Privacy Policy

We collect only what we need to make and deliver your book or gift card and handle a review if you choose to leave one:

• Your contact details — your name and email address, so we can send your receipt, your digital copy and order updates.
• Gift-card details — the giver’s email address, the recipient’s email address, any giver and recipient names or gift message you provide, and the delivery date you choose, so we can send the receipt and gift message.
• Reference photos — one to three photos of the adult who stars in the book (the “recipient”), and, optionally, one to three photos of each of up to three adult sidekicks.
• Story details — the recipient’s first name and pronouns, who they are to you, the occasion if you choose one, who the book is from, your “Tell us about them” text, and anything you tell us not to joke about. Every title uses the same questions.
• Sidekick details — each sidekick’s name and relationship to the recipient.
• Photo checks — whether a face is visible, whether the photo is of one person, whether they appear adult and whether their eyes are hidden, plus an appearance description: hair, facial hair, glasses, eyes, skin, face shape and apparent age. The check is stored with each accepted photo.
• Generated character drawings — the portraits made before payment so you can judge the recipient’s likeness.
• Order and shipping information — the edition you choose and, for a printed book, the delivery address we pass to our print partner.
• Saved drafts — only if you choose to save your progress: the email address you give, the language you were reading the site in, and the draft itself: the selected book and edition, the recipient’s name, your answers, sidekick names, relationships and stored-photo references, and your photo confirmation. A saved draft never includes a shipping address. If you open its link in another browser, we also record that browser’s random character session key, so it can open the same character.
• Payment information — processed by Stripe. We never see or store your full card number.
• Reviews — if you choose to review a delivered book from the link in our review email, we collect your star rating, headline, review text and the name you give, linked to your order number and email so we know it comes from a real buyer.
• Usage and diagnostics — sanitized page addresses, referring source and campaign tags, browser and device information, approximate region, funnel steps, sanitized error reports, pseudonymous browser or session identifiers, and hashed IP addresses used to enforce drawing limits.

• To check uploaded photos, draw the recipient’s character, and write and illustrate the book you order.
• To take payment, and to print and ship a printed book.
• To send transactional email: your order confirmation, gift-card purchase receipts and recipient gift messages, an invitation to review a book once it has been delivered, and, if a checkout times out before you pay, one reminder with the link to finish paying.
• If you save your progress: to email you a note with a link back to your draft and, at most, one reminder later. The stop link at the bottom of either email ends every email about drafts saved under your address, including the checkout reminder above.
• To read every review before publishing it, and publish it only if you tick the separate review checkbox. We show your first name and last initial; for a Chinese, Japanese or Korean name written with a space, only the first part; for a one-word name, only its first character followed by a period. Without that tick, only we read it.
• To provide support, understand which pages help, diagnose errors and improve the site and the books.

We do not sell your personal information. We do not use uploaded photos to train AI models. We do not send marketing email unless you sign up for it.

• Photos of adults only. Hello Sorry books are adult comedy; we do not accept photos of children.
• For photos uploaded from the time this retention policy takes effect, the deletion deadline is 30 days after the book is delivered, never later than 120 days after upload. While any paid order using a photo is still progressing toward delivery, the deadline is 120 days after upload. If several orders use a photo and all have been delivered, the 30 days run from the latest delivery. When no delivery is coming (an unpaid, abandoned, canceled or refunded order), the deadline is 30 days after upload. Photos uploaded before this retention policy took effect keep their earlier rule: 120 days after upload while a paid, unrefunded order references them, otherwise 30 days after upload.
• They are never sold, shared with advertisers, posted publicly or used to train any AI model.
• You can ask us to delete them, and everything else we hold about you, at any time.

The recipient and any sidekicks are real adults who did not sign up with us themselves. We process their photos, names and the details you give us for your book, including the photo checks and the recipient’s character drawing. You confirm before uploading that they would be okay starring in it.

If you are someone who appears in a Hello Sorry book and want your photo or details removed, email hello@hellosorry.com. We will delete them and, where a book has not yet printed, stop it.

Where the GDPR or UK GDPR applies, we rely on: performing our contract with you (making and delivering the book or gift card, payment, transactional email) and the steps you ask for before ordering (keeping a draft you choose to save and emailing you its link and one reminder); our legal obligations (accounting and tax records); your consent (analytics where consent is required, and the optional newsletter), which you can withdraw at any time; and our legitimate interests (analytics where consent is not required, error diagnostics, fraud prevention, and processing the recipient’s and sidekicks’ photos and details for your book).

We never process a photo to uniquely identify anyone — no biometric templates are created or stored.

We use PostHog for product analytics, and Sentry (Functional Software, Inc.) for error diagnostics. Both receive sanitized data only: we strip email addresses, names, private links and typed form contents before anything leaves your browser or our servers, and we discard any error report that contains image data.

We also use Google Analytics 4 (Google LLC) to see how visitors find the site and whether purchases complete. It measures sanitized page addresses (never a private link or a query string), the referring site’s address, campaign tags, approximate location, browser and device information, the order steps we track and, for a completed purchase, the order number, the edition, the amounts and the currency. It uses first-party cookies when analytics is allowed. It never receives a name, an email or shipping address, a photo, typed answers or payment details.

For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics start only after you accept. If you decline, or before you choose, they stay off, and Google Analytics is not loaded at all, so Google receives nothing. Elsewhere they operate as permitted by law. Anyone can change the choice at any time in Cookie settings.

A small set of providers, each receiving only what its job needs:

• Stripe — payment processing.
• Our print partner — the print-ready book files and the shipping address.
• Railway and Cloudflare — hosting, content delivery, security and coarse country detection.
• Supabase — the database that holds your order, photo checks and character records, and private storage for uploaded photos and generated character drawings.
• Brevo — transactional email and, only if you opt in, the newsletter.
• Each photo you upload goes to Anthropic for the photo check. The recipient’s reference photos, the check’s appearance description and our prompts go to OpenAI to draw their character. The drawing goes to Anthropic for its safety check before we show it to you. All of this happens before you pay.
• PostHog and Sentry — sanitized analytics and error diagnostics, as described above.
• Google LLC — Google Analytics 4, for traffic-acquisition and purchase reporting, as described above.

When you give a gift card, we share your email address with the recipient as the reply address on the gift message, so they can reply directly to you. This applies whether the gift message is sent immediately or on your chosen delivery date.

We may also disclose information when required by law, or as part of a merger, acquisition or sale of assets. We never sell your data.

Renji Labs, Inc. is based in the United States, and our providers may process information in the United States or other countries. Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on recognized safeguards such as the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

Hello Sorry is for adults. The site is not directed to anyone under 18, we do not knowingly collect information from minors, and we do not make books about minors. If you believe a minor has sent us information or a photo, contact us and we will delete it.

• For photos uploaded from the time this retention policy takes effect, the deletion deadline is 30 days after the book is delivered, never later than 120 days after upload. While any paid order using a photo is still progressing toward delivery, the deadline is 120 days after upload. If several orders use a photo and all have been delivered, the 30 days run from the latest delivery. When no delivery is coming (an unpaid, abandoned, canceled or refunded order), the deadline is 30 days after upload. Photos uploaded before this retention policy took effect keep their earlier rule: 120 days after upload while a paid, unrefunded order references them, otherwise 30 days after upload. Each photo’s stored check, including its appearance description, is cleared when the photo is deleted.
• Generated character drawings: stored separately from uploaded photos and not deleted by the photo-retention sweep.
• Finished book files: kept so you can re-download your purchase, until you ask us to remove them.
• Order records: kept for 7 years to meet accounting and tax obligations.
• Unfinished checkouts: if a checkout times out before payment, the order stays open, with the link Stripe gives us to finish paying, for up to 30 days, and is then canceled. Its photos keep their own deadline above.
• Saved drafts: a draft you choose to save, and the email address you saved it under, are deleted 30 days after you last save it, unless an order is placed for it; you can also ask us to delete them sooner. The stop link in a saved-draft email ends those emails; it does not delete the draft. A draft’s photos keep their own deadline above, and its link stops working before they are deleted, at most 14 days after it was sent.
• Analytics and error data: kept no longer than our providers’ configured retention periods.
• Google Analytics event data: up to 14 months; aggregated reports may remain available longer.

Wherever you live, you can ask to see, correct or delete the data we hold about you, and withdraw any consent at any time. Residents of the EEA, the UK and California have specific rights under laws such as the GDPR and CCPA, including access, deletion, portability, restriction and objection. To make a request, email hello@hellosorry.com. Requests are free; we verify them against the email address on the order and answer within one month. You may also complain to your local data-protection authority, though we would appreciate the chance to put things right first.

To stop emails about a draft you saved, use the stop link at the bottom of any of them; your draft stays saved. To delete it as well, email hello@hellosorry.com.

To leave only the Hello Sorry newsletter list, use the Hello Sorry unsubscribe link or enter your email at hellosorry.com/unsubscribe; emails about an order you placed still arrive. The email provider’s footer link labeled “unsubscribe from all Renji Labs email” and your mailbox’s “Unsubscribe” button stop all Renji Labs marketing email, including our sister brands.

• Necessary: two first-party cookies (NEXT_LOCALE and hsy_locale_source) remember which language you read the site in — 7 days when you open a language edition, 1 year when you pick one in the language selector. Local storage remembers your consent choice. It also keeps a random character session key (hsy_character_session) across closed tabs, used to authorize access to your character and count your daily drawings. Local storage also remembers how you first arrived at the site — the address of the page that referred you and any campaign tags in the link — kept for up to 90 days, and session storage remembers the same about the visit you are in now, so that when you place an order we can record where that order came from.
• Each explicit consent choice — accept, decline, a settings save or a withdrawal — also records an anonymous row on our servers as evidence of your consent choice. The row contains a random identifier your browser generates and keeps in its local consent record, your analytics choice, the banner version, the page’s language tag and a coarse two-letter country code derived from the network request. It contains no IP address, user agent, session key, account identifier or order identifier. The random identifier is the only link between one browser’s successive choices. Automatic grants based on region and Global Privacy Control signals are not explicit choices and record no row. We keep these rows as the record of consent and do not remove them in response to a request to delete personal data, because they identify nobody.
• Session storage remembers your in-progress book draft until you close the tab: the recipient’s name, selected book and edition, answers, sidekick names and relationships, stored-photo references, photo confirmation, character reference, email and the shipping address you typed. If browser storage is blocked, the draft and character session key last only for the current page view.
• Analytics (only when allowed): PostHog stores pseudonymous browser and session identifiers for about 1 year.
• Analytics (only when allowed): Google Analytics sets first-party cookies such as _ga and _ga_<stream-id>, which last up to 2 years, to tell pseudonymous visitors and sessions apart. A visitor who declines receives none, and declining later deletes them.

Use Cookie settings on the site to accept, decline or change analytics at any time, or clear cookies and storage in your browser.

We may update this policy as the product grows. When we make a material change we will update the date at the top and, where appropriate, tell you.

Questions? Email hello@hellosorry.com, or write to Renji Labs, Inc., 7775 Walton Pkwy, Ste. 100, New Albany, OH 43054, USA.