Privacy Policy
Looking for our Terms of Service?
1. Information We Collect
We collect the following categories of information:
Information you provide
- Account information (name, email address).
- Content you upload (photos, audio recordings, text, and related metadata).
- Communications with support.
Information the Service creates from your Content
- Transcripts. When you record a story, we transcribe the recording automatically. We store the transcript, and the timing of each word within the recording, so the text can follow along as the recording plays.
- AI insights. Summaries, titles, suggested collections, and similar output generated from your objects and stories.
Automatically collected information
- How you use the app. The app records which screens you view, which buttons and items you tap, and when each session starts and ends. These events are linked to your account and are used to understand where the app is confusing or slow. They are automatically deleted 90 days after they are recorded.
- Device and diagnostic data. App version and error logs.
- Push notification token. If you turn on notifications, Apple issues a device token for your iPhone, and we store it so we can deliver notifications to that device. It is deleted when you sign out on that device and when you delete your account.
2. How We Use Information
We use your information to provide and operate the Service; store, organize, and display your Content; generate optional AI-based features at your request; secure the platform and prevent misuse; improve functionality and user experience; and respond to customer support requests.
We do not sell your personal information.
3. AI Processing and Third-Party Providers
To generate insights about your objects and to transcribe and analyze your stories, relevant portions of your Content are transmitted to OpenAI, our AI provider, solely to generate the requested output. In plain language, here is exactly what OpenAI receives:
- Your object photos. We give OpenAI a temporary link to the photo, and OpenAI’s servers fetch the full-size image directly from our storage.
- The recording itself. A voice recording is uploaded to OpenAI’s Whisper service as audio so it can be transcribed. The recording is sent, not just a description of it.
- The resulting transcript. The transcribed text is then sent to OpenAI a second time to produce the story’s summary, title, and key moments.
- What you typed. The titles, descriptions, and speaker names you entered for the object or recording.
Your account information (such as your name and email address) is never included in these requests — only the content needed to generate the result.
We do not permit OpenAI, or any other provider, to use your Content for advertising, to train their models, or for any unrelated purpose, subject to their contractual obligations.
4. Sharing of Information
We share information only:
- With the service providers listed below, who support core operations.
- When required by law, legal process, or to protect rights and safety.
- With people you explicitly invite into shared spaces.
The providers we rely on, and what each one receives
- Amazon Web Services. Hosts the Service and stores everything in it — your photos, voice recordings, transcripts, stories, and account records.
- OpenAI. Receives the Content described in Section 3 to generate transcripts and AI insights.
- Resend. Delivers invitation emails. When you invite someone, Resend receives that person’s email address so it can send them the invitation.
- Netlify. Hosts our website, myheirlooms.com, and receives standard request data (such as your IP address) when you load a page.
- Stripe. Processes payments made on our website, including gifts. Stripe receives your payment details directly — we never see or store your card number. We keep a record of the purchase (which museum, when, how much) so we can honor refunds.
- Apple. Processes purchases made in the app through the App Store. Apple handles your payment details and refunds; we receive only a signed confirmation of the purchase, never your card.
Every third party that receives personal information from us is required, by contract, to protect it to the same standard we do, to use it only to perform the service we engaged them for, and never to sell it or repurpose it for their own ends.
The website also uses the providers described in Section 9.
5. Data Retention and Deletion
We retain your information while your account is active and as needed to provide the Service. Usage events (Section 1) are deleted automatically 90 days after they are recorded.
Deleting your account
Deleting your account is self-serve and does not require contacting us. In the app, open Account → Delete Account. Or sign in on the web at myheirlooms.com/account and delete it there. In plain language:
- You get 30 days to change your mind. Your account is deactivated immediately and a 30-day grace period begins. Nothing is erased during that window — sign back in and your museum, and everything in it, comes back.
- After 30 days, it is permanently erased. Your account and Content are deleted for good — photos, voice recordings, transcripts, stories, usage events, and push notification tokens included. This cannot be undone.
- A shared museum is not destroyed with your account. If other people are members of a museum you own, ownership transfers to one of those members so the family’s memories survive, and your membership is removed. A museum with no other members is erased along with the rest of your data.
Some information may be retained for legal, security, or operational reasons as permitted by law.
6. Security
We use industry-standard safeguards such as encryption in transit and restricted access controls. However, no system is completely secure, and we cannot guarantee absolute security.
7. Children’s Privacy
The Service is not directed to children under 13. We do not knowingly collect personal information from children without appropriate consent.
8. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated through the app or website.
9. Website, Cookies & Advertising
This section applies to our website, myheirlooms.com. In plain language:
- Our own analytics cookie. We set a first-party cookie named
mh_ws— a random identifier that contains no personal data and lasts up to one year. It helps us understand how visitors move through the site (for example, from the home page to the demo). It is not shared with advertisers. - Meta (Facebook) Pixel. Our marketing pages use the Meta Pixel to measure how well our advertising works. Meta may set its own cookies and receive standard browsing data when you visit those pages. You can read how Meta handles this data in the Meta Privacy Policy. We do not include the Pixel on this page or on the Terms page.
- Web demo photos. Photos uploaded to the try-it demo at /begin are stored temporarily so we can generate the AI insight. If you create an account, your photo is saved into your own museum. If you don’t, the demo upload expires after 24 hours and the photo is automatically deleted from our storage within 7 days — demo photos from visitors who don’t create an account are never added to any family museum.
- Waitlist emails. If you join the waitlist, your email address is collected via Formspree, a form-processing provider, and used only to let you know about availability.
- Fonts. Our site’s typefaces are served by Google Fonts, so Google receives standard request data (such as your IP address) when the pages load.
10. Contact
Privacy questions or requests may be sent to: privacy@myheirlooms.com
MyHeirlooms Inc.
Washington, United States