Privacy policy
Last updated: October 14, 2026
Stirloom is made by The Open Apps, Inc., a Delaware corporation ("we", "us"). This policy covers the Stirloom plugin in ChatGPT, the website stirloom.ambientapp.ai, and the printed books we sell. It explains what we collect, why, who receives it, how long we keep it, and how you can delete it.
The short version
- We collect only what we need to make, print and deliver your book.
- We never sell your data, show ads or send marketing email.
- Payment card details go straight to Stripe. We never see or store your card number.
- You can delete a book at any time. Its files are erased within 24 hours.
What we collect
| What | Where it comes from | Why we need it |
|---|---|---|
| Photos of recipe cards (front and back) and scanned PDFs of cards | You, through ChatGPT or the book editor; relatives, through the family link | To straighten them, show them in the editor and print them in the book. When a photo arrives we save a new copy without its hidden details, such as where and with which phone it was taken, and delete the file as sent (for a card from a family link, once its safety check is done). |
| Recipe text: title, cook, category, servings, times, ingredients, method and notes | Typed by ChatGPT from your cards, by you, or by a relative | To lay out and print the book |
| Names you choose to give us: cook names, the book title, subtitle and dedication, and the name a relative types on the family link | You and relatives | To print them in the book and show who added each card |
| Book, recipe and order numbers | Created by us | To keep your book, recipes and orders together |
| A scrambled (hashed) form of the anonymous user ID that ChatGPT sends with each request | ChatGPT | So your books are shown only to you, in any chat. We never receive your name, email address or chat history from ChatGPT. |
| Your approximate country, if ChatGPT shares it | ChatGPT | To show the right price before checkout. We keep only the country, with your order and in technical logs. |
| Order details: recipient name, delivery address, email address, phone number, number of copies, amount paid and payment status | You, at checkout on our website (collected for us by Stripe) | To take payment, print and ship the book and email you about the order. The carrier needs a phone number for delivery. |
| A scrambled (hashed) form of a relative’s IP address | The relative’s browser, when they add a card | To stop misuse of family links |
| Safety-check results for cards from a family link: whether the text or a photo was flagged, and the category (for example "harassment") | Our automated safety check | To hold back a flagged card before anyone sees it |
| Support messages: your name, email address and message | You | To answer you |
| Technical logs: the time, the page or tool used, and errors. For requests from ChatGPT, also the language and app type ChatGPT reports, your approximate country, and scrambled (hashed) forms of the user, conversation and workspace IDs ChatGPT sends | Your browser or ChatGPT | To keep the service running and secure and to find problems. Logs never contain recipe text, photos, file links, addresses or card details. |
We don’t collect payment card numbers, your ChatGPT conversations, your contacts or your precise location. We don’t use your photos or recipes to train AI models.
About ChatGPT. When you use Stirloom in ChatGPT, OpenAI handles your conversation and the files you share under OpenAI’s privacy policy. ChatGPT reads your cards and sends Stirloom the photos and typed text of the cards you choose to add. We receive only what ChatGPT sends to Stirloom.
How we use it
- To make your book, show it to you in ChatGPT and the editor, and print it.
- To take payment, ship the book and send order emails: confirmation, shipping and any problem with the order.
- To answer support requests.
- To prevent misuse and keep the service secure. Cards relatives send through a family link (the photos and the typed text) go through an automated safety check before the organiser sees them; a flagged card is held back and never shown.
- To keep the records that tax and accounting law require.
We don’t sell or rent personal data, share it for advertising, build marketing profiles or send marketing email. Relatives who add cards never receive email from us.
Who receives it
| Recipient | What they receive | Why |
|---|---|---|
| Stripe, Inc. | The order amount and items, and what you enter at checkout: name, email, phone, delivery and billing address, and payment details | To process your payment |
| Lulu Press, Inc. | The print files of your book and cover, the recipient’s name, delivery address, phone and email, and the number of copies | To print and ship the book. Lulu passes delivery details to the carrier (such as USPS, FedEx, UPS or Canada Post). |
| Postmark (ActiveCampaign, LLC) | Your email address and the content of order emails | To deliver order emails |
| Hetzner Online GmbH | Our servers, database and stored files | Hosting |
| OpenAI | For cards sent through a family link: their typed text, including the cook's name, and their photos, without location or camera details, for the safety check. What Stirloom sends back to ChatGPT: book contents, recipe text, the family link, order numbers, order status, delivery dates and tracking links. If you choose Type these with ChatGPT in the editor, the card photos you picked are added to your chat. | So ChatGPT can show your book and answer your questions. OpenAI's moderation service also checks the photos and text relatives send through a family link, under OpenAI's API data terms. |
Inside a family book, the organiser sees each card a relative sends and the name they typed. People who open a family link see the book’s title and the short name the organiser is shown by.
We may also disclose information when the law requires it, or to protect people from harm. If our business is sold, the buyer must keep this policy’s promises for the data it receives.
How long we keep it
| Data | How long |
|---|---|
| Books that were never ordered | 12 months after the last activity, then deleted |
| Books that were ordered (recipes and print-size photos) | 24 months after the last delivery, so the family can order again |
| Original photos, at full size | 90 days after the first order ships (print-size copies stay with the book) |
| Print files (PDFs) | 30 days after shipping; we can make them again from the saved book |
| Order name, address, phone and email | 12 months after delivery |
| Order amounts and order references | 7 years, for tax and accounting |
| Scrambled IP addresses of relatives | 30 days |
| Technical logs | 30 days |
| Support emails | 12 months after the conversation ends |
| Anything, on request | Deleted at once; files are erased within 24 hours |
Your choices
- Delete a book. Ask ChatGPT to delete your Stirloom book, or email us. We delete it at once and erase its files within 24 hours. For a book that was paid for, we keep the order record for the periods above and the print files until 30 days after shipping.
- See or correct your data. You can see and edit everything in a book in the editor. Email us for a copy of your order details or anything else we hold.
- Relatives can ask the organiser to remove their card, or email us with the book title and the name they used.
- Close a family link. In the editor, switch off Accepting new cards. Email us if you need a new link.
- California residents have the right to know, correct and delete personal information. We don’t sell or share personal information for cross-context behavioral advertising, and we won’t treat you differently for using your rights.
We answer every request within 30 days. We may ask you to confirm a detail of your book or order so we know the request is yours.
Children and teens
Stirloom is for general audiences and is not directed at children under 13. Teens aged 13 to 17 may use it, for example to add a card to their family’s book. Buying a book needs a payment card and is meant for adults. Cards from relatives don’t go into a book until the organiser approves them. If you believe a child under 13 has sent us personal information, email us and we will delete it.
Security
- All connections to Stirloom are encrypted.
- Books are tied to a scrambled ID, and family, checkout and order links use long random codes. Anyone who has one of these links can open that page, so share them only with family.
- Photos and print files are served only through signed links that expire.
- Card payments are handled by Stripe, which is certified to the highest level of the card industry’s security standard (PCI DSS Level 1).
Cookies
Our website sets no advertising or analytics cookies. The checkout page loads Stripe, which sets its own cookies to process the payment and prevent fraud, as described in Stripe’s cookie policy.
Where data is processed
We are based in the United States. Our servers are run by Hetzner Online GmbH. Stripe, Lulu, Postmark and OpenAI may process data in the United States and other countries, each under its own privacy and security commitments.
Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use data we already hold, we will say so on this page before it takes effect and, for open orders, by email.
Contact
The Open Apps, Inc. Email: support@theopenapps.com