Privacy Policy

What we collect

• Account information — your name and email address when you create an account.
• Recordings — the video, audio, and written responses you create inside the app.
• Family information — names and relationships you add to your family tree, including any GEDCOM files you import.
• Relatives' email addresses and phone numbers — if you add them to someone's card on your tree. Only you, the tree's owner, can see them; relatives you share your tree with never do.
• Trusted contacts and next-of-kin — names and email addresses you designate to receive your legacy recordings.
• Delivery preferences — dates, recipients, and delivery conditions you set for your recordings.
• Lists and recipes — any personal lists (favorites, memories, etc.) or recipes you save, and any photos of recipe cards you choose to keep with a recipe.
• Payment information — handled entirely by Stripe (on this website) or Apple (in the iPhone app). We never see or store your card number.
• Purchase history — which plan you have, where it came from (this website, the App Store, or a gift), and when it renews or ends. For App Store purchases this is kept for us by RevenueCat (see below).
• Shared plans — if you share a Together or Family plan, the email addresses invited, who has joined, and whether someone was invited as under 18. The plan holder sees the names and addresses of the people on their plan and how much room the plan has used in total — never anybody's recordings, unless that person shares them in the usual way.
• Photos and documents — pictures and papers you choose to add: photos to tell the story of, pictures of people on your family tree, and documents you file against them.
• Notes and transcripts — notes you write before recording, and the words spoken in your recordings, written down. We make these transcripts automatically so recordings can be searched and read along with; only people who can watch a recording can read its words. You can turn this off in Account, under “Writing out recordings”; recordings already written out keep their words. A practice run with “Talk it through” is turned into text on your phone and never leaves it.
• Obituaries, family lists and recipe cards you ask us to read — the link, the words you paste, or the photo or screenshot you choose, when you press Read. For a link, we open the page and take its words. What we read is shown to you to check; only what you choose to save is kept.
• Things you share with family in the app — comments and reactions on recordings, recipes and lists, Campfire comments and reactions, and the questions and photo requests you send (with any note you add).
• Technical information — a notification token if you allow notifications, your phone's time zone (so reminders and the daily nudge arrive at a sensible hour where you are, not in the middle of your night), and the dates you last signed in, checked in or played a recording, which we need for check-ins and storage. Our service providers keep ordinary security logs, such as IP addresses. To see how many people visit this website, we use Plausible, which uses no cookies, collects nothing that identifies you, and never sees private links — we remove codes from page addresses before counting. The iPhone app uses no analytics at all. On three public pages only — the home page, the prices and the gift page, with their thank-you pages — and only for visitors in the United States, we use Meta’s pixel to learn whether our Facebook and Instagram ads lead to visits and purchases (see Meta, below). It is never used anywhere else on this website or in the app, and it never sees your recordings, your family or a private link. We don’t sell any of this.

How we use your information

• To store and play back your recordings.
• To deliver your recordings to the recipients you designate, on the schedule you set.
• To send periodic check-in emails if you have legacy recordings — confirming you are still with us. Signing in, opening the app or making a recording also counts as checking in. If we don't hear back after multiple reminders, a person at The Attic reviews your account, and may contact your trusted contacts, before anything is released.
• To send transactional emails: delivery notifications, account confirmations, receipts.
• To process your subscription payments.
• We do not use your recordings or family data to train AI models, and neither do the companies whose AI reads or writes out things for us (Anthropic and Cloudflare, below). We do not sell your data. We do not show you ads.

How your data is stored

We use the following trusted third-party services to operate The Attic:

• Supabase (supabase.com) — database, authentication, and real-time features. Data stored in the United States.
• Cloudflare R2 and Stream (cloudflare.com) — video and audio file storage and delivery. Cloudflare R2 stores data with 11 nines of durability. Data stored across Cloudflare's global network.
• Cloudflare Workers AI (cloudflare.com) — writes down the words spoken in your recordings, so you can search them and read along. The sound goes straight from our storage to Cloudflare and the words come back to us; Cloudflare doesn't keep it, doesn't share it, and doesn't use it to train AI. You can turn this off in Account, under “Writing out recordings” — then nothing of yours is sent to it.
• Anthropic (anthropic.com) — its AI, Claude, reads what you ask us to read and writes out what it says for you to check: an obituary or a family list (from a link, words you paste, or a photo or screenshot) and the photo of a recipe card. For a link, we open the page ourselves and send its words. Only what you give us is sent, and only when you press Read; before your first read we ask whether that's all right. Anthropic doesn't use it to train AI, and normally deletes it within 30 days (longer only if its own safety rules require). A FamilySearch family list pasted in whole is read on your own device and sent nowhere. A recipe card's photo is kept with us, in Cloudflare R2, alongside the recipe.
• Resend (resend.com) — transactional email delivery.
• Expo push notifications (expo.dev) — carries notifications to the iPhone app, through Apple. It receives your phone's notification token and the words of each notification (such as “Mom asked you a question”), and nothing else about you or your recordings.
• Plausible (plausible.io) — counts visits to this website: which pages are viewed, the country and type of device. No cookies, no personal information, no cross-site tracking, and hosted in the EU. Not used in the iPhone app.
• Meta (facebook.com) — measures our Facebook and Instagram ads, on this website's home, prices and gift pages only, for visitors in the United States. Meta sets its own cookie and learns that you viewed one of those pages and, if you buy, which plan and what it cost — never your name, email or anything you write or record. It is not used in the iPhone app or anywhere else on this site. It doesn't run if your browser sends Global Privacy Control, and you can also block it with your browser's tracking protection or in your Facebook ad settings.
• Stripe (stripe.com) — payment processing for plans bought on this website. Stripe is PCI-compliant and handles all payment data directly.
• RevenueCat (revenuecat.com) — processes plans bought in the iPhone app for us. It holds your account's ID, the App Store purchases and renewals made with it (product, dates, price and currency, country of the App Store, and Apple's transaction IDs), and nothing about your recordings. Apple itself takes the payment. When you delete your account we ask RevenueCat to delete this too.

Your recordings are encrypted in transit (HTTPS) and at rest. We do not share your recordings with anyone other than the specific recipients you designate.

How we protect your recordings

A recording in The Attic may be the only copy of an irreplaceable moment. We treat it that way. The precautions we take include:

• Scrambled on the way and where it's kept — everything is encrypted while it travels between your device and us, and encrypted again where it is stored, so it can't be read along the way or lifted off a disk.
• Kept in more than one place — recordings are stored with Cloudflare, which keeps a copy of every file in more than one facility. A single broken machine cannot lose your recording.
• Nothing lost while saving — while a recording is being saved, a copy stays on your own device until we have confirmed it is safely stored. If the connection drops, the battery runs low or the page is closed, it can be finished later rather than lost.
• Only the people you choose — every recording is locked to your account. Nobody else — family members included — can see a recording unless you have chosen to share it with them. Recording files are kept in private storage and are opened only through short-lived links, given only to people you have allowed.
• Staff don't browse your recordings — people at The Attic cannot look through your recordings. We look at one only when it is strictly necessary to help with a support request you started, or where the law requires it, and every such look is logged.
• Card details never reach us — they go directly to Stripe, our payment provider, and never touch our own systems.
• Deliveries that don't get lost — messages you set up for a date, or for after you're gone, are stored and checked on our side, not just on your device, so one you set up is not silently dropped.

No online service can promise perfect security, but we design every part of The Attic around the assumption that what you have entrusted to us cannot be replaced.

Data breach notification

If we ever discover a security breach that affects your personal information or recordings, we will notify affected users by email without undue delay, and comply with applicable breach-notification laws in your jurisdiction.

International data transfers

The Attic's providers store and process data primarily in the United States. If you access The Attic from outside the United States, you understand your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

Who can see your recordings

• Every recording starts out private — visible only to you.
• Family recordings are visible to the members of your family you choose.
• Scheduled recordings are delivered to specific recipients on the date you set.
• Legacy recordings stay locked until after your passing. Before any are released, we contact you first, and a person at The Attic reviews the release.
• Everyone — only if you choose it yourself for a particular recording, and confirm it. Then anyone with an Attic account can watch that recording, including people you don't know. You can switch it back at any time.
• A private link — only if you make one yourself, with Share, for a particular recording. Anyone you send it to (and anyone they pass it on to) can watch, listen to or read that one recording in a web browser, without an account, until you turn the link off — which stops it working for everyone at once. Recordings set to arrive on a date or after your passing can't be shared by link.
• Attic staff do not routinely access your recordings. We may access or review content only to resolve a support issue you initiated, to comply with the law, or to investigate a report or signal of prohibited use (see "Content moderation" below).

Content moderation

Your recordings are private by default and we do not routinely monitor them. To keep The Attic lawful and safe, we may use automated scanning and periodic spot checks, and we act on reports, to detect content that is illegal or violates our Terms — such as child sexual abuse material, which we report to the National Center for Missing & Exploited Children (NCMEC) and law enforcement as required by law. When we act on content, we may remove it, hold a delivery, or suspend an account, and we may preserve related data as the law requires. You can report content in the app or at abuse@intheattic.space.

Your rights

You can, at any time:

• Export your data — from Account settings, request a full export of your profile, recordings, lists, and family data. You'll receive a download link by email.
• Delete your account — from Account settings. This permanently deletes your recordings, profile data, and all scheduled deliveries. They disappear from The Attic straight away, and the recording files themselves are erased from our storage for good within 30 days. This cannot be undone.
• Correct your information — update your name, email, and contact details in Account settings at any time.
• Opt out of check-in emails — you can turn off the check-in emails in Account settings if you prefer to document your wishes elsewhere.

EU residents have rights under the GDPR including access, rectification, erasure, and data portability. California residents have rights under the CCPA. To exercise any of these rights, email privacy@intheattic.space.

Children

The Attic is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us at privacy@intheattic.space and we will delete the account promptly.

Data retention

We retain your data as long as your account is active. If your subscription lapses, your recordings are moved to a read-only archive state — they are not deleted. You will receive email notice before any data is deleted due to inactivity. You can request deletion at any time.

Changes to this policy

If we make material changes to this policy, we'll notify you by email and update the date at the top of this page. Continued use of The Attic after changes take effect constitutes acceptance.

Contact

Questions about this policy: privacy@intheattic.space