Privacy policy

1. Who is responsible

The data controller is VOO Solutions OÜ (registry code 14492107), Estonia ("Moments", "we"). For anything in this policy, contact info@myfamilylegacy.ai. This inbox is monitored and is the fastest way to reach the controller. We have not designated a formal data protection officer; privacy matters are handled directly by the company's management.

2. What this policy covers

This website and the Moments product: the browser app, and the iPhone app, which is in testing now and reaches the App Store later. There is no Android app yet; when there is, this policy will cover it too. It is written for family members using Moments and for visitors to this site.

3. What we process

Account data

Name, email address, a password you choose, optional profile photo, and your settings, such as Elder Mode. Email and password is the only way to sign in today. Sign in with Google and Sign in with Apple are not offered; if we add either, this policy will say so before it goes live, because both would mean telling that company you use Moments.

Family archive content

The memories your family chooses to record: voice recordings and their transcripts, photos and their descriptions, written memories, answers to story and card questions, comments and reactions family members leave on a memory, family-tree relationships (including names, dates of birth and dates of passing), and invitations sent to relatives. This content routinely contains personal data about family members, including those without accounts; adding it is your family's choice and responsibility, and it stays private to your family.

Every memory carries a privacy tier you choose when you save it. Familymemories (the default) are visible to the relatives you have invited; privatememories are visible only to you, their author, and you can switch a memory between the two at any time. A private memory is still processed to make it searchable for you, but it is never shown to other family members or surfaced in answers to their questions.

Derived AI data

To let the Navigator answer questions, we create search indexes (embeddings) from your memories. They are derived from your content, belong to the same archive, and are deleted with it. Building these indexes and generating answers means content is sent to our AI provider (OpenAI) for processing; this happens on our instruction, the provider is contractually barred from using it for its own purposes or to train its models, and the results come back into your private archive.

It is worth being exact about what gets sent, because "the memory" is not the whole of it:

• the memory's text, or the transcript of the recording;
• the photo itself, when a photo is being described;
• any comments family members have left on that memory, together with the commenter's name, because a question is often answered by what a relative added underneath;
• and, with every question you ask the Navigator, who your family are: names, dates of birth, any dates of passing, and how people are related. Without it the Navigator cannot tell who "my grandmother" is. How much goes depends on the question: ask about one person and only that person's details are sent; ask an open question and the whole tree summary is. It is sent as reference material for that one question, and our agreement with the provider bars them from using it for anything else.

When you answer a spoken story question, the transcript is also sent so the app can offer one warm follow-up question. That is the AI acting as an interviewer, not as a listener: the question it writes is shown to you, and nothing is saved unless you answer it.

Photo understanding

When you add a photo, it is analysed by AI (OpenAI) to produce a plain-language description of what it shows (the people, place or occasion) so that photos become searchable and can be cited in Navigator answers. This analysis is carried out by a processor on our behalf; the description is stored in your family's archive alongside the photo and is deleted when the photo or the account is deleted. It follows the same privacy tier as the photo it describes.

Technical data

Server logs (IP address, device and browser type, the address requested, timestamps) and security events, kept short-term to keep the service running and safe. Note that the address requested includes the invitation link you were sent, so an unopened invitation appears in our host's logs; those logs expire, and an invitation can be cancelled at any time by whoever sent it.

Crash reports

When something in the app breaks, we send an automatic error report to Sentry, hosted in Germany. It contains the error and its technical stack trace, the app version, whether Elder Mode was on, and the screen you were on with any identifier removed, for example/memory/:id, never the actual memory. It contains no name, no email address, no account identifier, and none of your family's content. Sentry also sees the IP address the report arrives from, as any web service does.

Website and app measurement

We count page views using Vercel Web Analytics on both this site and the app. It sets no cookies, stores nothing on your device, and does not build a profile or follow you across sites, so it runs without asking for consent, in the same spirit as a server log. The address of the screen is sent with identifiers stripped, the same masking the crash reports use. It does not run in the iPhone app at all.

Separately, and on our own servers rather than anyone else's, we record one row each time an AI feature runs: which feature, how much it cost us, and which account triggered it. It is how we know whether the service is affordable and whether one account is being used in a way that would take the service down. It never leaves our infrastructure and is never used to build a picture of you.

Beyond that, this site sets essential cookies only. The consent banner also offers analytics, personalisation and advertising categories; none of those trackers is installed or active today, and none will load unless you switch the category on. Emails you send us are kept as correspondence.

Invitation requests

When you ask us to invite your family, by email today or through the invitation form this site will gain, we process your email address and any note you choose to add. We use them for one purpose: inviting your family to Moments. The legal basis is your consent (art. 6(1)(a)), which you can withdraw at any time. Requests are stored with our host, Supabase, in the EU, and kept until your family is invited or until you ask us to delete the request at info@myfamilylegacy.ai.

4. Why, and on what legal basis

We do not use your data for advertising, we do not sell it, and we do not use your family's content to train AI models. Ours or anyone else's.

5. Where data lives

Family archives are stored in the European Union, and crash reports go to Sentry's German region. Some AI processing (transcription, photo analysis, building search indexes and generating Navigator answers) is carried out by OpenAI in the United States, so the material listed under "Derived AI data" above (memory text, photos, audio transcripts, comments with their authors' names, and the family-tree summary that accompanies every Navigator question) is transferred to the US for that step. The website and the app itself are delivered by Vercel from a global network, which means the request for a page can be served from outside the EU; no archive content passes through it, only the app's own files. Where data leaves the EU it is covered by recognised transfer safeguards (EU standard contractual clauses or an adequacy framework), and the providers are barred from using your data for their own purposes.

6. Subprocessors

We keep this list current and announce changes before they take effect. Google is not on this list and is not meant to be: the app and this site load their fonts from our own servers, so no font request leaves the product, and we do not offer Sign in with Google.

7. How long we keep things

• Your own archive: until you delete it, or until account deletion. That means the people, memories, recordings, photos and search indexes that belong to the profiles you created.
• Account data: while your account exists; on deletion, removed from live systems within 30 days and from expiring encrypted backups within 90 days (see delete your account).
• Memories you added to a relative's archive: these stay, and your name comes off them. This is the one part of deletion that is not total, and it is deliberate: if you recorded your grandmother telling a story, that recording is her family's too, and erasing your account should not erase it from theirs. Anyone in that family can still delete it, and you can delete it yourself before closing your account. We are working on making this a choice you are offered at deletion time rather than a rule you have to read about here.
• Technical logs: typically 90 days.
• Legal-minimum records: only as long as the law requires.

8. Your rights

Under the GDPR you can ask for access, correction, erasure, restriction of processing, and a portable copy of your data; you can object to processing based on legitimate interest; and you can withdraw any consent at any time. Two of these are built into the app and need no email: account deletion erases your data (see delete your account), and Export my data under Settings builds a downloadable archive of your memories, transcripts, photos and recordings. The download link it gives you expires after seven days. For anything else, write to info@myfamilylegacy.ai and we will answer within a month. You can also complain to your local data protection authority, and we would rather you complained to us first.

9. Children

Moments is family software. Our terms require you to be at least the digital-consent age in your country (13 to 16 in the EU) to create an account. We do not ask your age or verify it today, and we would rather say that than imply a check we do not perform. Younger children appear in family memories under the responsibility of their adult relatives, which is how family photo albums have always worked; those memories remain private to the family.

10. Cookies and on-device storage

This site sets essential cookies only, including the record of your cookie choice itself (kept in your browser under moments.cookies.v1). Analytics, personalisation and advertising-measurement cookies exist as categories in the consent banner but are off by default, and no advertising trackers are installed today. You can change your choice any time via "Manage cookies" in the footer.

The Moments app keeps information in your device's own storage so that it works the way you left it. None of it is a tracker and none of it is shared with anyone; it never leaves the device unless you are signed in and the app is talking to your own archive. But it is not all preferences: four of the items below hold your sign-in, or text from your memories, and you should know which. All four are cleared when you sign out. Clearing your browser data, or deleting the app on a phone, removes every one of them. Today the full list is:

We use no other on-device storage: no advertising or tracking cookies, no offline database, no fingerprinting. Signing out now clears everything that belonged to that session: the signed-in session itself, any pending invitation, the answers held mid-deck, the drafts, and the copy of your family the app was holding in memory to stay fast. What survives is deliberately only the things that belong to the device rather than to you: display mode, language, and the markers that stop first-run setup and the tips walkthrough repeating. On a family tablet passed between people, signing out is now enough.

11. Security

Data is encrypted in transit and at rest. Archives are isolated per family by rules held in the database, so an ordinary request cannot reach another family's rows even if our own code asks it to. Two features answer with a server-side key that those rules do not constrain (the Navigator, and the background job that indexes a memory), and there the family boundary is enforced by our code and covered by tests instead. Administrative access is restricted to a single named account and refuses everyone else. We do not yet keep an audit trail of what that account looks at, and we are building one; until it exists we would rather say so than let "restricted and logged" stand in for half a control. Automatic error reports strip identifiers before they leave our servers. If a breach ever affects your data, we will notify you and the supervisory authority as the GDPR requires, in plain language, without burying it.

12. Changes

When this policy changes we date the change on this page and say what moved, and we email account holders before anything material takes effect. We will never weaken the no-sale, no-ads, no-AI-training commitments by footnote.

What changed

• 2 August 2026. First numbered version; the draft label came off. Added the invitation-request purpose: an email address and an optional note, processed by consent, stored with Supabase in the EU, and kept until the family is invited or the request's deletion is asked for. Moved three internal counsel notes out of the shipped page. Removed a stale note that claimed self-service export was not built; it is, and section 8 describes it.
• 27 July 2026. Rewritten against the code rather than from memory, then audited a second time by people who had not written it. Named two processors we had not named (our host, and our error reporter); listed the on-device storage we had left out, including your sign-in; said plainly that a summary of your family tree, and comments your relatives leave, are sent to the AI provider along with the memory; corrected the sign-in methods, which listed Google and Apple when only email and password exist; added the legal basis for cookieless page counts and for the weekly digest; described what account deletion does not remove; and replaced a claim that administrative access is logged, which it is not yet. A second audit round the same day corrected six more: the opening summary still said "erase everything"; section 2 described the iPhone app as unreleased when it is already with testers, and named an Android app that does not exist; the subprocessor note still offered Sign in with Google; the family-tree paragraph overstated what a question about one person sends, and claimed the provider does not retain it, which is not ours to promise; section 9 said an age check happens, and none does; and section 11 said family isolation is enforced entirely by the database, when two features scope it in our code instead.

Version: 1.0, August 2026.