Privacy Policy
Last updated: August 13, 2026 Effective: August 13, 2026
§ 1Who We Are
Someday is operated by TMS Enterprises LLC, a Delaware limited liability company (“TMS,” “we,” “us”). Someday is a brand and product name of TMS Enterprises LLC.
16192 Coastal Highway, Lewes, Delaware 19958
This policy covers somedaycomes.app and related services (the “Service”).
§ 2The Short Version
Someday needs very little about you.
- There is no name field. We do not require your name, though what you type or send us may identify you.
- We do not receive or store your full card number. Stripe collects and processes payments.
- Sign-in is by email link. There are no passwords.
- Your identity and your designs are stored separately. Design records contain no account-name field or email address, though labels you type may contain names or other identifying information. A restricted internal identifier links them when the Service needs to.
This summary highlights key practices and does not replace the full policy below.
§ 3What We Collect
From you
| What | Why |
|---|---|
| Email address | Passwordless sign-in; administering your account, trial, or subscription; transactional and legally required notices; responding to your requests; account security. |
| Payment information | Collected and processed by Stripe at checkout. Stripe provides us with identifiers and limited payment and subscription metadata needed to administer your account, not your full card number. |
| Your design | The allocations and amounts you enter, and the sequence of choices you make. Optional: the free experience works without saving. |
| Labels you type | Words you attach to parts of a design, which may include names of other people. Optional and never verified. Displayed only within your authenticated saved-design experience, and not included in public sharing or research outputs. |
| Your state | Used to estimate taxes. A default is derived from your approximate location; you choose the state that applies. It is a calculation input, not a statement of where you live. |
| Privacy and support communications | The contents of your requests and the records needed to verify, process, and document our response, including correspondence, verification records, and any appeal. |
Automatically
- A first-party browser identifier so an unsaved design follows you between visits without an account. Your browser stores a randomly generated value lasting about a year, and our database stores a one-way representation used to recognize that browser. It remains a pseudonymous identifier and may be treated as personal information under applicable law. Clearing your browser storage resets it. We do not use device fingerprinting.
- Usage data: pages viewed, features used, browser and device type, and IP address.
- Advertising identifiers. If you arrive from one of our ads, the advertising platform adds an identifier to the link you clicked, and we store it so that, if you later do something we are measuring, we can tell that platform its ad led to it. One of our advertising platforms also stores identifiers in your browser on every visit, whether or not you have ever seen one of our ads. Neither carries the allocations you enter or the choices you make, and neither is collected at all if you have opted out or your browser sends an opt-out preference signal. See Section 6.
- Cookies: see Section 6.
We do not request or intentionally collect Social Security numbers, government identifiers, biometric data, precise geolocation, or health data, and we do not directly receive or store full payment card or bank-account numbers. Please do not enter such information in labels or other free-text fields, and do not enter sensitive or unnecessary information about another person. You are responsible for having an appropriate basis to submit information relating to others. We do not buy personal information from data brokers.
§ 4How It Is Stored
We store account identity information, including your email address, separately from design content. Design records contain no email address and no name field. The Service uses a restricted internal identifier to associate saved designs with your account when it needs to: to show you your designs, honor your privacy choices, prevent fraud, and respond to valid requests.
Labels you type stay with your saved design. They are not included in share cards or share links, in link previews, in our research records, in analytics, or in notification emails. Authorized personnel and service providers may access them where necessary to operate, secure, support, or troubleshoot the Service.
§ 5The Someday Index
We compile aggregate statistics about how people allocate hypothetical wealth: the Someday Index.
5.1 Published results are aggregate only. We publish only aggregate Index results and do not publish an individual design as part of the Index. We apply aggregation and de-identification safeguards designed to prevent any published figure from identifying an individual user or design.
5.2 Participation. Designs created without an account do not contribute to the Index. Contribution begins only when a design is saved to an account, and your saved allocation records count toward the Index unless you opt out.
5.3 Opt-out. You can opt out through the control on this page or through any other Privacy Settings method we make available. The opt-out becomes effective when the preference is successfully recorded by the Service. Opting out excludes your contributed records from Index calculations and publications generated after the opt-out becomes effective. It does not alter or withdraw statistics published before the opt-out. The opt-out applies to Index source records that remain associated with your account through our restricted internal identifier, including allocation records, version records, and choice-sequence records used to generate the Index.
The Someday Index
Your designs count toward the aggregate unless you opt out.
Opting out stops your records counting, past and future. Anything already published stays published, but your records are excluded from everything published after this.
5.4 Deleting a design is not the same as opting out. Deleting a design removes the saved design from your account but does not by itself change your Index participation preference. Research records derived from that design may continue to be used unless you opt out of the Index. Deleting an individual design does not change your overall Index preference; deleting your account excludes all account-associated contributions from future Index calculations, as described in Section 5.5.
5.5 Deleting your account. Deleting your account excludes your contributed records from Index calculations and publications generated after deletion is completed, whether or not you opted out beforehand. The exclusion remains associated with the relevant source records after account linkage is removed, so those records do not resume contributing. Deletion does not alter statistics published before it.
5.6 What research records contain. Research records contain allocation amounts, proportions, the sequence of choices, the jackpot size at the time, and the state you selected. They contain no email address and none of the labels you type.
§ 6Cookies and Similar Technologies
We use cookies and similar technologies, including first-party browser storage, analytics technologies operated with service providers, and advertising measurement described below, in these categories:
- Essential: sign-in, security, and remembering your design between visits. Blocking these may prevent sign-in or prevent your design from being remembered.
- Preferences: recording that you have seen our notices and the choices you have made.
- Analytics: understanding how the Service is used.
- Advertising measurement: telling an advertising platform that a browser visited the Service, recognizing that you reached us from one of our ads, and reporting back to that platform that its ad worked.
How advertising measurement works here. We use two advertising platforms. Each of them runs a tag in your browser, and neither one waits for you to have seen one of our ads. Google's tag loads throughout the Service. Reddit's loads on most of it, but not everywhere: the page that displays a design someone has shared with you does not load it. Beyond that they work differently enough that describing them together would misdescribe both.
Reddit. Two separate things happen, and only the second one depends on an ad.
On the pages that load it. Reddit's tag announces the visit to Reddit. It does this for every visitor who has not opted out, whether or not you arrived from one of our ads, and whether or not you ever take an action we measure. Because the tag is Reddit's own and runs in your browser, Reddit receives the address of the page you are on, your IP address and browser user-agent, and can store its own identifiers in your browser.
The same tag also reports two of the actions we measure, by name and nothing more: that a design was worked on, and that a subscription checkout was started. It sends the name of the action and no detail about it: not your design, not your labels, and not the amounts you enter. As with the visit itself, this happens only if you have not opted out, and it does not depend on your having arrived from one of our ads.
A completed subscription purchase is reported too, but not by the tag: our servers send it, only when you arrived by clicking one of our Reddit ads, and only if you had not opted out when you started checkout. It carries the click identifier from that ad and the fact and time of the purchase: not what you paid, not the plan you chose, and no order or payment reference.
Only if you arrived from one of our ads. When you click one of our Reddit ads, Reddit adds a click identifier to the link, and we store that identifier in a first-party cookie. If you later take an action we are measuring, our servers (not your browser) send Reddit that click identifier, the name and time of the action, and limited technical information such as your IP address and browser user-agent, so it can attribute the action to its ad. No click identifier is stored and no action is reported unless you arrived by clicking one of those ads.
Google. Google's advertising measurement does not have that split: it runs in your browser rather than through our servers. From the moment its tag loads it stores advertising identifiers there: first-party, on every visit, lasting up to 90 days, whether or not you have ever seen one of our ads. When you take an action we are measuring, your browser sends the report to Google directly. That report carries the address of the page you were on, which the tag reports in two separate fields, along with your IP address and browser user-agent; where you did reach us by clicking one of our Google ads, that ad's click identifier travels in a field of its own. The report is sent for every visitor who takes a measured action, not only those who arrived from an ad.
What we do not do with it. We do not build a profile of you, we do not send your design, your labels, or anything you type, and we do not place advertising on the Service. We may use an advertising platform's measurement to show our own ads to people who have visited before. What that platform does with what its own tag collects is governed by its privacy policy and by its terms with us.
Turning it off. The same "Do Not Sell or Share" opt-out described in Section 10, and a Global Privacy Control signal, each stop advertising measurement before it starts: on every page you open afterwards, neither platform's tag is loaded at all, so neither one is told that you visited, no advertising identifier is stored in your browser, no click identifier is stored, and nothing is sent.
On the page you are already on when you opt out, the effect is narrower, and it differs between the two. Google's tag is removed and disabled there and then, and advertising identifiers it had already stored are cleared. Reddit's tag is removed only within the app itself; on our standalone pages, including the one this policy appears on, it stays loaded until you move to another page. It sends no further reports there, but it is not removed. Neither opt-out can recall what was already sent, and neither deletes identifiers Reddit has already stored in your browser; your browser's own cookie controls do that. The platforms we use for advertising measurement are listed in Section 8.
Global Privacy Control. Where required by applicable law, we recognize supported opt-out preference signals, including Global Privacy Control (GPC), as an applicable request to opt out of sale, sharing, or targeted advertising. Regardless of how our current analytics configuration is ultimately classified under those laws, when we receive that signal we do not load our analytics technologies for that browser, and we do not store an advertising click identifier or send anything to an advertising platform. Because we process the signal before sign-in, its effect ordinarily applies to the browser or device that sends it; you may need to enable it separately on other browsers or devices. The signal does not by itself opt your account out of the Someday Index; that separate control is in Privacy Settings.
Do Not Sell or Share My Personal Information
Also: opt out of the Someday Index, the anonymous re-price aggregate. It never carries your name or your allocations.
Purchases are the exception, and the exception is narrow. If you buy a subscription, we record that purchase in analytics even where you have opted out or sent an opt-out preference signal. That exception is about ANALYTICS, and it does not extend to advertising measurement: where you have opted out, no purchase is reported to Reddit. A completed purchase is a transaction we are entitled to count. The record contains the subscription term and the time it happened: never your name, your email, your design, or the labels you type. Where analytics has not loaded for your browser, the record cannot be connected to your visit at all; it tells us a sale occurred, not who browsed.
You can also block or delete cookies in your browser settings.
§ 7How We Use Information
To provide the Service and remember your design; process payments, validate cards for free trials, and manage subscriptions and trials; sign you in; send notifications you asked for and notices we are required to send; compile the Someday Index; understand usage and improve the Service; prevent fraud and abuse; and comply with law.
We do not sell your personal information. We do not disclose your design content or the labels you type to third parties for their independent marketing. We may disclose online identifiers and usage information to analytics providers, and to advertising platforms to measure our own ads and to select audiences for them, as described in Sections 6 and 8. We may use aggregate or de-identified information to develop and improve internal analytics, as described in the Terms.
§ 8Who We Share It With
Our principal providers currently include Stripe for payments, Resend for email delivery, Vercel and Railway for hosting and application infrastructure, Google Analytics for analytics, Sentry for error monitoring, Microsoft Clarity for session replay, Reddit and Google Ads for measuring our own advertising, and Slack for limited operational alerts.
| Who | What they receive | Why |
|---|---|---|
| Stripe (payments) | Payment information you provide at checkout; your email; subscription and transaction metadata | Payment processing, trial card validation, subscription management |
| Vercel, Railway (hosting and infrastructure) | Data needed to run and secure the Service, which may include IP addresses and request information in infrastructure logs | Operating the Service and its databases |
| Resend (email delivery) | Your email address, message contents, delivery status and related delivery metadata | Sending sign-in links, receipts, and notices |
| Google Analytics | Event-level usage data, an analytics client identifier, browser and device information, and your IP address at collection. Google states that GA4 uses the IP address to derive approximate location and then discards it before logging. Also the fact and time of a completed purchase and the subscription term, sent from our servers, including where you have opted out of analytics. Never your name, email, design, or labels. | Understanding how the Service is used, and (because the same Google tag carries both) measuring whether our own ads lead to use of the Service |
| Sentry (error monitoring) | Only when something breaks: the error message and stack trace, the page address, and basic browser and device information. Not your name, your email, your design, the labels you type, or the amounts you enter; these are removed before the report is sent. Error reports are collected even if you have opted out of analytics, because they are how we find out the site is broken for you. | Detecting and fixing errors that stop the Service working |
| Microsoft Clarity (session replay) | A recording of how you use the Service: pages viewed, clicks, scrolling, and the layout of what was on screen, plus basic browser and device information. Names you type for the people in your design, and the link to a design you have shared, are hidden from the recording before it is sent. What you type into an email field is not recorded by Clarity. The numbers you enter into the drawing checker, and the matches it shows you, are hidden the same way. Clarity also exchanges identifiers with Microsoft: one that recognizes the same browser across Microsoft's own services, including its advertising systems, and one that recognizes a browser across other websites that also use Clarity. Microsoft therefore learns that a browser visited this site, and can connect that visit to the same browser elsewhere. Your design, the labels you type, and anything else you enter are not part of that exchange. Recordings and identifiers follow the same choice as analytics: if you have opted out or your browser sends an opt-out preference signal, Clarity does not load at all; no recording is made and no identifier is exchanged. If you opt out during a visit, the recording stops. | Seeing where people get stuck, and diagnosing problems we cannot reproduce |
| Reddit (advertising measurement) | If you have not opted out: Reddit's tag loads in your browser on most pages of the Service (not on the page showing a design someone has shared with you) and tells Reddit that the visit happened, whether or not you arrived from one of our ads. The same tag reports two actions by name only (that a design was worked on, and that a subscription checkout was started) with no detail attached: not your design, not your labels, not the amounts you enter, and not the plan or price you chose. A completed subscription purchase is reported from our servers rather than by the tag, only where you reached us from one of our Reddit ads and had not opted out at checkout: the click identifier from that ad, and the fact and time of the purchase (never what you paid, the plan, or an order reference). Because that tag is Reddit's own, it carries the address of the page you are on, your IP address and browser user-agent, and Reddit can store its own identifiers in your browser. Separately, and only if you reached us from one of our Reddit ads: the click identifier from that ad, plus the name and time of the action being measured, sent from our servers rather than your browser. Not your design, your labels, or your email. The "Do Not Sell or Share" opt-out and a Global Privacy Control signal each stop Reddit's tag loading at all on every page you open afterwards, so Reddit is not told of the visit and stores nothing. Opting out partway through a visit removes the tag within the app but not on our standalone pages, where it stays loaded until you move on; in neither case are identifiers already stored deleted. | Measuring whether our own ads lead to use of the Service, and selecting audiences for those ads |
| Google Ads (advertising measurement) | If you have not opted out: when you take one of the actions we measure, your browser sends a conversion report to Google directly; this one does not go through our servers. It carries the address of the page you were on, which Google's tag reports in two separate fields; your IP address and browser user-agent; and, where you reached us by clicking one of our Google ads, that ad's click identifier in a field of its own. The report is sent whether or not you arrived from one of our ads. Google's tag also stores advertising identifiers in your browser: first-party, on every visit, lasting up to 90 days. Not your design, your labels, or your email. The "Do Not Sell or Share" opt-out and a Global Privacy Control signal each stop Google's tag loading at all, so nothing is sent and nothing is stored; using the opt-out also clears advertising identifiers already in your browser. | Measuring whether our own ads lead to use of the Service, and selecting audiences for those ads |
| Web push services | A push subscription endpoint, device or browser token, encryption information, and notification content | Delivering notifications you request |
| Slack (team communications provider) | Operational alerts that may include limited account, subscription, or diagnostic information | Operating and supporting the Service |
| Lottery data providers | No personal information; we receive jackpot data from them | Displaying current jackpot figures |
We may also disclose information where required by law or legal process; to protect our rights or safety, or those of others; to investigate fraud or a security incident; or in connection with a merger, acquisition, financing, reorganization, or sale of assets. A recipient in such a transaction will be required to handle information in accordance with this policy unless and until it gives notice of a lawful change.
§ 9Retention
We retain information for as long as reasonably necessary for the purposes described in this policy. Retention depends on the type of information, whether your account is active, our legal and tax obligations, security and fraud-prevention needs, and whether the information has been aggregated or de-identified.
In general: your email address is kept while your account, trial, or subscription is active and for a reasonable period afterward for legal, tax, and accounting purposes. Designs are kept while your account is active. Payment records are retained by Stripe under its policies and by us as required for tax and accounting. Published aggregate statistics may be retained indefinitely. De-identified or pseudonymous research records may be retained for research, integrity, security, and audit purposes, subject to your Index preference as described in Section 5.3. We may retain records of privacy requests and our responses for a reasonable compliance and audit period, even after the underlying account is deleted.
§ 10Your Choices and Rights
You may:
- opt out of the sale or sharing of your personal information: the control is called "Do Not Sell or Share My Personal Information" and is on this Privacy Policy page. Using it stops our analytics and advertising-measurement technologies loading in that browser, and applies to the browser or device you use it on;
- opt out of the Someday Index: in Privacy Settings;
- delete a design: in your account;
- close your account or request deletion of your account data: email help@somedaycomes.app from the address associated with your account; we send a time-limited confirmation link before processing (see Section 10.5);
- request a copy of your information, or correct your email address: email help@somedaycomes.app;
- turn off notifications: in your account. Transactional and legally required messages continue while your account is active.
10.1 State privacy rights. Depending on where you live, and subject to applicable exceptions, you may have rights to know what we collect and how we use it; to access, correct, or delete your personal information; to obtain a portable copy; to opt out of sale, sharing, targeted advertising, and certain profiling; and not to be treated differently for exercising these rights.
10.2 How to exercise them. Email help@somedaycomes.app. Because we hold very little about you, we usually verify a request using the email address associated with your account, and we will not ask for more information than we need to verify it. We will confirm receipt and respond within the period applicable law requires; where no period applies, we aim to respond within 45 days and will tell you if we need an extension. You may use an authorized agent where the law permits; we may require evidence of the authorization and may verify the request with you directly.
10.3 Appeals. If we decline your request and your state provides a right to appeal, reply to our decision or email help@somedaycomes.app with “Appeal” in the subject. We will tell you the outcome and, where required, how to contact your state attorney general.
10.4 Limits. These rights are subject to exceptions. For example, we may retain information needed to complete a transaction, keep tax and accounting records, detect or prevent fraud, maintain security, comply with law, or establish or defend legal claims, and we cannot recover statistics already published. For information associated only with a browser identifier, we may be unable to verify that it relates to you, and clearing your browser storage may prevent us from locating the corresponding record.
10.5 Closing your account and deleting your data. Closing or deleting your account is different from simply cancelling renewal. To protect you, a deletion request must ordinarily be confirmed through the email address associated with your account before anything is destroyed, and an unconfirmed request is not carried out. If you cannot access that address, contact us and we may offer another verification method where we can reasonably verify your identity and authority over the account. After confirmation, we begin processing the deletion: account access may end promptly, while deletion, de-identification, and removal from operational systems may take a reasonable period. If we cannot complete a necessary billing or account-security step, we may delay deletion and notify you rather than delete the account while leaving an active renewal in place. A verified account-deletion request may end your access before the end of a paid period and does not by itself create a right to a refund; we cancel future renewals as part of processing the request. We delete or de-identify your active account identity record and the designs associated with your account, and your contributions stop counting toward the Someday Index. Share cards and links are not connected to your account, so deleting your account does not take them down and we cannot locate them on your behalf. If you want a share removed, send us its link at help@somedaycomes.app, before or when you delete, since afterward neither of us can tell which shares were yours. See Section 11. We keep limited information where required for billing, tax, fraud prevention, security, legal claims, request auditing, and compliance. Deleted information may remain for a limited period in restricted backups and disaster-recovery systems and will not be restored to ordinary use except where necessary for recovery, security, or legal compliance. When we complete a deletion we will tell you that your active account has been deleted and that certain information may have been de-identified or retained for the limited purposes described in this policy.
10.6 Beyond what the law requires. We may extend some or all of these options to people even where we are not legally required to, subject to verification, technical feasibility, legal retention requirements, and the rights of others.
§ 11Information You Choose to Share
If you create a share card or link, the design information it contains may be accessible to anyone who receives or obtains it, and recipients may copy, save, or redistribute it outside the Service. Do not include information you want to keep private.
A share is not connected to your account. It carries no identifier tying it back to you, which is deliberate; it is why a share cannot be traced to the person who made it. It also means we cannot find your shares for you, and deleting your account does not take them down. To have a specific share removed, send us its link at help@somedaycomes.app. Removing a share does not remove copies that others have already saved, redistributed, or cached.
Share cards and links do not include the labels you type.
§ 12Security
We use administrative, technical, and organizational safeguards designed to protect information, including encrypted browser connections, access controls, storing identity separately from design content, and automated controls designed to reduce the risk that directly identifying information enters our research records. No system is perfectly secure, and you are responsible for safeguarding access to the email address associated with your account.
If we determine that a security incident requires notice under applicable law, we will provide notice as required.
§ 13Electronic Communications
The Terms of Service govern your consent to receive communications electronically. This section explains the mechanics: you can update your email address in your account settings or by contacting us, and you are responsible for keeping it current. You may request a paper copy of a legally required notice, free of charge, by emailing help@somedaycomes.app; to send one we may need to collect a mailing address solely for that request. You may withdraw consent to electronic communications by contacting us; because the Service is delivered electronically, withdrawing may require closing your account or subscription, and it does not affect the validity of communications sent before withdrawal or by itself entitle you to a refund.
§ 14Artificial Intelligence
We do not currently send your designs, labels, or support-message contents to a generative-AI provider for generation, model training, or analysis. As described in the Terms, we may use aggregate or de-identified information to develop and improve internal analytics. If this changes, we will update this policy and describe what is shared and for what purpose.
§ 15Children
The Service is intended only for people 18 or older, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information, contact help@somedaycomes.app and we will take appropriate steps, including deletion where required.
§ 16Changes
We may update this policy. We will change the “Last updated” date, and changes take effect on the date stated in the revised policy. For material changes we will give notice through the Service. We have no mailing address for you, and most people who use Someday never give us an email address, so a notice on the site is the only way we can reach everyone a change affects. Where required by law we will obtain consent before applying a materially different use to information we already collected. We may not be able to continue providing certain features if you do not consent to a change necessary to provide them.
§ 17Contact
TMS Enterprises LLC
16192 Coastal Highway, Lewes, Delaware 19958
© 2026 TMS Enterprises LLC. All rights reserved. Someday is a product of TMS Enterprises LLC.