Privacy Policy — Campfire
Last updated: 15 October 2026
Campfire is an app for fathers to write to their children. You will put things in here you may never have said out loud. This policy tells you exactly what happens to those words, in plain English.
Where something is only partly true, this policy says so. That is deliberate.
Who we are
Campfire is operated by Raistone Ltd, 28 Kingswood Rise, Four Marks, GU34 5BD, United Kingdom.
Questions, complaints, or requests about your data: sam.newman1212@gmail.com. We answer within 5 working days.
What we collect
Your email address. So you can sign in, and so we can send you a sign-in link. If you sign in with Apple and choose to hide your email, we only ever see Apple's relay address.
What you write. Your answers to the weekly questions.
What you record. If you answer by speaking, we store the audio recording and the text transcribed from it.
Your answers to follow-up questions. Answering a week's question is a conversation: we ask something that follows from what you said, and you reply. Those answers are stored the same way as any other entry, including the audio if you spoke them.
Your family details. Your name and your child’s name personalise questions, voice conversations and your book. If you choose to provide them during onboarding, we also store profile details such as age, gender, interests and birthday. You review these details before they are saved. The family introduction and memory features are explained below.
Photos you choose to add. We store the individual photos you attach to entries in private Supabase storage. We do not upload your whole photo library.
Notification settings. Which day and hour you would like to be reminded, and your phone's time zone, so that "9am" means your 9am.
A device token, if you allow notifications, so we know which phone to send them to.
We do not collect your device location, contacts or browsing history. We do not use advertising identifiers. Optional usage analytics and masked session replay are described below.
If you join the waiting list on this website, we store your email and optional campaign source in Supabase so we can contact you when Campfire launches. Joining sets no analytics cookie and does not subscribe you to a newsletter. We do not sell addresses or share them with advertisers. Ask us to remove your email at any time by contacting sam.newman1212@gmail.com. We keep waiting-list information until launch communications are complete or you request deletion.
If you preorder Campfire, Stripe handles payment on its own secure checkout. It processes your payment details, email, and billing or delivery information needed for the order. We use the order record, contact details and payment status to provide your purchase, arrange the included book, manage annual renewals and cancellations, and handle refunds. Stripe securely stores the payment method authorised at checkout for future £150 annual renewals. We do not receive or store your full card number or security code. Purchasing does not add you to the marketing waiting list. Website analytics and session replay are disabled, and we do not send purchase details to PostHog. Your website and app use the same Supabase account. Essential browser storage keeps you signed in and retains the referral code and checkout attempt while you complete payment. We store account-linked order records, payment references, referral attribution, qualification and refund states in Supabase. A payment-method fingerprint from Stripe may help flag duplicate or self-referrals for review; it is not a card number. Your referrer sees counts, never your name or email. We send transactional purchase, referral and reward updates through our email provider. Account and referral pages have no analytics or replay. Deleting an account removes its login and private content; necessary financial and refund audit records may be retained separately to fulfil outstanding obligations and record transactions. Stripe's processing is explained in its privacy policy.
Optional analytics and session replay
We use PostHog Cloud EU to understand which parts of Campfire are useful and where people get stuck.
Website analytics is currently disabled. When enabled, page visits and actions such as joining the waiting list or copying a letter are measured without identifying you by name or email. Before replay consent, PostHog uses no analytics cookies or local/session storage. It groups visits using a server-generated hash that changes daily; the incoming IP address and browser information are used to calculate that hash. Website visits are not linked to your app account.
When website analytics is enabled, you can separately allow session replay on public pages. This uses browser storage to connect activity in a session. Public website text is visible in replays; form inputs, including your email, are masked. Console and network recording are disabled, and the letter-writing page is excluded entirely. We count actions in the letter tool, but never send its writing, names or finished letters to PostHog. Choose Analytics preferences in the website footer to change your choice. We store your preference so we can remember it.
In the app, we ask you to review usage analytics and replay at the end of your first-time onboarding, after your family introduction is saved. Both switches are initially selected, but collection starts only when you save your choices. You can turn either switch off or choose Continue without sharing. Existing saved choices are respected, and you can change them in Settings. If you have already completed onboarding but have not made a choice on this device, we show the same review after sign-in. The preference applies to your account on that device. Analytics records screen names and actions such as completing onboarding or saving an answer, linked to your internal account ID. It does not include email addresses, family names, entry text, transcripts, audio or photos. IP geolocation is disabled. PostHog receives network requests but we configure it to discard stored client IP addresses.
App replay has its own switch and requires analytics to be enabled when you save your choices. It covers Home and settings, with text and images masked and personal panels blocked. Authentication, onboarding, your archive, memories, entries and voice conversations are excluded. No audio, console logs or network content is recorded.
Turning sharing off stops future collection and recording. It does not itself erase data already sent. Analytics data is retained under our PostHog plan's retention period. You may request erasure using the contact address below. Deleting your app account queues deletion of its linked PostHog profile, events and recordings; failed requests are retried, and event deletion is asynchronous. Your entries and recordings in Campfire are deleted independently, without waiting for PostHog. Website statistics cannot be looked up by your email because we never attach it to them.
What we do with it
Only what the app obviously needs:
Sign you in
Store your entries and show them back to you
Turn your recordings into text
Suggest follow-up questions about an entry you have written
Read those questions aloud, if you switch that on
Send you the weekly reminder, if you have asked for one
We do not sell your data. We do not share it for advertising. If you opt in to app analytics, an internal account ID links your usage events; we do not send your name or email to PostHog.
Who else touches your data
The companies that help us run this, each doing one job:
| Who | What they do | What they see |
|---|---|---|
| Supabase | Runs our database, sign-in and file storage | Your account and everything in it |
| Deepgram | Turns recordings into text | Your voice recordings only |
| Anthropic | Suggests follow-up questions and, when enabled, builds and recalls family memory | Your entry and its answers; relevant earlier excerpts when family memory is enabled |
| ElevenLabs | Reads a question aloud, if you turn that on | Questions for reading aloud; live conversations, names and relevant memory excerpts when you use voice conversation |
| Expo | Delivers push notifications | Your device token, and the words of the notification |
| PostHog Cloud EU | Optional app usage analytics, anonymous website measurement and consented replays | Screen/page visits, selected actions, public website text with form inputs masked, masked app interface and an internal app account ID; never your writing or recordings |
| Apple | Sign in with Apple, App Store | Your Apple sign-in |
| Stripe | Website checkout, annual renewals, payment receipts and refunds | Payment details, order information, email and billing or delivery details; never your Campfire memories |
These services process your words:
Deepgram transcribes recorded answers.
Anthropic reads entries and answers to suggest follow-up questions. When you enable family memory, it also reads past and future pages to build recollections with source quotes and connections between people, places and themes. Relevant earlier excerpts may inform later questions.
ElevenLabs reads questions aloud and processes live voice conversations, including your first name and your child’s name. When memory is enabled, relevant recollections and source excerpts may be shared during those conversations.
Your family introduction. During onboarding you can talk with Ember or write about you and your child. ElevenLabs processes the live voice conversation, and Anthropic helps draft your profile details. You review and confirm names, optional age, gender, interests and birthday before they are saved as profile context. The introduction is separate from your child’s journal. You can choose whether Ember uses it and future journal pages as memory.
Existing accounts have family memory off by default; new onboarding asks you to confirm your memory preference. In “What Ember remembers”, you can inspect sources, correct recollections, exclude topics, pause memory or forget it. Forgetting a memory excludes its whole source page from future memory learning, while keeping your journal. Forgetting everything disables memory and excludes all existing pages. This removes derived memory from Campfire; it does not recall data already processed by our providers or immediately remove backup copies. Topic matching may miss indirect references, so you can also exclude a specific page.
Anthropic does not train its models on data sent through its API.
If we have added a crash-reporting service, it receives error details only — never your entries, transcripts, email address or IP address.
Your data is stored in the European Union (Supabase, eu-west-1).
Transcription (Deepgram) and follow-up questions (Anthropic) may be processed in
the United States under appropriate safeguards. Neither keeps your words to
train anything.
Security, stated honestly
What is true:
Every connection is encrypted (HTTPS)
Your entries are encrypted at rest on the server
Your recordings and uploaded photos sit in private storage. The app uses temporary signed links to retrieve them; anyone who receives such a link can use it until it expires
The database itself refuses to hand your entries to any other user. This is not a setting we remember to check; it is enforced on every single request
What is NOT true, and we will not claim:
Campfire is not end-to-end encrypted.
We could technically read your entries, in the same way that any service which stores your writing could. We do not, and we never use your words to train anything. But we will not tell you it is impossible, because that would be a lie, and this is the wrong product to lie in.
If end-to-end encryption is what you need, Campfire is not currently the right app for you.
AI, and what it is not allowed to do
Your recordings are transcribed by machine. That transcript is stored exactly as it came back, in a field the database physically refuses to let anything change afterwards. You can correct your own words whenever you like; nothing else ever will.
A language model asks follow-up questions and, if you enable memory, creates a separate set of source-backed recollections. These may include tentative connections or patterns, which you can correct or forget.
AI does not rewrite your original journal. Derived memory is stored separately. Only you edit your own words; the original machine transcript remains unchanged.
Your words and recordings are never used to train AI models — not by us, not by our transcription provider under the terms we have agreed with them, and not by Anthropic, which does not train on data sent through its API.
How long we keep it
For as long as you have an account, because the whole point is that it lasts.
Payment and refund records are retained separately for fulfilment, accounting, tax and dispute obligations. Deleting your Campfire account does not erase records we are required to keep for those purposes. Contact us about an order or refund using the email below.
If you delete your account, your Campfire entries and recordings are removed immediately, and permanently from our backups within 30 days. Linked PostHog data follows the separate asynchronous deletion process described above. Not 30 days because we are slow — everything is removed within seconds — but because our host keeps automatic backups for around a week, and your data lives on in those until they expire. Thirty days is the honest number.
Your rights
You can, at any time:
See everything we hold. Settings → Send myself a copy gives you every word you have written as a plain text file. No request needed, no waiting.
Correct anything. Every entry is editable.
Delete everything. Settings → Delete my account. This genuinely deletes, including every voice recording.
Object, restrict, or complain. Email us at sam.newman1212@gmail.com.
If you are in the UK or EU, you may complain to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk).
Our lawful basis for processing is performance of a contract — we cannot give you the app without storing what you write — except for notifications, app analytics and masked session replay, which rely on your consent, withdrawable using the controls described above.
Children
Campfire is for adults writing to children. It is not intended for use by anyone under 16, and we do not knowingly collect data from children. Your journal may contain information about your child, including their name, the optional profile details you provide, and the stories and photos you choose to save. Those details come from the adult account holder.
Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect. Not by quietly updating a date at the top.