Othersun — Privacy Policy

Last updated: 10 November 2026

Operator: Timothy Goode, trading as Goodeboy

Contact: privacy@goodeboy.com

Othersun is a daily ritual: at your sunrise or sunset you photograph the sky, write a short note and send it to a stranger somewhere else in the world, and someone else's comes back to you. This policy describes exactly what the app stores, who sees it and what you can remove. It is written to match what the software does.

The short version

We need an email address to sign you in. Nothing else is required.
Your location is used and stored as a city only. Your phone works out which city you are in, and your coordinates never leave it.
A postcard travels with your photo, your note, a first name if you choose one, your city, your country, your local time and which sun it was. Nothing else about you. Nobody who receives it can learn your email, your account or how to reach you.
Photos are re-made on your phone before upload, and no location or camera data survives in them.
Every postcard and written reply is checked automatically before anyone receives it.
Whoever receives your postcard can share it, showing your first name and city. You are told this the first time you send.
No advertising, no analytics and no tracking. You can delete your account in the app, and it takes your postcards and replies with it, everywhere.

What we store

To sign you in

Email address, used to send a one-time code. If you sign in with Apple, Apple gives us an address (it may be a private relay). We never send marketing.

About you

That you confirmed you are 18 or over, and when. We do not ask for or store a date of birth.
A sign-off name, if you choose one: a first name of up to 16 letters. Leave it blank and your postcards say "Someone".
Which suns you send at (sunrise, sunset or both) and how early you want a nudge.
Quiet hours, so a notification isn't delivered at 3am.
When you first sent a postcard, as the record that you were told whoever receives it can share it.

Where you are

The city you are in: its name, country, time zone and the centre point of the city (taken from a list of cities that ships inside the app).

Your phone asks for an approximate position, turns it into a city name on the phone, and sends only the city. We never receive or store your coordinates, a street, an address or a live position. The city is refreshed when you open the app, so the sun times follow you when you travel. If the city can't be worked out you can choose it yourself.

Postcards

For each postcard you send:

The photo, re-encoded on your phone (2048 pixels on the long edge, plus a small thumbnail). Every metadata segment, including GPS and camera details, is removed before upload, and the server refuses any image that still carries any.
Your note (up to 120 characters) and the prompt it was written under.
Your sign-off name and city as they were when you sent it. Changing them later does not change postcards already sent.
Which sun, the date and your local time.
Who it went to (held on the server only), their city, the distance between the two cities, a card number, any rarity it earned, and whether it has been opened.

Photos are stored in a private bucket. They are never publicly addressable: each viewing needs a short-lived link the server only issues to the sender and the person who received it.

Responses

If someone responds to your postcard, or you respond to one: which thank-you was chosen, or the written reply, the responder's sign-off name and city as they were at the time, and whether it was delivered.

To make the app work

A push notification token, if you allow notifications, and the queue of notifications we will send you (a postcard arrived, someone responded).
Sun nudges are scheduled on your phone. They are not sent by us.

Safety

Blocks, reports (including anything you write in a report, and a copy of what was reported), items you have hidden by reporting or blocking, and moderators' decisions.

Who sees what

Who	Sees
The person who receives your postcard	Your photo, note, sign-off name, city, country, local time and which sun. Never your email, account or any way to contact you.
You, about a postcard you sent	The city it went to, the distance, whether it was opened, and any response with the responder's sign-off name and city.
Anyone they show it to	If they share your postcard, an image with your photo and/or note, your first name and city.
Moderators	A reported postcard or reply, and what was said about it. Not who sent it.

There is no profile, no search, no list of people and no way to message anyone. You can respond to a postcard once.

Checking content before delivery

Every postcard (photo and note) and every written reply is checked by an automated moderation service before anyone receives it, to keep out nudity, violence, hate, contact details, people's faces and the like. The service is Anthropic's Claude, which receives the photo and the note for that check only. If a check can't run, the postcard waits and is checked again; it is never delivered unchecked. If something is refused, we say only that it couldn't be sent.

Who else processes it

Who	What they handle	Why
Supabase	Database, sign-in, file storage, server functions	Runs the service
Anthropic	Each postcard's photo and note, and each written reply	Automated moderation before delivery
Resend	Your email address and the sign-in code	Sends the code
Expo	Notification text and your push token	Relays notifications
Apple (APNs) and Google (FCM)	Notification text and your push token	Deliver notifications

They process this on our instructions to run the app. We do not sell personal data and we do not share it for advertising.

What we do not collect

Precise or background location, your contacts, your photo library (Othersun only ever adds an image to your library when you tap Save image, and never reads it), your full name, your date of birth, payment details, advertising identifiers, or any analytics or tracking software. We do not record which screens you use or for how long.

How long we keep it

As long as your account exists.

Deleting your account (You → Delete account) removes your profile, your city, every postcard you sent and its photos, including from the collections of the people who received them, every response you wrote, your blocks, your push tokens and your notifications. It cannot be undone and we keep no copy.

What survives: if something of yours was reported, the report remains, with your account detached from it and a copy of what was reported, so a pattern of abuse can't be erased by deleting an account. Postcards other people sent you belong to them and stay theirs.

A postcard that is refused by moderation is deleted, photos included.

Your choices

Change or remove your sign-off name: You → tap your name.
Choose which suns, and when you're nudged: You.
Turn notifications off in your phone's settings at any time.
Report or block from any postcard you received, or any reply to one you sent.
Delete your account: You → Delete account.

Depending on where you live you may have rights to access, correct, export or restrict the processing of your data. Write to privacy@goodeboy.com and we will respond within 30 days.

How to reach us

By email, at privacy@goodeboy.com. We answer within 30 days.

If you are not happy with how we handle a privacy matter, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or, in the UK or EU, to your local data protection authority.

Children

Othersun is for adults. You must be 18 or over to use it, and you confirm this when you sign up. If we learn an account belongs to someone under 18 we delete it.

Where data is held

London, United Kingdom (AWS eu-west-2). If you are outside the UK your data is transferred there to run the service. Moderation checks are processed by Anthropic in the United States.

Credits

The city list comes from GeoNames, used under the Creative Commons Attribution 4.0 licence. Sun times are worked out with SunCalc (BSD licence). Instrument Serif and IBM Plex Mono are used under the SIL Open Font License.

Changes

If this policy changes materially we will say so in the app before the change takes effect.