Privacy

Your data is yours.

Last updated October 30, 2026. Written to be read, not to be skipped.

The short version

We don't sell your data. Not a little. Not even to the nice company that asked politely.
No ads. No trackers. No analytics that follow you around. Nobody is watching you plan dinner.
Your password is scrambled one way. We can't read it. If you forget it, we can't tell you what it was, and we're okay with that.
Your people's names, numbers and emails are scrambled in our database too, so a stolen copy of it is a pile of gibberish.
Guests don't have accounts. They open a link, answer, and that's it. No profile, no follow-up emails, no "we miss you".
You can take everything with you, or delete everything, in one tap. Account, then Your data.
Curious how that compares with Facebook, Amazon and Google? We put it side by side, with sources.

That's the gist. The rest answers the questions a careful person asks, one at a time, and the last part is the fine print: still plain English, just more exact. If anything here is unclear, that's our bug: write to support@somedaysoon.me and we'll fix the page.

What do you collect, and why?

Only what the app needs to do its one job: turn "we should get together" into a date. Here is every kind, in full.

What	Why we need it	How long we keep it
Your name, email and password (as a one-way scramble)	To let you sign in, to address you, and so the person running Someday Soon can see who has joined and when.	Until you delete your account.
The email of anyone who asks for an invite (only an email, nothing else)	To send them a link when a spot opens.	Until we send the link, or 60 days, whichever comes first.
Which member's invite link you joined through, if you used one	So that member can see how many families joined through their link, as a number. Never your name.	Until you delete your account, or they delete theirs.
Your answers to the optional "what is it worth" survey (if you choose to answer)	To set a fair price. The answers are saved without your name, account or address, and the optional note is encrypted.	Until we have used them to set the price, and no longer than we need them. They cannot be traced back to you, so they cannot be edited or deleted individually. We only keep the date you answered on your account, so we don't ask twice.
Your device's notification address, only if you turn notifications on	So we can send you reminders and alerts on that device.	Until you turn notifications off, your device says it is gone, or you delete your account.
Your votes in the feature poll, only if you vote (on the Renovation page or from the newsletter). Signed in or from your own newsletter, the vote is tied to your account; otherwise to a random code in a cookie. Either way we keep only a scramble of it	So each person gets one vote per feature, which they can take back. Only the totals are ever shown.	Until you take the vote back, delete your account, or ask us to delete it.
Whether you get the monthly newsletter, and which issues were sent to you	So it goes out once a month, once to each person, and never to someone who opted out.	Until you delete your account.
An address for a plan, only if you give one	So guests know where to go, and so it can go on the calendar event.	As long as the plan, and then with it.
Friends: who you are connected with (a connection is made when you accept a request, or when someone signs up through your invite link, or you sign up through theirs), whether friends can find you, an optional phone number, and who can see when you are free (accepting a friend request shares free times both ways, and either of you can stop any time on the friend's page)	So you can connect with people you know and plan around each other's free times. Finding you needs your exact email or phone: nobody can browse or search. It is on when you sign up (the sign-up screen says so, and you can switch it off there or any time on the Friends page), and with it off nobody can find you. What a friend sees is free times, never what you are doing. When a friend invites you in the app, they see when you opened it; someone who isn't your friend never does.	Until you remove the friend, change the setting or delete your account.
A passkey, only if you add one: its public key, a name you gave the device, and when it was last used	So you can sign in with your fingerprint, face or device PIN. The secret part never leaves your device, so what we keep cannot sign anyone in.	Until you remove it or delete your account.
What kind of phone you use (iPhone or iPad, Android, or something else), only if you tell us	To show you the right help. Until you say, the page goes by what your browser tells it, once, to draw the page: that is never saved or sent anywhere.	Until you change it or delete your account (the guess is not kept at all)
Your Google Calendar connection, only if you connect it: a login token (encrypted), the address of the Google account, and which calendars you chose	So we can see when you are busy (to offer only times that work) and hold the times you offer and put the plans you confirm on your calendar, with no copying by hand. Details are in the Google Calendar section below.	Until you disconnect it or delete your account.
Your family's name, time zone, free and busy time	To suggest times that really work, in your clock.	Until you delete your account.
The names, phone numbers and emails of the people you invite	So the invitation can be texted or emailed to them.	Until you remove them or delete your account.
What a guest answers: the time they pick, who's coming, food needs, a note, an email if they choose	So the plan can actually happen.	With that plan, until it's deleted. Their link stops working 30 days after the last offered time.
Server logs: which page was asked for, when, from which internet address, and error reports with a reference number	To keep the app running and fix it when it breaks. They never contain passwords or private link keys.	Rotated automatically; a few weeks at most.
Backups of the database	So a broken disk doesn't lose your plans.	Deleted after 30 days, always.

We don't collect your location, your contacts list, your photos, your device's identity, or anything about what you do on other sites. If you tap "Choose from your contacts" on an Android phone, only the one contact you pick is read.

Google Calendar

Connecting a calendar is optional, and it is the only way we ever see anything from Google. This is exactly what happens:

What we read. The times your chosen calendars are busy (and what each event is called, held only for the moment we work out which times are free). We use it for two things: so a plan only offers times when you are really free, and to suggest open time when it sees you are usually free (like Tuesday evenings), which is only ever added if you say yes. We do not keep a copy of your events.
What we write. On the calendar you pick: while a plan waits for an answer, each time you offered, marked tentative so nobody books over it; then, for the time you confirm, one confirmed event (with the address, if you gave one, and your chosen reminders), and the other tentative ones are removed. We move or remove it if the plan changes. We do not change, delete or reply to anything else, and Google never emails anyone on our behalf.
What we store. A login token (encrypted in the database, never shown), the address of the Google account, and which calendars you chose. No person at Someday Soon reads your calendar.
What we never do. We don't sell it, share it, show ads with it, or use it to train any AI or machine-learning model. We use it only to provide the calendar features you can see in the app.
Taking it back. Disconnect in Account, then Calendar, and we delete the token at once. You can also remove our access any time at myaccount.google.com/permissions. Deleting your account removes the connection too.

Your calendar link (Apple Calendar and others)

Optional, and one way: it puts your plans on a calendar, and reads nothing from it.

What it holds. Your family's confirmed plans: what it is, who with, when, the note and the address you wrote. Never a guest's phone number or email.
Who can see it. Anyone who has the link, which is long and random and made only when you ask. Your calendar app uses it to look again about every hour. Keep it private.
Taking it back. Make a new link or turn it off in Account, then Calendar, and the old one stops working at once.

Someday Soon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Do you sell it? Share it? Use it for ads?

No, no and no. There are no ads in Someday Soon and there never will be. We don't have a "partners" list to share with, because there are no partners. The only outside services that touch anything are the ones listed below, they're there to make the app work, and we tell you exactly what each one can see.

How does this compare with the big platforms?

Here is the honest comparison. The "on the public record" side is what these companies' own policies, regulators and court records say, checked on October 31, 2026. Companies change, so every line links to where it comes from. We aren't saying these companies are villains, or that this is everything they do. We're showing how Someday Soon is built differently, and what we've promised.

Following you around the web

On the public record

Meta's privacy policy says it receives information about your activity on other companies' websites and apps, through tools such as the Meta Pixel and Facebook Login, including from people who don't have a Facebook account or aren't logged in. [1] [2]

Someday Soon

No pixels, no ad scripts, no third-party code on the page, and no analytics that follow you. The page's security rules only allow our own scripts, and our tests fail if a tracker is ever added.

Training AI on what people post

On the public record

Meta told Australian lawmakers in 2024 that it had used public posts and photos from adult accounts since 2007 to train its AI, and offered no opt-out there (as reported; private posts and under-18 accounts were not used). In the EU it began in May 2025, with an opt-out rather than asking first. [3] [4]

Someday Soon

Never. We don't train any AI or machine-learning model on anything you put here, and we say so in writing.

Faces, voices and recordings

On the public record

Texas won a $1.4 billion settlement from Meta over capturing facial-recognition data without consent. [5] Google settled with Texas for $1.375 billion over privacy claims including location tracking, Incognito mode and biometric data (Google did not admit wrongdoing). [6] The FTC charged Amazon with keeping children's Alexa voice recordings and not honoring deletion requests; Amazon paid $25 million and said it disagreed with the claims. [7]

Someday Soon

We never use your camera, microphone, location or photos, and we tell your browser not to allow them. Your contacts are only used if you tap "Choose from your contacts" on an Android phone, and then only the person you pick.

Selling, sharing and ads

On the public record

Ad-funded platforms earn money by letting advertisers reach you using what is known about you. Meta's policy describes receiving information about you from advertisers, measurement partners and data providers, and using it to show you ads. [1]

Someday Soon

No ads, ever. Nothing sold, nothing shared, no partners. The only outside services are the few listed on this page, there to make the app work, and each is described.

Hard-to-leave subscriptions

On the public record

Amazon agreed to pay $2.5 billion to settle an FTC case saying it used "dark patterns" to push people into Prime and make cancelling hard (Amazon denies wrongdoing). [8]

Someday Soon

Delete everything in one tap, immediately, after downloading a copy. Prices are shown before any charge, and cancelling will be as easy as starting.

What we do keep is in the table at the top of this page, in full: your name, email and phone (scrambled in the database), your plans and guests, the times you're busy, and server logs. We can't promise we'll never make a mistake. We can show what we built and what we wrote down, and you can hold us to it.

Where each line comes from

Meta Privacy Policy, sections on information from partners, advertisers and Business Tools.
The Markup, 2022: How we built a Meta Pixel inspector.
9to5Mac, September 2024: Meta scraped public Facebook and Instagram posts since 2007 for AI training (Australian Senate inquiry).
TechCrunch, April 14, 2025: Meta to start training its AI models on public content in the EU.
Texas Attorney General: $1.4 billion settlement with Meta over unauthorized capture of biometric data.
Texas Attorney General: $1.375 billion settlement with Google.
Federal Trade Commission, May 2023: FTC and DOJ charge Amazon with violating children's privacy law by keeping kids' Alexa voice recordings.
Jurist, September 2025: FTC settles Amazon Prime deceptive practices suit for $2.5 billion.

Spot something out of date or wrong? support@somedaysoon.me. We'll fix it and say what changed.

Who else can see anything?

Us, a little. The person running Someday Soon has an Admin page that shows how many accounts there are, when each was made (name and family name, never an email), how people joined, and counts of what's happening, like how many plans were made this week, with which families have reached each step (made a plan, sent one, had a get-together). It can't show your plans, your guests, or what anyone answered.

Cloudflare (Tunnel)
Carries traffic between your phone and the app, and keeps the app's real address private.
What it sees: The pages asked for, the time, and your internet address, as they pass through. It does not see our database.
DigitalOcean (where the app runs)
Rents us the server that runs the app and keeps its database, in their Toronto data center, in Canada. Nightly backups stay on that server, with a copy on the operator's own computer.
What it sees: Like any hosting company, they could technically reach what is on the server's disk: everything the app stores, which is scrambled (encrypted) where it is sensitive. Their terms limit what they may do with it.
Push notification services (Google, Apple or Mozilla, depending on your device)
Deliver a notification to your phone or computer. Only if you turn notifications on, and only to the devices you turned them on for.
What it sees: That a notification was sent to your device, and when. What it says is encrypted so that only your device can read it.
Google (Calendar), only if you connect it
Holds your calendar. With your permission we read when you are busy and write the plans you confirm.
What it sees: Which calendar events we ask for, and the plan events we add, change or remove. Google already holds your calendar; it learns only what we ask for and write.
Photon, from OpenStreetMap data (address suggestions), only while you type an address on a plan
Suggests places that match the address you are typing, so a typo is caught before guests see it. Nothing else uses it.
What it sees: The address text you have typed so far (once there are a few characters), sent through our server so your own internet address and cookies never reach it, with no name, account or plan attached. We do not store it. It is not used for saved addresses or anywhere else.
Resend (email)
Sends our emails: sign-in help such as password-reset links, notices about plans for people who gave an email address, and, to account holders, a newsletter once a month (on the 1st, only about what's new; opt out in one tap at the top of any issue, or in Account).
What it sees: The address it sends to, the message, and whether it was delivered. We turned off its link and open tracking, so it does not watch what you click or open.

That's the whole list. If we ever add one (say, card payments), you'll be asked first, and this page will say what it sees before it goes live.

Cookies

Three. All are ours, and neither follows you anywhere. There's no cookie banner because there's nothing to ask permission for.

_someday_soon_session: Keeps you signed in on this device, and keeps forms safe from other sites. Lasts up to 30 days from the last time you opened the app, or until you sign out.
color_mode: Remembers that you chose light or dark. Lasts a year.
voter: A random code, made only if you vote on the Renovation page, so each browser gets one vote per room. We keep a scramble of it, never the code itself. Lasts a year.

How is it kept safe?

Everything travels over an encrypted connection (HTTPS), and the app refuses to talk any other way.
Names, phone numbers, emails, addresses, notes and what is good to know about a guest are encrypted inside the database, and backups are made of that encrypted data.
Passwords are stored only as a one-way scramble (bcrypt). Sign-in is rate-limited and doesn't reveal whether an email has an account.
You can turn on two-step sign-in with an authenticator app.
The browser is told to load only from this site and to share nothing with others (a strict content security policy), and a set of automatic tests fails the build if a tracker, an outside script or an extra cookie ever sneaks in.
Private links are long random keys, and they're kept out of our logs.

No system is perfect, so if something does go wrong: we'll find out, fix it, and tell the people affected within 72 hours of knowing, plainly, saying what happened and what to do.

Your choices

See and take your data: Account, Your data, Download my data. One file, readable by any program.
Delete it: Account, Your data, Delete my account. Immediate. A family's admin deletes the whole family; a member deletes only their own login. Backups go within 30 days.
Fix it: change your name, email (with a code) and password in Account; edit or remove anyone you invited.
A guest who wants their answers gone: ask the family that invited you, or write to us and we'll do it.

Children

Someday Soon is for adults. Families plan with it, but we never ask for a child's name, age or details, and we don't knowingly make accounts for anyone under 16. If you think we hold something about a child that we shouldn't, write to us and it's gone.

If this changes

If we change what we collect or who can see it, we'll say so here and tell account holders before it takes effect. We will never quietly make this page weaker.

Contact

Questions, requests or complaints: support@somedaysoon.me. A person reads it.

The fine print

Still plain English, just more exact, for the people who need that.

Who is responsible for your data: Someday Soon is run by Zachary Stone, a person in the United States, trading as the Lunch Crew. For the personal data of people who hold an account, we are the "controller". For the data an account holder enters about the people they invite (names, phone numbers, emails), the account holder decides what to enter and we process it on their behalf to make the service work.
Why we are allowed to use it: To provide the service you asked for (performing our agreement with you), to keep it secure and working (our legitimate interest in a safe, reliable service), and to keep the records the law requires. We don't use your data for marketing or profiling, and we don't make automated decisions about you.
Where it is processed: In Canada (the server that runs the app and keeps its database, in Toronto) and the United States (Cloudflare, and the service that sends our emails). If you are in the European Economic Area, the United Kingdom or Switzerland, you may have the rights below; where data is transferred we rely on appropriate safeguards.
Your rights: Depending on where you live (including the GDPR and the California Consumer Privacy Act), you may have the right to access, correct, delete, restrict or object to our use of your data, to take a copy of it, and to complain to a data protection authority. We give everyone these rights, wherever they live, using the tools above or by email. We respond within 30 days. We will not treat you worse for using them.
California: We have not sold or shared personal information (as those terms are defined in California law) in the last twelve months, and we do not use it for cross-context behavioral advertising.
Retention: As the table above states. When an account is deleted its data is deleted at once from the live system and from backups within 30 days. We keep nothing to "remember" you afterwards.
Security incidents: We will notify affected people and, where required, the authorities, within 72 hours of becoming aware of a breach of personal data.