Privacy Policy

Private invitations and email choices.

Effective September 9, 2026 (UTC). These details apply to private studio invitations. Viewing or approving a design does not give permission for follow-up or marketing email.

Your email, your choice: we receive your address and email choice only when you submit the form. Typing, autofill, leaving the email field, checking a box or leaving the page does not save your address or send an email. The optional marketing checkbox is unchecked by default. You can explore your preview and continue with setup without subscribing.

When you continue, we may show one optional offer for studio marketing tips, new designs and Dayposter updates. Choose Yes, send me ideas to select marketing emails, or Continue without updates to keep going without them. Dismissing the offer never opts you in. A temporary setting in your browser tab remembers that the offer has been seen or declined; it contains no email address or personal identifier.

Preview and setup email: selecting Email me about this preview asks us to email you about that preview and help you get started. Selecting Continue during setup lets us send the setup and account messages needed to provide the service. Neither action by itself subscribes you to marketing.

Dayposter updates: to request studio marketing tips, new designs and Dayposter updates, choose the optional checkbox and submit using Continue or Email me about this preview. We send a confirmation email only after you submit that request; during setup, we wait until your setup submission succeeds. Your marketing subscription becomes active only after you confirm. Unchecking a box without submitting does not change an existing subscription; use the unsubscribe link or contact us. We continue to respect existing unsubscribe and do-not-contact requests. The mailing-list retention and unsubscribe provisions below still apply.

Earlier contact details: unsubmitted email drafts retained from earlier forms are removed after 30 days. Those drafts do not authorize follow-up or marketing email. Earlier contacts and design approvals do not become email consent. Separately recorded email requests retain their original purpose.

Invitation activity: we record limited first-party page activity linked to the studio invitation: page requests, recognized link-preview services or crawlers, browser-open signals and interactions with the page. This helps us see whether a preview was reached. We keep first and last activity times and counts. These signals cannot establish that a particular person opened the link, and automated browsers may look like visitors. Forwarded links remain associated with the original studio invitation.

The activity system does not keep raw IP addresses, full user-agent strings, referrers, typed content or page-query strings. It does not record screens or track across other websites. Short-lived page identifiers expire after 24 hours; daily activity details expire after 90 days. Invitation-level totals and first/last activity times remain with the retained invitation. Security rate limiting may separately use short-lived keyed digests.

You can turn invitation activity tracking off from the notice on the invitation. A first-party preference cookie remembers that choice for up to one year. We also honor supported Global Privacy Control and Do Not Track signals and limit invitation metrics to U.S. visits. The separate optional Cloudflare Web Analytics setting remains unchanged. Operator review visits are excluded when opened in review mode.

Retained designs and outreach: expiring a public preview closes access but does not delete its studio record, artwork or contact history. We retain these privately so we can recognize prior outreach and respond if you return later. Verified requests to remove personal contact data take priority over ordinary retention. Cloudflare stores these records; Resend handles requested email delivery. We do not sell this information or add it to another business’s audience.

For access, correction, deletion or a change to email preferences, contact hello@dayposter.com. We may verify ownership. Dayposter · 205 Hudson Street, 7th Floor, New York, NY 10013.

The short version.

We collect the minimum needed to post your schedule story each night, we share it only with the companies that make the service run, we never sell it, and you can close your account from its setup link or by email. We delete live account data within 7 days of a verified request, subject to the billing and restricted-backup exceptions below. We do not collect member or client lists, bookings, or payment details. We do process the public instructor names and photos your booking page shows, because they appear on the story.

Everything we collect,
item by item.

When you use the free demo, with no account:

• The website or booking-page link you type, and the email address you enter to get your setup link
• The public schedule at that link: class names, start times, instructor names, substitutes, cancellations, and instructor photos where your booking profiles show them
• Colors read from your public website, used to propose the design
• Your optional design-assistant requests and current appearance choices, used to refine the preview; short request records and results expire after 8 days
• Standard web logs: IP address, browser type, pages requested

When we set up your account:

• Your name and email address, and, if you add one, a second address that receives previews (the front desk)
• Studio name and time zone
• Booking platform and booking-page link, and the booking line shown on the story
• Brand: your accent color, logo file, typeface choice, design choice, and up to eight studio photos that you upload
• Settings: short class names, how substitutes are shown, the "spots left" tag, what is not shown, post time, frames, days off, preview time, and your choice for overnight changes: ask me first, or post approved updates automatically

When you connect Instagram:

• Your Instagram handle and the status of the connection
• The Instagram account id and the access token that authorize publishing to your account. Meta issues both when you approve the connection on Instagram's own screens. At launch they are held by our posting rail, upload-post, on our behalf; we hold the reference that ties your studio to its profile there.
• For each published frame, the rail's delivery reference

Every night:

• The schedule as it stood at preview time, and the rendered story images for the days you choose, including extra frames for a busy schedule
• What happened: previewed, approved, held, posted, skipped, or failed, and when

When you subscribe:

• Payment is handled by Stripe through a Stripe checkout page in the last step of setup. Your card number goes to Stripe and never touches our systems. We store your Stripe customer id, subscription id, plan, and billing status. You can request billing changes by email. Deleting your Dayposter account cancels its subscription.

When you email us or we email you:

• The emails we send, including the preview images inside them
• If you separately opt in to Dayposter updates: your email address, the consent wording and version, when and where you requested it, and when you confirm by email. Saving a preview does not by itself subscribe you
• Messages to stop@dayposter.com: our software reads the sender, subject, and body to find a STOP, START, or PAUSE, and records who sent it and when
• Everything else you write to us, in our support inbox

We do not collect your booking-platform login, your Instagram password, member or client lists, bookings, or your clients' payment details. We do process the public instructor names and photos your booking page shows, because they appear on the story.

How we use each item.

• Schedule data: to build your daily schedule story, and for nothing else.
• Brand and settings: to make the story look like your studio and post it the way you asked.
• Instagram handle and account id: to show you which account is connected and to make sure each story publishes to the right account. This is the only use of the basic-identity permission.
• Instagram access token: to publish your schedule story to your account. We use publishing access for that purpose. Dayposter does not read your messages, comments, follower lists, or insights as part of the service.
• Name, email, time zone: to run your account, send the evening preview and the confirmations, and answer you when you write. Posting emails include a control to stop posting.
• Each night's record: to send the preview, to run the second check before posting, to hold or post an overnight change the way you chose, and to tell you what happened.
• Billing data: to charge the subscription you chose, and nothing more.
• Optional email updates: with your separate confirmed consent, to send Dayposter news, product updates and offers. This does not enroll you in another Sleeping Bear Studio audience. You can unsubscribe at any time; account and posting emails stay separate.
• Web logs: to keep the service up and to investigate abuse.

We do not sell personal data. We do not share your personal data with advertising networks. Optional Dayposter marketing emails require the separate consent described above. We do not use your studio data to train models. The schedule shown on your story is not invented: it is built from your schedule, checked again before it posts, and shown to you first.

Who we share it with.

Only the companies that make the service run, and only what each one needs:

• Cloudflare: runs the software (Workers), the database (D1), image storage (R2, a private bucket with no public address), rendering (Browser Rendering), and inbound email (Email Routing), and hosts dayposter.com. It also processes optional design-assistant requests when that feature is enabled. Holds the service data listed above, plus request logs for a limited period.
• Resend: sends every email we send, previews inside. Holds your email address, each email, and delivery records.
• Stripe: billing. Holds your card, your invoices, and your Stripe customer record.
• upload-post (TONVI TECH SL, Spain): the posting rail that carries each story to Instagram through the official API at launch. Holds your Instagram account id and access token, each story image as it is published, and delivery records.
• Meta: Instagram itself. Holds your Instagram account and receives each published story.

We update this list before adding anyone to it. A person reads your replies; if we ever bring in a company to help answer them, it goes on this list first.

Beyond that, we disclose data only if the law requires it, or, with notice to you, as part of a sale of the business, in which case this policy's promises travel with the data.

How long we keep it.

• Demo drafts and renders: 7 days from the last change. Demo activity records expire after 30 days.
• Rendered stories, previews, and nightly schedule and delivery records: 30 days, then removed by the scheduled cleanup.
• Instructor photos fetched from booking pages: cached for 7 days, then removed or fetched again. Your uploaded photos remain with your account.
• Studio-review caches: 7 days. Optional design-assistant request records and results: 8 days. Setup-link rate-limit digests: 2 days. Design-editor monitoring keeps aggregate daily counts without studio identifiers for 90 days. Temporary preview-edit locks expire after ten minutes.
• Account, brand, uploaded photos, settings, and account activity: while your account is open. After cancellation, account configuration is kept for 90 days so you can return, then enters deletion. Ask sooner and live account data is removed within 7 days of your verified request.
• Instagram connection: until you revoke it or the account deletion process removes the studio profile and associated social connection at Upload-Post.
• Optional mailing list: unconfirmed requests are removed after 30 days. Confirmed email addresses and consent records are kept while you subscribe to the list. Unsubscribing or requesting account deletion removes the address and consent details from the list; a keyed, non-readable email digest and suppression timestamp remain to prevent accidental resubscription. These digests are not used as an audience.
• Deletion receipts: the email address is held only until the confirmation is accepted by our email provider. A minimal completion record is kept for 30 days to verify and safely retry cleanup.
• Support email and delivery records: support threads are handled separately when you request deletion. Our email provider keeps delivery records under its own retention policy.
• Billing records: invoices, tax records, and the associated Stripe customer record remain where required for accounting or legal obligations.

Restricted database recovery copies can retain deleted data for up to 30 additional days. These copies are not used to serve the product. If recovery is needed, completed deletion requests are reapplied before service resumes. Copies of published stories and archives in Instagram remain under your control.

Delete your account and data.

Open the setup link from your Dayposter account email, choose Delete account, and confirm. This first stops posting and closes existing account links. We then cancel the subscription, remove the Upload-Post studio profile and social connection, and delete the account, settings, uploaded photos, linked demo work, story images, and account records from our live database and storage. A story already being delivered may finish.

We complete verified deletion requests within 7 days and email a confirmation. Temporary provider failures are retried and escalated to a person; your studio stays stopped throughout. Required billing records and restricted recovery copies are handled as described above.

You can also email hello@dayposter.com with the subject “Delete my account.” This option is available to subscribers, former subscribers, demo visitors, and anyone whose data we hold. There is no fee. We may verify ownership so we remove the right records. Support inbox deletion is handled by a person.

Step-by-step instructions are at dayposter.com/data-deletion.

Your choices.

• Revoke Instagram access any time on Instagram's own screens; the token dies immediately.
• Stop posting any time: use a stop link and confirm on the next page, or reply STOP and confirm the request sent to your account email. Stopping posting and unsubscribing from marketing email are separate controls; using one never silently changes the other.
• Pause, skip a day, or change any setting by replying to any Dayposter email in plain English.
• Unsubscribe from marketing email with the link in any marketing message, without logging in. This does not change your posting schedule or subscription. Essential account and billing messages may still be sent when needed.
• See or correct your data: email hello@dayposter.com and we send you what we hold or fix what is wrong.

Security and storage.

Data moves over HTTPS and is encrypted at rest by Cloudflare. There is no account password: a one-use email link expires after 15 minutes and opens a secure browser session lasting up to 12 hours. We store a digest of the session identifier, its studio, verification and expiry times, and revocation status. Studio URLs do not grant account access on their own. Posting-action links require explicit confirmation and can be revoked. Keep sign-in emails private. The plain-language version of our security posture, what we touch, what we can never do, and who else touches your data, is at dayposter.com/security.

Cookies.

Dayposter uses essential cookies to keep your private preview and security checks working. Optional Cloudflare Web Analytics is cookieless and remains off until you enable it in our privacy settings. We do not load advertising or marketing tags. We remember your analytics preference in a first-party cookie; you can change it at any time on the cookies page.

Not for children.

Dayposter is a business tool and is not directed at children under 16. We do not knowingly collect data from children.

Changes to this policy

If this policy changes in a way that matters, we email account holders before the change takes effect and update the date at the top. We will not weaken the deletion promise.

How to reach us.

Sleeping Bear Studio LLC, doing business as Dayposter
hello@dayposter.com