Privacy Policy

Blue Energy People, Inc. builds and operates SUN. This policy explains how we handle personal information across the SUN web app, the mobile app, the Sun Public API, and the SUN connector for AI assistants such as ChatGPT, Codex, Claude, and Claude Code. It applies to everyone who signs in, and to the small amount of data we collect from visitors who do not.

• Account information

  Your email address, and the display name and avatar you choose. If you sign in with a third-party provider, we receive the basic profile that provider returns and nothing more. We never see your password.

• Prompts and source material

  The topic you type into the composer, and any text you paste or upload as source material for a course. This is the raw input to generation, so we store it alongside the course it produced.

• Generated courses and audio

  The scripts, chapter structure, cover art, and audio files that generation produces, plus the settings you chose (format, voice, length).

• Voice recordings

  If you create a cloned voice, we store the sample recordings you submit and the resulting voice model. We only ever create a clone from a recording you deliberately upload for that purpose.

• Listening and usage activity

  Which courses you play, how far through them you get, what you search for, and which features you use. This is what powers your library, your recents rail, and resume-where-you-left-off.

• Technical data

  IP address, browser and device type, and timestamped logs of requests to our servers. We use these for security, abuse prevention, and debugging.

• Website analytics

  If Google Analytics is on for your browser, how you use sunapp.ai. See Cookies and analytics below for exactly what, and how to turn it on or off.

• API tokens

  If you use the Sun Public API, we store a hash of each personal token you create along with its label and last-used time. We do not retain the token secret itself after you first see it.

We use the information above to:

• Generate the courses you ask for and deliver the finished audio to you.
• Keep your library, playback position, and preferences in sync across devices.
• Authenticate you, enforce quotas, and protect accounts from abuse.
• Diagnose failures (a generation job that errors is much easier to fix when we can see the prompt that produced it).
• Understand which features get used, in aggregate, so we know what to build next.
• Send you service messages, such as a notice that a long-running generation has finished.

We do not sell personal information or share it for cross-context behavioral advertising, and we do not use your prompts, uploads, or voice recordings to train our own general-purpose models.

Creating a course sends your prompt and any source material you provided to our generation service, which in turn calls third-party language and text-to-speech models to write the script and voice it. Those providers process the content to return a result and are contractually barred from using it to train their models.

Generated audio is stored in our object storage so you can play it again later. Courses are private to your account unless you explicitly share one, at which point anyone holding the share link can listen to it.

You can connect your SUN account to ChatGPT, Codex, Claude, Claude Code, and other AI assistants that support the SUN connector, and ask them to make courses, meditations, stories, and songs for you. Connecting means signing in to SUN and approving access. We keep a record of that connection, with an encrypted credential, so the assistant can act for you until you disconnect it or delete your account.

• What we receive

  Only what the assistant sends to SUN on your behalf: the topic or your own words for a course, meditation, story, song, or briefing, including any names and details you give (for example, your child's name in a bedtime story), the length, voice, characters, schedule, or time zone you chose, and files you attach. We treat these exactly like prompts and source material you enter in SUN, and keep them with what they produced.

• What we do not receive

  The rest of your conversation with the assistant. SUN sees a request only when the assistant uses SUN for you.

• What the assistant receives

  The results it asks SUN for: your account email and ID; your credit balance, whether you have a subscription, and the expected cost of a request; what you make and its progress, such as titles, lyrics, cover images, and links to listen to it; your voices and scheduled briefings; SUN's character catalog; and one-time links for uploading files, with the names and status of files you add. For a course built from your files, this includes the text of its short spoken introduction, which sums up those files and can greet you by your first name. Once the assistant has them, they are covered by the assistant provider's privacy policy (for example, OpenAI's for ChatGPT and Codex, or Anthropic's for Claude), not by this one.

If you include details about other people, such as your children, include only what you are comfortable sharing. We use them only to make what you asked for and do not use them for anything else. Deleting the course, meditation, story, or song deletes them too. To stop an assistant from acting for you, disconnect SUN in that assistant's settings, or contact us and we will revoke the connection.

We keep the list of companies that touch your data deliberately short. Today it is:

• Supabase

  Authentication, our primary database, and file storage for audio and images.

• Language and speech model providers

  Generate course scripts, synthesize narration, and host cloned voices.

• Mixpanel

  Product analytics in the mobile app. We send it pseudonymous event data, meaning which screens and features were used, and deliberately do not send it prompt text, course content, or voice recordings.

• Google Analytics (Google LLC)

  Website analytics on sunapp.ai, described in Cookies and analytics below. Google processes this data for us as our processor.

• Cloud hosting and CDN providers

  Run our servers and deliver audio files to your device.

We may also disclose information when the law requires it, or when we need to investigate fraud, abuse, or a threat to someone's safety. If we are ever party to a merger or acquisition, personal information may transfer as part of that transaction, and this policy travels with it.

On sunapp.ai we use Google Analytics, a service from Google LLC, to count visits and see which pages and features people use. When it is on in your browser, it records the pages you view, including each page's address and title (for a public or shared course's page, the title includes the course's name), how you use them, such as scrolling and following links to other sites, how you arrived, your browser and device type, and your approximate location. It also records a few product events: that you signed up or signed in (and whether with Google, Apple or email), each generation you start and its format, your first finished generation, and the plan and price when you start a checkout. It does not receive your prompts, uploads, email address or account ID: before a page address is sent, our setup removes the values of address parameters that can carry a prompt, a sign-in link or an email address, and removes email addresses from what is sent.

You can turn Google Analytics on or off at any time with Cookie settings in the site footer. Turning it off stops Google Analytics in that browser and deletes its cookies there.

On our website we tell Google not to use this data for advertising: advertising cookies, advertising use of your data and ad personalization are switched off, and Google signals is not used.

When you buy a plan on the web with Google Analytics on, our servers report that purchase, its renewals and any refund (amount, currency, plan and a transaction ID) to Google Analytics. If you later turn Google Analytics off, write to us to stop reports for purchases you already made.

Google Analytics sets two cookies (_ga and _ga_YP4NJZ1051) that tell visits from the same browser apart; they last up to 2 years. We also set a few cookies of our own, lasting from about a minute to 6 months, to remember your cookie choice, to report sign-ins, and to credit the shared link or referral that brought you. Cookies that keep you signed in are needed to provide the service and do not depend on this choice.

Google keeps the event-level data linked to the _ga identifier for 14 months after the browser's last visit and then deletes it; aggregated reports that identify no one are kept. Google processes this data for us as our processor.

• Courses, prompts, and audio stay until you delete them, or until you delete your account.
• Cloned voices stay until you delete the voice. Deleting a voice removes both the sample recordings and the derived model.
• Analytics events are retained in aggregated form and are not tied to your account after deletion.
• Google Analytics event-level data is kept for 14 months after the browser's last visit, then deleted by Google.
• Server logs are kept for a short operational window, on the order of weeks, and then discarded.

When you delete your account we remove your personal data from our production systems. Backups roll off on their own schedule, so a copy can persist there for a short period before it is overwritten.

• Delete any course, or any cloned voice, from within the app at any time.
• Request a copy of the personal data we hold about you.
• Ask us to correct information that is wrong.
• Ask us to delete your account and the data attached to it.
• Turn Google Analytics on or off for your browser with Cookie settings in the site footer.

Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA, including the right to object to certain processing and the right to lodge a complaint with your local data protection authority. Write to us and we will honor these requests regardless of where you are.

Data is encrypted in transit and at rest. Access to production data is limited to the people who need it to operate the service, and row-level security rules in our database keep one account's content from being readable by another. No system is perfect, but we treat prompts and voice recordings as sensitive by default.

SUN is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal data, contact us and we will delete it.

We operate from the United States and our providers may process data there and in other countries. Where required, we rely on standard contractual clauses or an equivalent safeguard to cover those transfers. Google LLC, which provides Google Analytics, is certified under the EU-US Data Privacy Framework and its UK Extension, and its Data Processing Terms also include standard contractual clauses.

We will update this page when our practices change and move the date at the top. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect.