirely on your iPhone, using Apple's on-device frameworks. No photo, thumbnail, face data, or analysis result from this process is transmitted to us or to anyone else. Face-recognition groupings exist only on your device, are used only to improve which photos are chosen for you, and are never uploaded. If you never claim a book, nothing about your photos ever leaves your device.

When you claim a season. After you approve your book and pay, the app uploads the approved photos (approximately 30) to our servers over an encrypted connection, so that a printable copy of your book exists even if you never open the app again. Before each photo is uploaded, the app strips its embedded metadata — including GPS coordinates — from the file, and sends only the photo itself along with a capture date and a general place name derived on your device for the printed caption. If you later change your book — including during the adjustment window after your season ends — the app quietly uploads only the changed photos. Uploaded photos are stored in private, encrypted storage that is accessible only through short-lived, authenticated links scoped to your account.

What we use uploaded photos for. One thing: producing and shipping your printed book. We do not use your photos to train machine-learning models, we do not analyze them for advertising or profiling, we do not share them with any artificial-intelligence service, and we do not sell or license them. You retain all rights you have in your photos; you grant us only the limited permission needed to store, format, review, print, and ship them as your book.

Human review before printing. Before each season's books are sent to production, authorized Njuta personnel review the final print files. This review exists to (a) ensure print quality, and (b) screen for content that we or our print partner cannot lawfully or contractually print (for example, sexually explicit imagery or content that is illegal to reproduce). This is the only routine circumstance in which a person at Njuta views your photos. Personnel performing this review are bound by confidentiality obligations. We may also access your uploaded photos when you ask us to (for example, a support request about your order) or where required by law.

Locking and printing. At the close of your season's adjustment window, your book is locked and rendered into a print file. The print file and shipping details are provided to our print partner solely to print and ship your book.

Retention and deletion. The uploaded source photos are automatically deleted from our servers 30 days after your book ships (or promptly if you cancel before printing). Your finished book — the rendered file exactly as it was printed — is kept for as long as your account exists, for two purposes only: so your past books remain reliably viewable in the app, and so you can reorder a printed copy of a past season. Everything — source photos, book files, and your account — is deleted if you delete your account. Deletion is enforced by an automated process, not a manual promise.

3. Do we use artificial intelligence or machine learning?

njuta's curation — scoring image quality, detecting faces and near-duplicates, recognizing recurring people, and screening sensitive content — is powered by on-device machine-learning built on Apple's Vision and photo frameworks. This processing happens on your iPhone's own hardware.

To be explicit about what we do not do:

• We do not transmit your photos, photo analysis, or personal information to any third-party AI or machine-learning service provider (such as OpenAI, Anthropic, Google, or any other model provider).
• We do not use your photos or personal information to train, fine-tune, or improve any machine-learning model, ours or anyone else's.
• We do not build or contribute to any facial-recognition database. Face groupings are computed and stored only on your device for the sole purpose of choosing better photos for your own book, and are deleted if you delete the app or revoke photo access.
• We do not use AI to make decisions about you that produce legal or similarly significant effects.

4. How do we process your information?

We process your personal information for the following purposes:

• To provide the Services. Creating and maintaining your account, syncing your approved book to our servers, and displaying your order status.
• To fulfill and manage your orders. Charging the seasonal subscription price you agreed to, rendering your print file, screening it for printability, submitting it to our print partner, shipping it to your address, and handling refunds, replacements, or delivery problems.
• To manage your subscription. Processing recurring seasonal charges you have authorized, handling failed payments, and processing cancellations.
• To communicate with you. Sending transactional, service-related messages — for example, payment receipts (sent by Stripe), season-wrap notices, shipping confirmations, and responses to your support requests. We send marketing communications only if you separately opt in, and every marketing email includes an unsubscribe link.
• To keep the Services safe and secure. Fraud monitoring and prevention, abuse prevention, rate limiting, debugging, and enforcement of our Terms of Service.
• To evaluate and improve the Services. Reviewing anonymized usage trends (see TelemetryDeck in Section 1) and aggregate, de-identified statistics to understand how the app is used and make it better.
• To comply with our legal obligations. Maintaining tax and bookkeeping records, responding to lawful requests, and establishing, exercising, or defending legal claims.

We do not process your personal information for targeted advertising, we do not sell it, and we do not use it to make automated decisions with legal or similarly significant effects.

5. When and with whom do we share your personal information?

Service providers. Companies that perform services on our behalf under contracts that restrict their use of your information to providing those services:

Legal obligations and protection. We may disclose personal information where we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or enforceable governmental request; to enforce our Terms of Service; or to protect the rights, property, or safety of Njuta, our users, or others (including fraud prevention).

Business transfers. If Njuta is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, personal information may be transferred as part of that transaction. We will ensure the recipient honors commitments at least as protective as this policy or notify you before your information becomes subject to a different privacy policy.

With your direction or consent. We may share information for any other purpose you explicitly direct or consent to.

What we never do: We do not sell or rent your personal information. We do not share it with third parties for their own marketing. We do not share it for cross-context behavioral or targeted advertising. We do not share your photos with anyone other than the infrastructure and print providers listed above, strictly to produce your book.

6. Do we use cookies and other tracking technologies?

On njutabook.com, cookies may be set only by the third-party services that power specific site features: Formspree (when you join the waitlist) and Stripe (when you make a payment, including via Apple Pay). These are necessary for those features to function securely. We do not currently use functional, analytics, or advertising cookies on the website; if that ever changes, we will update our Cookie Policy and this policy first.

In the app, there are no cookies, no advertising SDKs, and no advertising identifiers. The only third-party measurement is the TelemetryDeck analytics described in Section 1, which uses an anonymized, salted device identifier — never for advertising or cross-app tracking.

Full details, including your choices, are in our Cookie Policy.

7. How long do we keep your information?

We keep personal information only as long as necessary for the purposes described in this policy, unless a longer period is required or permitted by law. Specifically:

• Uploaded source photos: automatically deleted 30 days after your book ships. To be precise about the full window: your book photos are held on our servers from the moment you claim your season (or later sync a change) through the end of the season, its adjustment window, printing, and shipping, plus 30 days — so a photo uploaded early in a season may be held for several months before the ship-plus-30-days deletion runs. If you cancel an order before it prints, the photos for that order are deleted promptly. If you delete your account, they are deleted as part of account deletion.
• Finished book files: the rendered file of each book, exactly as printed, is retained for as long as your account exists, solely so that your past books remain viewable in the app and so you can order a reprint of a past season. Deleted when you delete your account.
• Account information (account record, display name, Apple sign-in linkage): retained while your account exists; deleted when you delete your account.
• Order and payment records (what was purchased, amount, date, shipping destination, Stripe references): retained for as long as needed for bookkeeping, tax, accounting, refund, and dispute-resolution purposes, as required or permitted by law, even after account deletion.
• Support communications: retained as long as reasonably needed to resolve your issue and maintain a record of our interactions.
• Anonymized analytics: contain no personal information and may be retained indefinitely in aggregate form.

When retention ends, we delete or irreversibly anonymize the information. Where immediate deletion is not technically practicable (for example, information held in encrypted backups), we isolate it from further processing and delete it when the backup cycle completes.

8. How do we keep your information safe?

Our first security measure is architectural: we avoid collecting what we don't need. Your photo library never reaches our servers; your card number never reaches our servers; there are no passwords to breach.

For the information we do process, we maintain technical and organizational safeguards including:

• Encryption of data in transit (TLS) and at rest on our infrastructure;
• Private storage for uploaded photos, accessible only through short-lived, authenticated, per-user links — never publicly listable or publicly accessible;
• Default-deny access controls at the database level, so each account can access only its own records, verified on every request;
• Authenticated, ownership-checked endpoints, request validation, upload limits, and rate limiting to prevent abuse;
• Signature verification on payment notifications so payment status can never be forged;
• Logging hygiene: our systems are designed to keep photos, full addresses, and credentials out of logs;
• Secrets management: third-party credentials are held server-side only and are never embedded in the app;
• Authentication tokens on your device are stored in the iOS Keychain.

However, despite our safeguards, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, and we cannot promise that hackers, cybercriminals, or other unauthorized third parties will never defeat our security. If a breach of security affecting your unencrypted personal information occurs, we will notify you as required by applicable law, in the most expedient time possible and without unreasonable delay.

9. Do we collect information from minors?

The Services are not directed at children under 13, and we do not knowingly collect personal information from children under 13. Because njuta is a paid subscription requiring a payment method and shipping address, you must be at least 18 years of age (or the age of majority in your jurisdiction) — or the parent or guardian of a minor consenting to and supervising that minor's use — to purchase a subscription. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe we may have collected information from a child under 13, contact us at hello@njutabook.com.

10. What are your privacy rights?

Deleting your account. You may delete your account at any time in the app (You → Delete account). Account deletion is real deletion: it removes your account records, your uploaded photos and print files from our storage, your personal details from our systems, cancels your subscription for future seasons, and detaches your payment record at Stripe. Books already sent to print will ship as ordered. Order records required for bookkeeping and tax purposes are retained as described in Section 7.

Managing device permissions. You can revoke or limit photo library access, Face ID, or notifications at any time in your device Settings. Revoking photo access stops all on-device processing of your library.

Withdrawing consent. Where we rely on your consent to process personal information, you may withdraw it at any time by using the relevant in-app control or contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

Canceling your subscription. You may cancel at any time in the app. Cancellation stops future seasonal charges; it does not refund a season already paid, and a book already in production will still ship.

Marketing communications. We send marketing email only with your opt-in, and you can unsubscribe at any time using the link in any marketing email or by contacting us. You will still receive essential service messages (receipts, shipping notices, season-wrap notices) while you have an active order or subscription.

Corrections. To correct your shipping name or address before your book prints, update it in the app or contact us promptly at hello@njutabook.com.

If you have questions or comments about your privacy rights, email us at hello@njutabook.com.

11. Controls for Do-Not-Track features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting you can activate to signal your preference not to have your online browsing activities monitored and collected. Because we do not track visitors across third-party websites or serve targeted advertising, there is no cross-site tracking for a DNT signal to disable on our Services. No uniform technology standard for recognizing and implementing DNT signals has been finalized, and we therefore do not respond to DNT browser signals at this time. California law requires us to disclose how we respond to DNT signals; this paragraph is that disclosure. If a standard we must follow is adopted in the future, we will describe our compliance in a revised version of this policy.

12. Do United States residents have specific privacy rights?

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or another state with a comprehensive consumer privacy law, you may have the rights described in this section, subject to certain exceptions provided by law.

Categories of personal information we collect

The table below describes the categories of personal information (as defined under California law) that we have collected in the preceding twelve (12) months, or expect to collect through the operation of the Services:

We collect this information directly from you and from your use of the Services, for the purposes described in Section 4, and we retain it for the periods described in Section 7.

Sale, sharing, and targeted advertising

We have not sold or shared personal information (as "sell" and "share" are defined under the California Consumer Privacy Act) in the preceding twelve (12) months, and we do not sell or share personal information, including the personal information of anyone under 16. We do not process personal information for targeted advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects. Because we do not sell or share personal information, no "Do Not Sell or Share" opt-out is necessary; we honor the spirit of universal opt-out signals such as the Global Privacy Control by not engaging in the practices they exist to stop.

Your rights

Subject to certain exceptions, you have the right to:

• Know/Access — confirm whether we process your personal information and access it, including the categories collected, the purposes, and the categories of third parties to whom it is disclosed;
• Delete — request deletion of your personal information (the fastest way is in-app account deletion);
• Correct — request correction of inaccurate personal information;
• Portability — obtain a copy of the personal information you provided to us in a portable format;
• Limit use of sensitive personal information — we do not use sensitive personal information for purposes requiring this right, but you may exercise it nonetheless;
• Non-discrimination — not receive discriminatory treatment for exercising any of these rights.

Depending on your state, you may also have the right to obtain a list of the categories (or, in some states, the specific identities) of third parties to which we have disclosed personal data. That list, in full, is the provider table in Section 5.

How to exercise your rights; verification; appeals

To submit a request, email hello@njutabook.com or write to the address in Section 16. For deletion, the in-app control (You → Delete account) is the fastest and most complete path.

We will take reasonable steps to verify your identity before responding — typically by confirming control of the email address or account associated with the information — and we will only use the information you provide in a request for verification. We will respond within the time required by applicable law (generally within 45 days, with an extension where permitted). You may designate an authorized agent to submit a request on your behalf; we may require proof of the agent's authority and verification of your identity.

If we decline to act on your request, you may appeal by replying to our response or emailing hello@njutabook.com with the subject line "Privacy Appeal." We will respond to your appeal within the period required by law and explain our reasons in writing. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine the Light"

California Civil Code § 1798.83 permits California residents to request, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. California residents may nonetheless submit such a request using the contact details in Section 16.

13. Users outside the United States

The Services are operated from the United States, our servers are located in the United States, and printed books currently ship only to United States addresses. If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those of your jurisdiction. By using the Services, you consent to that transfer and processing in accordance with this policy. If you are located in a jurisdiction granting you additional rights (for example, the European Economic Area or the United Kingdom), you may contact us at hello@njutabook.com to exercise them, and we will honor applicable requests.

14. Photos that include other people

The photos you approve for your book will often include people other than you — family, friends, guests. When you approve photos for upload and printing, you are responsible for ensuring you have any permission needed from the people depicted (or, for children, their parent or guardian) to include them in your printed book. We process photos of third parties who appear in your book only on your instruction and only to produce your book, under the same protections and retention limits described in this policy. If someone believes a photo of them has been processed through our Services improperly, they may contact us at hello@njutabook.com.

15. Do we make updates to this policy?

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this policy. If we make material changes — especially any change to how photos are handled, what we collect, or with whom we share — we will notify you by prominently posting a notice on our website, by an in-app notice, or by email, before the changes take effect where required by law. We encourage you to review this policy periodically.

16. How can you contact us about this policy?

If you have questions or comments about this policy or our privacy practices, you may contact us:

17. How can you review, update, or delete the data we collect from you?

Depending on the laws of your state or country of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correction of inaccuracies, or deletion of your personal information, and to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law.

• To delete everything: use the in-app control at You → Delete account — this is the fastest and most complete path, and it takes effect without needing to contact us.
• To review, access, correct, or obtain a copy of your personal information, or for any other request: email hello@njutabook.com or write to the address in Section 16.

We will respond to every verified request in accordance with applicable data protection laws.