Privacy Policy

Effective October 7, 2026.

This is what Sundry Works collects, why, where it goes, how long it stays, and how to make it go away. Sundry Works is made and run by one painter. "We" and "us" below means that person.

The short version

Your paintings are yours. We do not sell anything about you, show you ads, track you around the web, or train anything on your work. What the app needs to do its job is described below, section by section, and anything here can be deleted by asking.

The waitlist

If you leave your email on the front page, that is what it is for: one message from [email protected] when there is something to try, and nothing before then. Your name and what you paint are optional, and only used to make that one message worth sending. A note of each sign-up is also emailed to that one inbox so it is not missed. Nobody else sees any of it, and it is never sold or shared.

To stop the form being flooded, the address your visit came from is kept for one hour, and only as a scrambled code that cannot be turned back into the address. Your entry stays on the list until you ask to be taken off it.

Your catalogue

For most painters, the photographs, stories and records you put into Sundry Works live in your own Dropbox, in a folder the app can see and nothing else can. That data goes straight from your device to your Dropbox and never touches a Sundry Works server at all. Dropbox's own privacy policy covers what Dropbox does with it.

A few painters without Dropbox use a hosted copy instead. For them, the same catalogue lives on our server, in a folder held just for that account, read and written only by that account's own copy of the app. The server keeps a copy of that folder from each of the last seven days, so a bad day can be undone, and we keep one more week of daily copies on a separate computer, so a failed disk does not take your catalogue with it.

Some of what you keep is about other people: the buyers and collectors in your contacts, for instance. That is your record, kept for your own use, and we do not look at it or use it. When the app publishes a painting to your website, buyer and sale details are left out.

Paying for it

Payments are handled by Stripe. Your card details go to Stripe and not to us - Sundry Works never sees them and has nowhere to put them. To start a subscription Stripe is given your email address, and Stripe has its own privacy policy which governs what it does with what it holds.

What is kept on this side is an identifier for your customer record, an identifier for your subscription, and one word saying whether that subscription is in its trial, paying, or stopped, and the date the current period ends. That is the whole of it. No card number, no expiry, no billing address.

Your account

An account is a folder on our server with a code name, the name we gave it when it was made, and a scrambled copy of your sign-in token. The token itself is not kept, only something that can check it, so a copy of the folder cannot be used to sign in as you. Paying, the scheduler, the comment gatherer and AI drafting in a browser each add to that folder, as described below.

If you lose your token and ask for a link back in, your account holds a scrambled copy of that one-time code and the time it stops working, and nothing else. It is deleted as soon as the link is used. The address the link is sent to is asked of Stripe at that moment and is not kept here, so no email address of yours is stored on our side at any point.

If you use the scheduler

The scheduler posts to Instagram, Facebook, Threads, Bluesky and Pinterest on a timer on your behalf. Connecting a platform means allowing Sundry Works to post there for you. It does not mean handing over your password. What the server keeps is the access pass each platform issues for that, and, if you connected Instagram, Facebook or Threads from a browser, the ID and secret of your own Meta app, so the pass can be renewed. A Bluesky app password is used once to get that pass and is not kept.

Pinterest is connected through Sundry Works' own Pinterest app, so there is no app or secret of yours involved. The server keeps the pass Pinterest issues and the pass that renews it, your Pinterest username so the app can show which account is connected, and the ID of the one board you choose for your pins. It asks Pinterest for your list of boards each time you choose one and does not keep it. It does not read your other pins, your followers or anything else on your account, and it only ever makes a pin when you press the button for that pin.

Those passes are kept in your account's folder where only the server can read them. They cannot be locked any tighter than that, and we would rather say so plainly: the whole point of the scheduler is to post while you are asleep, so the server has to be able to use them with nobody there. Disconnecting a platform in the app deletes its pass, and you can also withdraw the permission from the platform's own settings at any time.

A picture or reel waiting to be posted is stored on our server under a long random name, because Instagram, Facebook, Threads and Pinterest collect it from a web address rather than being sent it. Nobody is told that address except the platform. Once the post has gone, or has failed for good, the file is deleted.

If a post fails, or auto-post runs out of posts, the scheduler emails you about it, never more than once a day. The address is asked of Stripe at that moment and is not kept here. What your account keeps for this is when the last email went and which posts it has already told you about, and, if you press Hold, the time you pressed it.

If you use the Comments tab, the server gathers the comments people leave on your posts: each commenter's name or handle as the platform shows it, what they wrote, and when. It keeps them in your account so you can answer them in one place. None of it is shared, sold, or used for anything except running your posts and showing you your comments.

AI drafting

Stories and captions can be drafted by Google's Gemini or Anthropic's Claude, whichever you choose, using your own key with them, never ours. Drafting sends the painting's photograph and your description to the provider you picked. They pass through our server on the way, because that is where your key is kept, locked with your sign-in token so a copy of the server's files cannot use it. The photograph and description are not stored or logged on the way through. The server counts how many drafts you make each day, so it can stop a runaway bill.

Narration for reels uses ElevenLabs, with a key you paste in each time. The story text goes from your device to ElevenLabs, and the key is never saved anywhere.

What each provider does with what it receives is governed by its own terms, which differ between free and paid accounts and can change: see Google's Gemini API terms, Anthropic's privacy policy and ElevenLabs' privacy policy. You can also turn stories and captions off and write every word yourself.

Publishing to your website

If you connect your own WordPress site, the app sends paintings to it using a password you create in WordPress for the purpose. It is kept in your browser's storage on that device, and is never sent to our server.

Who else receives anything

Only the services you choose to use, and only what each needs:

• Dropbox holds your catalogue, if you keep it there.
• Stripe handles payment: your email and card.
• Meta (Instagram, Facebook, Threads) and Bluesky receive the posts you schedule, and send back their comments.
• Pinterest receives the pins you make: the picture, its title, description, alt text and link, and the board it goes to.
• Google or Anthropic receive a painting and its description when you ask for a draft.
• ElevenLabs receives a story when you ask for narration.
• Your own WordPress site receives what you publish to it.
• Our web host runs the server everything above passes through, and so holds what the server holds.
• Google Fonts supplies the lettering on these pages and in the app, so Google sees the address your browser asks from. See Google's note on what it logs.

Nothing is sold to anybody, and nothing is given to anybody else unless the law requires it.

No cookies, no tracking

These pages and the app do not use cookies, analytics, advertising trackers, or anything else that follows a visitor around. Like every web server, ours keeps ordinary technical logs of requests: the address a request came from, the time, what was asked for, and the browser that asked. They are used to keep the site running and to spot abuse, and are cleared by our host on its own schedule. The server's own log records what happened to each account, such as "post sent" or "key set", and never the content.

Links on Sundry Works' own posts on Bluesky, Threads and Facebook end in a short code, like sundry.works/?p=k7rw4f, so we can tell which post brought people here. When this page opens from one, the code is counted - the code and the day, nothing else - and taken out of the address bar. So that one person is counted once rather than every time they reload, a scrambled form of the address the visit came from is kept with that day's count and deleted the next day. If you go on to start a free trial from that visit, the code is kept with your account, so we can tell which post brought you - only the code, which says nothing about you.

The app keeps a few things in your own browser's storage, so you are not signing in every time: your Sundry Works sign-in token, your Dropbox connection if you use one, your WordPress password if you set one, and small preferences like which tab you were on. They stay in that browser, on that device. Clearing your browser's data clears them, and you sign in again.

Stripe's checkout page, if you go there to subscribe, is Stripe's own page and sets whatever Stripe sets. That one is theirs, not ours.

Keeping it safe

Everything travels over encrypted connections, accounts cannot see each other's folders, and the things that can be locked are locked, as described above. The one person who runs Sundry Works can reach the server's files, as the owner of any server can, and does not open anybody's catalogue except to help when asked. No system on the internet can promise to be perfectly secure, and this one does not either. If something ever goes wrong that affects your information, you will be told.

How long things are kept

• The waitlist: until you ask to come off it.
• Your account and a hosted catalogue: until the account is deleted. Stopping a subscription does not delete anything, so you can come back or take your catalogue with you.
• Daily copies of a hosted catalogue: seven days on the server and seven on the separate computer, each day replacing the same day last week.
• Pictures waiting to post: until they post.
• Platform passes: until you disconnect, or the account is deleted.
• Gathered comments: as long as the account exists.
• Billing: the two identifiers and status word as long as the account exists. Stripe keeps its own records for as long as the law requires of it.

Leaving, and deleting your information

If your catalogue is in Dropbox or on your own computer, it is already yours and stays exactly where it is. Nothing we do can delete it.

If your catalogue is hosted here, first take a copy: in Settings, Studio, press Export all, which saves the whole catalogue as one .zip file that another account, or a Dropbox, can open.

Then write to [email protected] from the address you use with Sundry Works and ask for the account to be deleted. Within 30 days, everything in it goes: the catalogue and the server's week of copies, the queue and its pictures, platform passes, AI keys, gathered comments and billing identifiers. The copies on the separate computer age out within seven days after that. Any subscription is cancelled at the same time. Stripe's records of past payments are Stripe's to keep.

You can also ask for a copy of what we hold about you, or for something to be corrected, the same way.

Getting in touch

Questions, or want your waitlist entry, your account or your subscription removed? Write to [email protected]. A person reads it.

Changes

If this changes, the new version replaces this page and the date at the top moves. If a change affects what happens to an account's information, account holders are told before it takes effect.