Your stories stay with the people they’re for.

What we collect

If you organize a Roast & Toast

• Your account: your email address and a password (stored only as a secure hash by our authentication provider).
• Your gift: the recipient’s name, the occasion, the title, and the tone you choose.
• A thank-you video, if you record one from the recipient and choose to share it with everyone who was invited.
• Purchases: if you buy a gift on our website, Stripe processes the checkout and we never see your full card number. We keep the order and payment identifiers, amount and currency, the gift and account it belongs to, its verification state, and any refund or dispute details, so we can confirm access and handle payment support. Please don’t send card details to our support mailbox.
• People you text: when you invite someone by text from the app, we save the name and phone number you picked so you can see who you’ve invited. The app only receives the contact you choose, never your whole address book. The text itself is sent by your phone’s Messages app, not by us.

If you add a story

• Your videos, stored privately. On the newer invitation page they are saved while you record, before you press Send; on the current page they are uploaded when you submit. Either way, the organizer, other contributors and the person the gift is for can’t see an unfinished upload. No account is needed.
• Your name, as you give it when you submit. If the organizer invited you by text, they already have the name and number they entered for you.
• Your agreement: when you confirm the notice before submitting, we record the time and which version of the notice you saw.
• A preview image: a still frame made on your device from your video and uploaded with it. We don’t analyze faces. It is stored with the video and shown only where that video is shown.
• Upload details: the video’s length and file type. Your browser keeps a private receipt, and may keep a copy of your recordings, so you can come back, retry or remove them. This depends on the browser; private browsing or cleared storage can lose it.

If a Roast & Toast is sent to you

• When you open it: the organizer can see when their link was first opened. We don’t collect anything else about you to show it.

If you visit this website

• Page views, counted with Vercel Web Analytics, which doesn’t use cookies. We strip everything after the page path before anything is sent, so private invitation links are never recorded.
• Standard server logs, such as IP address and browser type, kept by our hosting providers to run and secure the service.
• Product counts, such as “a story was added” or “a gift was opened”, recorded with the gift they belong to and a time. They never include names, phone numbers, videos, or invitation links. If a gift is deleted, its counts stay but are no longer connected to it.

How we use it

Only to run Roast & Toast: to let organizers create a gift, invite people, and watch the stories; to let contributors add, retry, or remove a story; to send account emails such as password resets; to keep the service secure; and to understand, in aggregate, which pages people use. We don’t edit, publish, or share stories anywhere else.

Who can see a story

A story goes to the organizer of that Roast & Toast, in their private collection. It isn’t public and isn’t shown to other contributors. The organizer may play it for the recipient or others, since sharing the gift is the point. Videos you have uploaded but not yet submitted are never shown to the organizer. Our policy is that Roast & Toast staff don’t open stories or unfinished uploads unless access has been granted in writing to help with a support request. This is a policy, not a technical barrier: the administrators of our storage provider account can technically reach stored files. Anyone with a shareable invitation link can add a story. If the organizer gives you a link made just for you, please don’t forward it.

When the organizer sends the finished Roast & Toast to the person it’s for, they get a private link that plays the stories the organizer included, with each contributor’s name, in any browser. Anyone with that link can watch until the organizer turns it off, takes the gift back, or deletes it, so it should be kept private too.

If the organizer shares a thank-you video from the recipient, anyone with a working invitation link to that Roast & Toast can watch it, even after it stops taking stories. Stories themselves are never shown on the invitation page.

Services that help us run Roast & Toast

These companies process information on our behalf, only to provide their service to us:

• Supabase: database, video storage, sign-in, and account emails. Our project runs in the US West (Oregon) region.
• Vercel: hosts this website, including Vercel Web Analytics. Our site is served from the San Francisco region.
• Stripe: processes website purchases and may act as the seller of record. It handles payment details under its own terms and privacy notice.
• Apple: distributes the iPhone app. Texts you send to invite people go through Apple’s Messages app on your phone.

The iPhone app asks for camera and microphone access only to record your videos. We store information in the United States. We may disclose information if the law requires it.

How long we keep it

• Stories, invitations, and the names and numbers you texted are kept until the organizer deletes the Roast & Toast, or deletes an individual story.
• A shared thank-you is kept until the organizer removes it or deletes the Roast & Toast.
• Videos you uploaded but never submitted are deleted from our servers 7 days after you last worked on them. On the newer page, where videos are saved before you send, they are deleted no later than 14 days after you started. Deletion runs on a schedule, so it can take a few hours more. A copy may remain in your own browser until you clear it or open the page again.
• Organizer accounts are kept until you ask us to delete yours.

Deleting is permanent: the video files are removed, not just hidden. Deleted stories and unfinished uploads are removed from our live database and storage. Our database provider also keeps routine backups for a limited period, so copies of database records, such as names and the list of videos, may remain in those backups until they expire.

Payment records are the exception. We keep them after a gift or account is deleted, for as long as we need them for tax, accounting, refund and dispute purposes.

Deleting your information

• Contributors: before you submit, you can remove your videos from the same page. After you submit, you can remove or replace your story from the same browser. If you no longer have that browser, ask the organizer to delete your story, or email us.
• Organizers: in the app, touch and hold a story to delete it, or use “Delete this Roast & Toast” at the bottom of the gift to remove every story, invitation, and texted phone number. To delete your account, use “Delete account” in your account settings. It removes your account and every Roast & Toast, story, invitation and texted phone number in it, except payment records (see above).

If you can’t use those options, for example you no longer have the browser you used or a link, email us. Tell us which Roast & Toast and which story or account you mean, and your name as you gave it. We may confirm with the organizer or ask a question to check the request is yours, then remove the story. We aim to reply within 30 days.

Your rights. Depending on where you live (for example, California and other U.S. states with privacy laws), you may ask us to tell you what we hold about you, correct it, or delete it, and you won’t be treated worse for asking. We don’t sell your personal information or share it for cross-context advertising. Use the privacy contact below to make a request.

Contact

Questions, requests to see or delete your information, or concerns: privacy@roastandtoast.app.

For help using Roast & Toast, such as a link that won’t open or an upload that won’t finish, email support@roastandtoast.app.

Roast & Toast is operated by Roast and Toast, LLC, a Utah limited liability company. Use of the service is also covered by our Terms of Service.

Roast & Toast isn’t meant for children under 13. If we learn that a child under 13 has shared information, we’ll delete it. If this policy changes in a meaningful way, we’ll update this page and the date at the top.