Privacy Policy

Family Legacy is a private, invitation-only archive operated for the Hopkin and Joelle family lines. We are the data controller for the personal data described below. You can reach the archive’s privacy contact at [email protected].

We collect only what the archive needs to work:

• Account data — your name, email address and password (stored only as a one-way hash, never in plain text).
• Voice recordings and transcripts — the conversations you record, and the text we produce from them.
• Photos, videos and documents you or other family members contribute.
• Profile details you choose to add about a family member — places, dates, languages and notes.
• Usage and technical data — your IP address and basic request information, kept briefly for security.
• Cookies — see the cookies section below.

Under the UK GDPR and GDPR, we rely on the following legal bases:

• Contract — to give you an account and let you use the archive.
• Consent — to record, store and transcribe a person’s voice, and to run optional analytics. You give this explicitly and can withdraw it at any time.
• Legitimate interest — to keep the archive secure and working, balanced against your rights.
• Legal obligation — where the law requires us to keep certain records.

A person’s voice is personal data, and recording it is intimate. We never record, store or transcribe anyone’s voice without their explicit consent, recorded at the time. Recordings are private to your family archive by default — never public, and never shared without the per-recording consent of the person speaking. You can ask us to remove a recording at any time.

• Account — until you ask us to delete it.
• Recordings, transcripts and contributed media — kept as part of the archive until you or the contributing family member asks us to remove them.
• Security logs — up to 90 days, then purged.
• Session data — expires within a day.
• Consent records — kept until consent is withdrawn.

We do not sell your data and we do not share it for advertising. We use a small number of service providers who process data on our behalf under contract (sub-processors):

• Render — hosting (USA, Standard Contractual Clauses).
• Neon — database hosting (USA/EU, SCC).
• Cloudflare — content delivery and privacy-first, cookieless analytics (global, SCC).
• Resend — sending account emails such as sign-in and verification (USA, SCC).
• Anthropic — AI assistance for organising transcripts (USA, SCC).
• Backblaze B2 — media and object storage for your photos, videos and recordings (EU-Central, Amsterdam; UK–EU adequacy / SCC).
• Deepinfra — embedding compute used to make your archive searchable, engaged only when immediate (paid) processing is activated (USA, SCC).
• Modal — video processing, engaged only when immediate (paid) processing is activated (USA, SCC).
• Sentry — error monitoring, to detect and fix faults in the service (EU region, Germany).
• Google Analytics — optional analytics, loaded only if you accept analytics cookies (USA, SCC).
• PostHog — optional product analytics to understand how the site is used, loaded only if you accept analytics cookies. We scrub family names and private links before anything is sent, and any screen recording is limited to our sign-up and marketing pages with all text and images masked (USA, SCC).

You have the right to:

• access the personal data we hold about you;
• correct anything that is wrong;
• have your data erased;
• receive a copy of your data in a portable format;
• object to or restrict how we use it;
• withdraw consent at any time, including consent to record a voice.

You can exercise the erasure and portability rights yourself from your account page — export your data or delete your account directly. For anything else, email [email protected]. We respond within 30 days.

We use a strictly necessary cookie to keep you signed in and to protect the archive — this needs no consent. Privacy-first analytics from Cloudflare are cookieless. Optional analytics cookies (Google Analytics and PostHog) load only after you accept them; you can reject them with one click, and rejecting is as easy as accepting.

The archive may hold stories and recordings that feature family members of any age, contributed by adults with the appropriate consent. The archive is not aimed at children, and accounts are for adults managing the family record. We do not use anyone’s data for advertising or profiling.

Some of our providers are based outside the UK and EU. Where your data is transferred internationally, we rely on Standard Contractual Clauses to keep it protected to the same standard.

If we change this policy in a way that affects you, we will update the date at the top and, where the change is material, let you know by email.

For any privacy question, or to make a complaint, email [email protected]. If you are in the UK you also have the right to complain to the Information Commissioner’s Office (ICO).