Privacy policy

Last updated August 7, 2026

Sunday is operated by Modern Matter LTD, which is responsible for the data described in this policy. In this policy, "Sunday", "we" and "us" mean Modern Matter LTD.

What we collect

• Account basics. When you sign in with Google we receive your name and email address. That's all sign-in shares: nothing else from your Google account.
• Phone number. You give Sunday your number during setup so it can message you on WhatsApp. We verify it with a one-time code.
• Style profile. Your quiz answers: the looks you swiped, brands you like, budget range, drop cadence, and anything you tell Sunday in chat that shapes your taste ("never olive again").
• Your photo (optional). If you share a photo, Sunday uses it for one thing: rendering try-on previews of outfits on you. Skipping the photo skips this entirely.
• Approximate location (optional). If you share it, we keep your city, not your precise coordinates, so drops match your weather. We use the BigDataCloud service to turn coordinates into a city name.
• Your conversation with Sunday. Messages you exchange with Sunday, so it has context and gets better at styling you.
• Shop link taps. The links in a drop point at us before they point at the brand, so we see it when you tap one. We record that your account tapped it, when, which brand and item it was, and how long after the drop arrived. That is how Sunday learns what you reach for rather than what you said you liked, and it is the only thing we use it for. Never your IP address, and never which browser or phone you tapped from. If you delete your account, the tap history goes with it. The links already sitting in your chat keep working, because we cannot reach into WhatsApp and take them back, but they stop being connected to you.
• Gmail order scan (optional, off by default). If you explicitly connect Gmail, Sunday scans for clothing order confirmations to learn your sizes and what already hangs in your closet. We store what we learn from each clothing order it finds: the item, its brand, your size, and the price. Never the emails themselves. Disconnect any time and the scanning stops.

How we use it

One purpose: styling you. Your data composes your looks, renders your try-on previews, times your drops, and tunes your taste profile. We don't use it for advertising, and we don't sell or rent it to anyone. Nothing in the list above is ever sent to an advertising platform: the one advertising tool we run is described under "The advertising pixel" below, it only ever sees a page being opened on this site, and it is off unless you switch it on.

Your photo

If you give Sunday a photo of yourself, it is used for one purpose: showing you what an outfit looks like on you. It is never used to train a model. It is never shown to another user. It is never sent to an advertising platform. You can ask us to delete it at any time, in chat or by email, and we will.

Rendering a try-on means the photo leaves our servers. It goes to the AI partners listed below: FASHN renders the try-on, and Replicate and Anthropic process the resulting picture of you. They handle it to make the image and do not train on it under our agreements with them. The finished picture then reaches you over WhatsApp, like everything else Sunday sends.

Who processes it

Sunday runs on a small set of service providers, each handling only what's needed for their job:

• Google: sign-in, and the optional Gmail order scan if you connect it.
• Meta (WhatsApp) and Twilio: delivering messages. Messages travel through WhatsApp under Meta's own terms, like all your WhatsApp chats. Meta also runs the advertising pixel described below, if and only if you allow it.
• AI partners (Anthropic, Replicate, FASHN): composing looks and rendering try-on previews. Your photo is sent to the try-on renderer for processing and is not used to train their models under our agreements with them.
• Railway: hosting and databases.

When you tap a shop link you go to the brand's own site, under the brand's own privacy policy. Some links are affiliate links: the brand may pay Sunday a commission, your price is unchanged, and we don't tell brands who you are.

What we measure

There is one thing we want to know about traffic to this site: whether people who arrive from a given link go on to finish signing up. To do that we set one first-party cookie holding a random identifier, which expires after 90 days, and we record which page you viewed, which step of signup you reached, and which link brought you here.

Two details come from our server rather than from you. One is a coarse device class, meaning phone, tablet, desktop or bot, worked out from your browser's user agent, which we do not store. The other, where our hosting provider tells us, is your country. Never your IP address, and never your city.

When you sign in, we link that identifier to your account. That is how we can say which link brought you, so it is the point of the whole exercise, and it means the pages you viewed before you had an account become attributable to you. It happens on each browser or device you sign in from, so signing in on your phone and again on your laptop links both. When you delete your account, the link and those records are deleted with it.

The identifier carries no name, no email address and no advertising identifier. It is readable only by us, and it is not shared with any advertising network. We keep those records for twelve months and then delete them.

Alongside it we set one short-lived cookie when you start Google sign-in, which checks that the sign-in coming back is the one you started. It is gone once you finish.

The advertising pixel, and your switch for it

Sunday runs ads on Instagram and Facebook, and we would like to know whether they reach anyone. The tool for that is Meta's advertising pixel, a small script from Meta that loads on this site. It is off until you say yes. We ask once, in a bar at the bottom of the page, and we take no for an answer.

If you allow it, the pixel tells Meta that a browser opened a page on this site, and separately that someone tapped through to WhatsApp. It also sets two cookies of its own on this domain, named _fbp and _fbc. We do not send Meta your name, your email address, your phone number, your photo, anything from your style profile, or anything you have said to Sunday.

Two things do go to Meta that we do not choose, and we would rather name them than let them sit in the small print. Meta's script reports the address of the page you are on and the address of the page you came from. Those ride on every message it sends and there is no setting that turns them off. What we can do is make the first one carry less: before the script is allowed to load, we remove our own advertising labels from the address in your browser, so the campaign and creative an ad was tagged with are not handed back to Meta along with the visit. The second one, the page you came from, was set by that page and we cannot change it.

Meta may still recognise you from your own Facebook or Instagram account, in the same way it does on any other site that runs its pixel, and what it does with that is governed by Meta's privacy policy rather than ours.

If you say no, the script is never fetched and no request to Meta is ever made from this site. Nothing about the page changes, because nothing about Sunday depends on it.

Your current choice: the advertising pixel is off. Turn it on

You can change your mind here whenever you like. Turning it off stops any further events and deletes those two cookies, but we cannot recall an event Meta already received, and we would rather say so than imply otherwise.

Your controls

• Pause: reply "pause" in WhatsApp and drops stop until you come back.
• Stop: reply "stop" and Sunday stops messaging you entirely.
• Delete: say "delete my data" in chat, or email us. We delete your account and data from live systems within 30 days.
• Photo & Gmail: ask Sunday to drop your photo, or disconnect Gmail, at any time, without deleting the rest of your account.
• Advertising pixel: off unless you turn it on, and the switch is in "The advertising pixel" section above.

Retention

We keep your data while your account is active. When you delete your account, or ask us to, it's removed from live systems within 30 days, and from rolling backups shortly after.

Age

Sunday isn't for children. You must be old enough to use WhatsApp where you live, and at least 16.

Changes

If this policy changes in a way that matters, Sunday will tell you in WhatsApp before the change takes effect, not bury it here and hope.

Contact

Questions, requests, complaints: amit.assaraf@gmail.com. A human reads it.