Privacy Policy

Last updated November 6, 2026

Waylum Inc., Ontario, Canada, runs Somewhere Up and is responsible for your personal data. Your memories are personal, so we keep as little as we can, never sell it, and never use it for advertising. This page says what we keep, why, and for how long.

What we keep and why

• Without an account. Stars and memories stay in your browser on that device. While you name a star, we briefly hold it for you (for about an hour) with a random id from your device and a one-way hash of your network, never your IP address itself.
• Account. Your email address and, if you sign in with Google or another provider, your name and profile picture, held by our sign-in provider Clerk. We keep an account id. Legal basis: to provide the service you asked for (contract).
• Your stars and memories. Each star’s name, who it is for, the occasion, your message and, if you add it, their birthday. The photos, videos, voice recordings and letters you add, with their captions and dates. Legal basis: contract. These can include details about other people, such as the person a star is for. Please add them only where you are comfortable doing so and, where needed, with their agreement.
• Sharing. Who a star is shared with and the links you create. People you share with see the star’s memories; birthdays are shown only to them, never to someone with just a link or to the public. Sealed letters are hidden from everyone but their author until their day.
• Payments. Polar, our merchant of record, collects your payment and billing details as an independent controller under its own privacy policy. We never see card details. Polar tells us what you bought so we can keep your star. We keep an order record (amount, date, star). Legal basis: contract and tax law.
• Security. IP addresses are used briefly to limit abuse. Our host Cloudflare processes them to deliver and protect the service and may keep them in short-lived logs. Legal basis: our legitimate interest in keeping the service safe.
• Reports and emails. If you report a star or write to us, we keep your message and email address to handle it.

We do not use your photos, recordings or letters for anything except showing them to you and the people you share with. We do not use them to train AI models.

How long we keep it

• Stars, memories and files: until you delete them or your account. After a refund, memories above the free limit are deleted after 30 days.
• Files you uploaded but never added to a memory: deleted after a day.
• Unsaved stars held without an account: released after about an hour.
• After deletion, copies can remain in our database backups for up to 30 days, then they are gone.
• Order records: kept for 7 years, as Canadian tax law requires.
• Reports: up to 2 years, to handle repeat abuse.

Deleting your account

My stars → Delete account removes your account, every star you own and everything in it (for everyone you shared it with), the memories you added to other people’s stars, and your place in stars shared with you. It can’t be undone, so make a backup first if you want to keep anything.

Cookies and storage

We use no advertising, analytics or tracking cookies, so there is no cookie banner. Everything below is needed for the app to work, and none of it is shared with anyone else.

• Sign-in cookies (set by Clerk, such as __session and __client_uat): keep you signed in and protect your account. Bot protection during sign-in may set a Cloudflare security cookie.
• Your stars on this device (local storage and IndexedDB): the stars you named, their memories, photos, videos and recordings, and your sky settings, so the app works without an account and opens quickly.
• A picture of each star you visited (local storage): shown while the star opens.
• A random device id (local storage): holds a star you just named for you until you sign in. It is not linked to your identity.
• Small reminders (local storage and session storage): whether you were signed in last time, the name you sign gifts with, and whether we already suggested saving your stars.

Clearing your browser data removes all of these. Stars saved to your account stay safe on our servers.

Your rights

Depending on where you live, including under Canada’s PIPEDA, the GDPR, UK GDPR and California law (CCPA/CPRA), you can ask to access, correct, delete or export your data, and object to or restrict how we use it. You can export everything yourself from My stars → Back up, and delete your account yourself. For anything else, email hello@somewhereup.com and we will reply within 30 days. You can also complain to your data protection authority, or in Canada to the Office of the Privacy Commissioner. We do not sell or share personal information, and we will not treat you differently for using your rights.

Children

Somewhere Up is not meant for anyone under 16, and we do not knowingly collect their data. If you think a child has an account, email us and we will delete it.

Security

Data is encrypted in transit. Your files are private: they are served only through links that expire within the hour, to people who may see that star. Access is limited to what is needed to run the service.

Where your data is and who helps us

We use these companies to run Somewhere Up. Each is bound by data protection terms.

• Cloudflare (United States): hosting, database, file storage and security.
• Clerk (United States): sign-in and accounts.
• Polar (United States): payments, tax and receipts, as merchant of record.

Your data may be stored and processed outside your country, including in the United States. Where the law requires it, transfers are covered by safeguards such as the EU Standard Contractual Clauses.

Changes

We will post updates here and email account holders about significant changes.

Contact

Waylum Inc., Ontario, Canada. Email hello@somewhereup.com.