Privacy Policy

1. The guiding principle — a closed community, not a publication

Every community site on the Service is private: there is no open signup, no way to discover a community you were not invited to, no access for strangers, and sites are not indexed by search engines (noindex). Admission is by personal invitation or by a class link on which every join request requires human approval by the community organizer (unless the organizer explicitly chooses an open mode).

Community data serves the community alone. We do not sell personal information, we do not pass it to advertising networks, and we make no commercial use of it beyond operating the Service itself.

2. What information we process

Account details: email address and name, as provided at signup or sign-in (Google or email).

Yearbook material: the yearbook pages uploaded by the community organizer, and the photos and names derived from them. This material may include personal information about alumni who have not yet signed up — we treat it as personal information in full, and it is accessible only to members of that same class.

Content members upload: a “now” photo, profile text, city, posts, comments, likes and photos — including group photos. Whoever uploads content affirms they are entitled to do so (see the Terms of Service), and any person appearing in content may request its removal.

Community activity: poll votes, meeting RSVPs, payment markings managed by the organizer, and notifications.

Support: the content of messages sent to us through the contact form.

3. Basis for processing and division of responsibility

A member who claims their card gives explicit consent at the moment of claiming; that consent is the basis for displaying their profile and any content they choose to add.

Yearbook material is uploaded by the community organizer, who affirms they are entitled to upload it. Until a card is claimed by its owner, we hold this material in a limited and secured way, for a single purpose: to let members of that class — and them alone — find themselves and reconnect. Any person may demand removal at any time, with or without an account.

The community organizer is the primary decision-maker over their community's content — they decide who is invited, what is uploaded and what is deleted. We operate the infrastructure on their behalf, and we are responsible for its security, its isolation and for honoring the privacy rights described in this policy.

4. What we never do — product commitments

No public exposure: no search-engine indexing, no open signup, no cross-community access.

No selling data and no tracking-based advertising: we do not run advertising networks (Google Ads, Meta and the like) inside community sites, we do not set third-party tracking cookies, and we do not build behavioral profiles of users.

No server-side face recognition: face detection for photo cropping runs only in the user's browser and yields crop boundaries only — no biometric templates, no embeddings, no face matching, and no biometric identifiers as defined by laws such as the Illinois Biometric Information Privacy Act (BIPA).

No AI processing of a person's face without that person's own consent: AI photo-enhancement features run only on photos of a person who consented themselves, and an enhanced result is shown to others only if the person depicted explicitly approved it. These features are currently off.

No bulk yearbook download: the Service does not offer downloading the full yearbook as a file.

No use of your likeness to promote the Service: members' photos are not used in advertising or marketing without separate, explicit consent — consistent with U.S. right-of-publicity laws.

5. Analytics and geolocation

To measure usage and improve the Service we collect aggregate analytics only, with no link to a name or identity. We do not build personal profiles and do not track an individual user over time beyond an anonymous, rotating activity token (a session identifier not linked to an account).

We record coarse geolocation at country level only, derived server-side, without storing the full IP address and without city-level data. Location is kept in aggregate and is not linked to a name, profile or account.

6. Retention, deletion and backups

Community content is kept for as long as the community is active. The organizer can delete content — including the original yearbook pages — or the entire community; deleting a community deletes its content.

Account deletion is available at any time from the “My account” page and deletes the personal information associated with it.

Backup copies are kept for a limited period for resilience only and are purged on a rolling basis; deleted or removed data is not restored from backup except for disaster recovery, in which case deletion and removal requests are re-applied.

We are formalizing a detailed retention schedule for each class of data (source material, photos, system logs and backups); this policy will be updated when it is complete.

7. Your rights

Export: you can download a copy of your data at any time from the “My account” page.

Deletion: you can permanently delete your account at any time.

Removal without an account: any person appearing in a photo or in the yearbook — even if they never signed up — can request removal through the removal-request form at the bottom of every community site. Removal requests are handled promptly.

Appeal: a member blocked from a community is informed and can file an appeal from within the Service.

We extend these rights — access, export, deletion and removal — to everyone, regardless of state or country of residence. We do not sell or share personal information as those terms are defined under U.S. state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA).

8. Historical photos and minors

The Service is for adult communities only: an organizer affirms that everyone appearing in the yearbook is an adult today, and the system enforces a graduation-year threshold. We do not open communities for classes whose members are minors.

Historical photos show people as they were in the past — sometimes as minors — but relate to today's adults. We treat these photos with particular sensitivity, and a parent or guardian may request removal of a photo at any time.

9. Where the Service operates

The Service is operated by an Israeli company and currently intended for users in Israel and the United States; it is not directed at other markets, including the European Economic Area. Expansion to additional regions will be accompanied by the adaptations required under local law.

10. Data security

Every community is isolated at the database level (Row-Level Security): a member of one class cannot access another class's data, and this isolation is continuously tested.

Our support staff has no standing access to members' personal information; support access is granted only with approval, is time-limited, audited, and visibly disclosed in real time.

Data is stored with established infrastructure providers (Supabase/AWS, Vercel, Google) and encrypted in transit. Additional sub-processors: Resend (operational email), Anthropic (the organizer AI assistant — see below), and a payment processor (once payments are enabled).

11. The organizer AI assistant

An AI assistant is available inside the management console to help a community's organizer with questions about running their community. It is available to the organizer only — members are never exposed to it and never converse with it.

To produce an answer, we send the following to our sub-processor Anthropic (Claude): the organizer's typed question, our own product documentation, and an aggregate snapshot of the community — counts and rates only (how many members, how many cards are claimed, how many people visited or contributed this week, content totals, and how many requests are waiting).

What we do not send: member names, email addresses, photos, posts or comments. No individual is identifiable from those figures. The assistant also cannot take any action on the site — it answers and points to the relevant page.

Organizer conversations are retained for up to 90 days for quality and abuse review and may be reviewed by us; this is disclosed to the organizer when the assistant is opened. Anthropic does not train models on this data. If an organizer chooses to type a member's identifying detail into a question, that detail reaches the sub-processor, so we advise against it.

12. Changes and contact

A material update to this policy will be published on this page with its date of update.

For any question or privacy request, contact us through the contact form and we will reply by email.