Privacy Policy

Last updated: October 27, 2026

What we collect

Your email address (for sign-in by an emailed sign-in link or Google).
Your display name (you set this during onboarding).
The genealogical data you enter: member names, dates, relationships, photos, voice recordings, written stories, and timeline entries.
Voice recordings submitted via share links — transcribed by OpenAI and turned into narrative drafts by Anthropic, solely to operate the service.
Usage stats via PostHog (US instance): which pages are opened and when something is added, linked to a random account number, never your name. More under Usage stats below.
Place names and coordinates for residence history are matched against a bundled offline gazetteer built from GeoNames data, licensed under CC BY 4.0. No place name you enter is ever sent to a third-party geocoding service.

How we use your data

We use your data only to operate Living Legacy for you and the family members you invite. Specifically:

Storing and displaying your family tree, stories, photos, and recordings.
Processing voice recordings through OpenAI (transcription) and Anthropic (narration) to generate written story drafts — solely on your behalf.
Sending you transactional emails (invites, story confirmations, exports).
Counting how the app is used, so we can see what helps families and fix what gets in the way.

We do not sell, rent, or share your mobile number or personal data with third parties for marketing purposes.

Usage stats

We count how Living Legacy is used — pages opened, and things added or sent, like a story, a photo or an invite — to see what helps families and what gets in the way.

The counts are linked to a random account number, never your name or email. They never include what you write, record or upload, or your private links, and your screen is never recorded.

PostHog keeps them for us in the US. Usage stats set no cookies and keep nothing on your device, and your internet address is not stored. Our own cookies only keep you signed in and the app working.

To switch it off, turn on "Don't include me in usage stats" in Settings, then Account. From then on, nothing is sent; earlier counts stay as they are. You're still counted as a number, never by name, in our own totals.

Without an account — say, recording through a link — a visit is counted as a plain visit, tied to no one. If your browser asks sites not to track you, we send nothing.

Who can see your data

Your family tree is visible only to people you explicitly invite. Other Living Legacy users cannot see any of your data. This boundary is enforced at the database level (Postgres row-level security) — not just in application code. Inside your family, each person chooses how far the things they add reach, from their closest family to everyone in the family, in Settings › Family.

AI processing

When you or a family member records a voice story, Living Legacy sends that audio to OpenAI for transcription and the resulting text to Anthropic to generate a narrative draft. These are API-based integrations — neither OpenAI nor Anthropic trains on API-submitted data by default, and Living Legacy has not opted in to any training program. Your stories remain yours.

If you receive a share link via SMS or WhatsApp and prefer not to participate, simply do not respond to the link. You can Reply STOP to any SMS message to opt out of future messages from Living Legacy.

Data about minors

Accounts are for people 13 or older (or the age of digital consent where you live). You may create profiles for younger relatives, managed by a parent or guardian.

Third-party processors

Living Legacy uses the following third-party services, each receiving only the data needed to perform its function:

Supabase — database (Postgres with row-level security) and file storage. Your data is stored in an encrypted Supabase Cloud instance.
Resend — transactional email delivery (invites, story receipts, export links).
OpenAI — voice transcription via API. Audio is sent solely for transcription; OpenAI does not train on API-submitted data.
Anthropic — narrative generation via API. Transcripts are sent solely for narration drafts; Anthropic does not train on API-submitted data.
PostHog (US instance) — usage stats, linked to a random account number, never your name. No story text, emails or private links are sent.
Vercel — hosts the app and runs its servers, in the US.
Sentry — error reports (what went wrong and where), used only to fix problems.
Google — only if you choose to sign in with Google.
Telnyx — text message delivery, only if we turn on text messages (off today).

Security

Your data is stored in a Postgres database with row-level security (RLS) policies that restrict every query to your family's data only. Media files (photos, audio) are stored in encrypted object storage and shared through short-lived private links. Profile pictures are the exception: they load from a public link that is hard to guess. We do not store passwords — authentication is handled by emailed sign-in links or Google.

Data retention and deletion

We retain your data for as long as your account is active. If you delete your account, your authentication record and any family you solely own are deleted. Family members you added remain as unclaimed records your family can continue curating. To request early deletion or exercise rights under GDPR, CCPA, or other applicable law, contact us at the email below.

Your rights

You own your stories. Here's what you can do with them:

Owners and editors can download a copy of everything they can see in the family's legacy, with its photos and recordings, as a ZIP file from Settings.
Delete your account at any time from Settings. Your profile stays in the family tree as an unclaimed record your family can continue curating.
Contact us to exercise GDPR/CCPA rights such as access, correction, or restriction of processing.

Contact

For privacy questions, data requests, or to report a concern, reach the operator at:

[email protected]