What we keep, why, and for how long.
A planner holds a lot of a life. Here is exactly what of it reaches us, and what we do with it.
- What we collect
- Your family's dates
- Your study choice
- Cookies and analytics
- Email from us
- Who else sees it
- What we never do
- How long we keep it
- Your choices and rights
- Children
- How we protect it
- Where we operate
- When this changes
- How to reach us
What we collect
Only what it takes to make your book, get it to you, and let you come back for the next one.
- Your account. Your email address, and a password only if you choose to set one, stored only as a hash. A display name, taken from the name on your first order unless you give us another. When you ask for a sign-in link, we record when, your IP address, and your browser's identifying string with it.
- Your book. Everything you type into the builder: the name on the cover, the dates you add with their labels (a birthday with a year prints an age, so the year is kept), the dedication, any phone number or email you put in the "if found" block, and every choice you make about layout, sections, and study. Your saved build is this, kept so next year starts from it.
- Your order. The shipping name, street address, and phone number you give at checkout; what you bought and what you paid; the carrier and tracking number once it ships. Card numbers never reach us. Stripe handles those and tells us only that the payment went through.
- Your approval. When you approve a proof, or agree to a subscription, we record the time, your IP address, and your browser's identifying string, alongside what you were shown. That record is how we can prove, later, what you agreed to and when.
- Your referral code and credit. The code assigned to your account, who used it, and the credit it earned. If a friend refers you, we keep the email address the referral was made to.
- Your email, if you ask us to write. If you join the waitlist, ask for the free week, or use "Email me this book," the address you gave, when you gave it, a scrambled version of your network address, and your browser's identifying string, so we can show you asked. More under Email from us.
- Your choices about cookies. Your choice is kept in a cookie on your device. If you're signed in when you make it, we also record it with your account, along with when, your IP address, and your browser's identifying string. When you start a checkout, your order notes whether analytics was on, so the events we report about that order follow your choice.
- If you're one of our creator partners. Your name, handle, platform, audience size, and code; our notes on the deal we agreed; the record of when you accepted the creator terms (with your IP address and browser string); and what you've earned and been paid. Bank and tax details go to Stripe, never to us.
- A creator's giveaway. If a creator's link brought you to the free week, asking for it enters their giveaway. We keep the entry's email, a scrambled network address, and the device id if analytics is on. The creator sees only a count.
- Your messages to us. Whatever you write to support, and our replies.
We don't ask for a birth date, a photo, a gender, or anything about you that the book doesn't need.
Your family's dates
A planner with birthdays already in it means you're giving us other people's names and dates, often your children's. They didn't sign up for anything, so we treat their information more carefully than our own customers': it exists to print a line on a page, and that is the only thing we do with it. We never build profiles from it, never match it against anything else, and never use it to decide what to show or sell you. If you ask us to delete your data, their dates go with it.
Your study choice
Choosing Come Follow Me, or a Bible reading plan, tells us something about your faith. We know that, and we want to be straight about what we do with it: we print the study you chose. It doesn't change what you're offered, what you pay, or what you see on the site. It never goes into our analytics with your name, email, or device attached. What we do count, once a week, is how many free weeks, proofs, and books each study went into, so we know which studies to put our effort into. A study with only a handful that week is grouped in with the others, so no count can point to one person. You can choose "none" at any time, and the book prints with the same number of pages given back to your life.
Cookies and analytics
We set two kinds of cookies of our own. The only other company that sets a cookie on our site is Stripe, on the payment page, to prevent card fraud.
Essential cookies keep the site working: one that keeps you signed in, one that protects forms from forgery, one that remembers the cookie choice you made, and, if you arrived through a friend's referral link, two that remember their code and how you arrived, for 90 days, so they get credit. These are on for everyone.
Analytics cookies help us see which parts of the builder people get stuck on and which pages lead to a book. They're on unless you turn them off. The first time you visit, we ask. Choose "Essential only" and we stop the analytics, delete their cookies, and honor that choice on every visit after. We still count the business's own events, like a sale, a shipment, a refund, or a giveaway entry, but with nothing that identifies you: no email, no device id, no name. You can change your mind any time from the cookie preferences link in the footer.
With analytics on, three things happen:
- We give your browser a random id, so we can tell that two visits came from the same device without knowing who you are. When you sign in, that id is attached to your account so your phone and your laptop count as one person.
- Google Analytics records which pages you visit and, if you buy, what you bought. It's keyed to that random id.
- PostHog, a product-analytics service, records how you move through the builder and which features you use. When you sign in, buy, or give us your email address, it's keyed to that address so we can follow one customer's path from first visit to book.
Error reporting is separate and always on. When something on the site breaks, a report goes to Sentry so we can fix it. It carries the technical details of the failure; with analytics off it carries no device id either.
On a few forms (signing in or creating an account, resetting a password, checkout, the waitlist, the free week, and "Email me this book"), Cloudflare Turnstile checks that a person is filling it in. It runs Cloudflare's script, sees your IP address, and exists only to keep bots out.
We never set advertising cookies or load advertising scripts, and apart from Stripe's on the payment page, we never let anyone else set cookies on our site. If you use an ad blocker, nothing here will fight it.
The cookies page lists every cookie by name, what it is for, and how long it lasts, and holds the same preferences you can reach from the footer.
Email from us
There are two kinds, and they follow different rules.
- About your own book or order. A receipt, a proof that's ready, a book that shipped, a plan that's about to make its next book, a sign-in link you asked for. These go to the address on the account or the order, and they can't be turned off while it exists; they're the point of having an address at all.
- Everything else. News and offers go only to an address that asked: by joining the waitlist, by ticking the box when you ask for the free week, or by switching it on under email preferences in your account. "Email me this book" also counts as asking: besides the link to your book, it sends up to three short reminders about that book over the next few days, and they stop for good when it goes in your cart, when you buy it, or when you unsubscribe. If you're signed in and already get our news, a book you leave unfinished gets the same reminders. Every one of these emails carries an unsubscribe link and our postal address, and the link works straight away and keeps working.
When you give us an address that way, we keep the address, when you gave it and under which version of this notice, a scrambled version of your network address (enough to check a claim, not enough to read), and your browser's identifying string. If you unsubscribe, we stop, and we keep the address marked do-not-email so we can't write to it again by mistake; typing it into one of our sign-up forms again counts as asking again. If an address bounces, we stop sending it news until you switch news back on in your account. If it reports us as spam, only a person here can undo that. Mail about your own order still goes either way. We keep these marks even if you ask us to delete everything else. Write to [email protected] if that's not what you want and we'll talk it through.
Who else sees it
Making and delivering a book takes a few other companies. Each one sees only what its job needs.
| Who | What they do | What reaches them |
|---|---|---|
| Stripe | Takes your payment and works out sales tax | Your email, shipping address and phone number, what you bought, and your card, which only they see |
| Our print partners | Print, bind, and ship your book in the United States | The print files, which contain your book, and your shipping name, address, and phone number. Questions about the job come to us, not to you |
| Google Cloud | Runs the site and stores its database and files, in the central United States | Everything above, held in private storage |
| Cloudflare | Sits in front of the site to block abuse, and runs the Turnstile check on a few forms | Your requests pass through it on the way to us, with your IP address |
| Postmark | Sends our email, including any news you opted into | The address and content of any email we send; Postmark tells us when one bounces or is marked as spam |
| Google Analytics | Page and purchase analytics | Page views and purchases, keyed to a random device id, only with analytics on |
| PostHog | Product analytics | How you use the builder, and purchases, keyed to your email once you sign in |
| Stripe Connect | Pays our creator partners (creators only) | A creator's name and email, and the bank and tax details they give Stripe directly |
| Sentry | Error reporting | Technical details when something breaks; no names, dates, or addresses |
We'll also hand over information if the law requires it, for instance a valid court order, and we'd tell you when we're allowed to. If the company is ever sold, your data goes with it under this same notice.
What we never do
- We never sell your personal information. Not for money, not for anything else of value.
- We never share it for anyone's advertising, and we don't use it for targeted advertising ourselves.
- We never build a profile of you or your family from what's in your book.
- We never let a third party set cookies on our site except Stripe on the payment page, and the only outside scripts we run are the analytics above (with analytics on), Cloudflare's bot check, and Stripe's payment page.
- We never read your book for any reason other than printing it or helping you when you ask.
These aren't legal formalities. Several state laws give you a right to opt out of the sale or sharing of your data; we don't offer that switch because there is nothing to switch off.
How long we keep it
Most of what we hold is the material for a book. Once the book is made, we keep as little of it as we can for as short a time as we can.
| What | How long | Why |
|---|---|---|
| Proof files | 24 hours, or until a newer proof replaces them | Only needed while you're looking |
| Print files | 30 days after your book ships; at once if the order is cancelled or refunded | So we can see any formatting errors and fix them directly if we need to reprint |
| Your saved build | Until you ask us to delete it | It's your setup for the next book, including after you cancel a subscription |
| A build started without an account | Until it's deleted; we don't yet delete these on a schedule | So you can come back to it, or claim it when you sign in |
| Order records | 7 years | Tax and accounting. This includes a copy of the book as approved. |
| Approval and consent records | 3 years, or 1 year after a subscription ends, whichever is longer | Proof of what you agreed to, as the law requires |
| Shipping and tracking | With the order record | Fulfillment history |
| Analytics | Per the service's own retention, keyed to a device id or your email | Product improvement, only while analytics are on |
| Waitlist, free-week, and "Email me this book" addresses | Two years from the last time you asked, or with your account once you have one. An address marked do-not-email keeps that mark for good. | So we never write to an address that stopped wanting us |
| Sign-in links | 30 days | So a link can be checked if something about a sign-in looks wrong |
| Support email | Until it's no longer needed to help you | Context for the next time you write |
A note on honesty: the order record's copy of your approved book means the names and dates in it are kept for the seven years the order is. We'd rather that record held only the price and the page count, and we're working toward that. Our mailing list deletes addresses on time, but some of the other limits in this table aren't yet enforced by automatic deletion: the copies of an address kept with free-week deliveries, giveaway entries, and build reminders; builds made without an account and the proof records behind them; orders; and approval records. The first of those deadlines is two years away, and automatic deletion will be in place before it arrives. Until then, this is what's true.
Your choices and rights
Whatever state you live in, you have the same rights here: to see what we hold about you, to correct it, to get a copy of it, and to have it deleted. There's no form and no hoop. Write to [email protected] from the address on your account and say what you'd like. We answer within 30 days.
- See it or get a copy. We'll send you your account details, your saved builds as a file you can open, and your order history.
- Correct it. Your build and your addresses you can change yourself on the site. Anything else, tell us and we'll fix it. You can also delete a saved build yourself, as long as you haven't approved it, ordered it, or started a plan from it.
- Delete it. We'll delete your account, your saved builds, and every date and name in them. Two things we have to keep: the financial record of any order, for seven years, and the record of what you approved or consented to, for as long as the law requires. We'll tell you exactly what stayed and why.
- Turn off analytics. Use the cookie preferences link in the footer, any time.
We won't treat you differently for using any of these. If you think we've handled a request badly, say so and a person will look at it again.
Children
The site is for adults. We don't knowingly collect anything from anyone under 13, and if we learn we have, we delete it. Children's names and birthdays that you put in your own book are covered under Your family's dates above.
How we protect it
Everything between your browser and us travels encrypted. Passwords are stored as hashes we can't reverse. Proof and print files live in private storage that can only be reached through links that expire, never a public address. Card details never touch our systems. The program that lays out your book runs on its own, apart from the site and its database, one book at a time.
No system is perfect. If we ever have a breach that affects you, we'll tell you what happened and what we're doing about it, as quickly as the law requires and sooner if we can.
Where we operate
We're a Utah company, we ship within the United States, and our systems run in the United States. We don't offer the site to people in the European Union or the United Kingdom, and this notice isn't written for those laws.
When this changes
If what we do with your data changes, this page changes first, and the date at the top with it. For a change that matters, we'll email the address on your account before it takes effect.
How to reach us
The Kept Year LLC
[email protected]
1853 S 1530 S
Spanish Fork, UT 84660
A person reads every message.