Privacy policy

1. The essentials at a glance

Your family stories belong to your family. These are the key points:

• Stories, answers, voice recordings, and photos are end-to-end encrypted. Only you and the people you authorise can read, listen to, or view them. Not even we can do that. The only exception is a printed book you order: with your consent, a readable copy of exactly that book goes to the printer (section 5.14).
• Account, purchase, reminder, and technical operational data, as well as voluntary feedback, are not end-to-end encrypted. We process them only for the functions and purposes described here.
• Voice recordings are turned into text exclusively on your family's devices.
• We do not sell data, show advertising, create advertising profiles, or use your data to train AI models.
• You can delete your account in the app and contact support@familystories.love about your privacy. Sections 11 and 12 explain retention, deletion, and your rights.

2. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

FamilyStories UG (haftungsbeschränkt)
Gewalterberg 1
45277 Essen
Germany

Represented by the managing director: Vedad Taranin
Email: support@familystories.love

Data protection at FamilyStories is owned at leadership level. For anything related to data protection, you can reach us at the email address above.

3. Scope and definitions

• "App" means the FamilyStories app for iPhone and iPad.
• "Guest link" means a private link that lets an invited family member answer questions directly in the browser, without the app and without an account.
• "Family circle" means the shared, encrypted space in which a family collects its stories and synchronizes them between the members' devices.
• "Website" means familystories.love and its information pages.

4. End-to-end encryption: what we cannot see

Your family content is encrypted on your device before it reaches our servers. The keys remain on your family's devices or in the privately shared guest link. We do not possess these keys.

End-to-end encrypted content includes in particular:

• Answers to questions (text)
• Voice recordings and their transcripts
• Photos
• Family-tree details such as names, dates of birth, family relationships, and photos
• Labels, descriptions, and questionnaire details held within an individual story
• Custom questions and edited question texts
• Answers and recordings submitted through guest links

Not even FamilyStories can read, listen to, view, or decrypt your family content. The only exception is a printed book you order (section 5.14). This also applies to guest-link answers and family circles with email reminders. Keep your devices and private links safe: without the keys, we cannot recover lost content for you either.

The account, reminder, feedback, purchase, and operational data that we need to run the service is not end-to-end encrypted. This includes in particular your profile name, optional date of birth, email address, membership and activity details, and account and device identifiers. We describe this data completely in section 5.

5. What data we process and why

5.1 Account and sign-in

To create an account, we process your email address. You can sign in in one of the following ways:

• with a sign-in code sent to your email address,
• with your Apple account ("Sign in with Apple"), in which case we receive your email address or a relay address provided by Apple, plus an identifier,
• with your Google account ("Sign in with Google"), in which case we receive your email address, an identifier, and, depending on your approval, profile details such as your name and profile image from Google.

We also store your chosen profile name, an optional date of birth, your language, and account and device identifiers. We use these details to display and operate your account, assign you within family circles, communicate in the right language, and synchronize your devices securely. Sign-in is handled technically by our processor Supabase (section 9). The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

Your email address and a profile name are required for the account. Providing your date of birth is optional.

When you sign in with Google, Google's sign-in library may also process a user identifier and the IP address. Google may use the IP address to estimate the device's general location for fraud prevention. We receive neither the IP address nor that location from Google. Google acts as an independent controller for this sign-in process.

In the technical privacy declaration for its sign-in library, Google also lists phone numbers for sign-in functionality, along with user and device identifiers, other usage data, and other data types for functionality and analytics purposes. These disclosures describe Google's library; they do not mean that we receive all of this data from Google. FamilyStories requests only your email address and profile details from Google, not your phone number. Your encrypted life stories, answers, photos, and voice recordings are not sent as part of Google sign-in. You can find more information in Google's privacy policy and the privacy declaration for the library we use.

5.2 Your family content

We do not claim ownership of your family content or use it for our own purposes. We store it only in encrypted form to synchronise and preserve it within your family. The legal basis is Art. 6(1)(b) GDPR.

Some optional question areas expressly concern health, spirituality or religion, and social or political beliefs. This may include, for example, blood type, allergies, or health conditions. You decide whether to select such an area and which questions to answer; none of this information is mandatory. It remains end-to-end encrypted as family content and is not analysed by us. Please share information about other living people only when you are entitled to do so and with due regard for their privacy.

5.3 Voice recordings and transcription

When you answer a question with a voice recording, the app accesses the microphone with your permission. The recording is encrypted on your device and synchronized end-to-end encrypted like all other content.

Converting speech to text happens exclusively on your family's devices, using the device's speech recognition or a locally downloaded recognition model. There is no cloud transcription. Neither the recording nor the transcript ever reaches a speech recognition service outside your family's devices.

5.4 Photos

When you add photos to answers, the app accesses the images you select, with your permission. Photos are also encrypted on your device before they are stored or synchronized.

5.5 Family circle, invitations, and synchronization (technical metadata)

For encrypted synchronization to work, our servers process some technical metadata:

• pseudonymous account and device identifiers as well as the public keys of your devices,
• which accounts belong to a family circle and the permissions granted there (for example, who may invite members),
• for each family circle, the day a member last opened the app or an answer last arrived through a guest link, and the days on which a plan or additional storage ended, so that we can apply the retention periods described in section 11,
• timestamps, version counters, and the size of encrypted data packages,
• the list of your music favorites, when you mark a piece with the heart in the music player of the app, so that you can find them on your other devices too; the list contains only identifiers of pieces of music, is not end-to-end encrypted and is deleted together with your account,
• the status and technical identifiers of invitations and guest links, never their secret decryption keys.

This metadata contains no content. It is required to deliver changes to the right devices, enforce permissions, and prevent abuse. Legal basis: Art. 6(1)(b) GDPR.

When the app starts, it may use Expo to check for and download an app update suitable for your device. This involves technically necessary connection and update data, including the IP address, platform, app and runtime versions, release channel, and identifiers of the offered and installed update. The purpose is to provide the current app version securely, not advertising or ad measurement. The legal bases are Art. 6(1)(b) and (f) GDPR.

5.6 Purchases and subscriptions

Plans and extra storage are handled through the Apple App Store. Apple processes payment details such as your credit card number; we do not receive them. You pay for a printed book through Stripe (section 5.14).

We use RevenueCat to manage and restore purchases. The data processed includes a pseudonymous identifier linked to your account, product, purchase times, transaction and subscription status, purchase history, and technical details such as device type and operating system. RevenueCat also processes the necessary purchase receipts. We use this to assign purchases to your family circle, enable restoration, prevent purchase fraud, and analyse purchase history for operational purposes. The legal bases are Art. 6(1)(b) GDPR for purchase management and restoration, and Art. 6(1)(f) for fraud prevention and operational analytics.

Several members of a family circle can take out subscriptions for the same circle. All active members of the circle can see who pays for the plan and the extra storage, shown with that person's profile name; they do not see prices, purchase receipts, or Apple account details. If a member takes over with a bigger plan, we tell the person who paid until then once in the app and by email; we mention the new payer's profile name, never the name of the circle. If a member unlocks Premium or a bigger plan for the circle with a purchase in the app, also when it starts with a free trial, we tell the other active members once per purchase in the app and by email and, if they have allowed notifications, by push notification. In the app and in the email, we mention the buyer's profile name; the push notification contains no name, and we never mention the name of the circle. For these notices, we read profile names only when a notice is shown and do not store them in the notice itself. The legal bases are Art. 6(1)(b) GDPR for the circle's plan and billing and Art. 6(1)(f) GDPR for mentioning the profile name and for the notices to members (legitimate interest: transparency within the family about who pays for or unlocked the plan).

Deleting your account does not cancel your Apple subscription. In our own systems, we keep a minimal deletion and purchase record to assign later restorations securely. Limited billing data also remains where necessary. These records contain pseudonymous identifiers or their hashes, timestamps, and, where applicable, transaction identifier, product, Store environment, and purchase status. They contain no email address, name, family content, key, or signed Apple receipt.

During a restoration you request, we temporarily process old and new purchase identifiers and the necessary transaction details. Transfer data that is no longer needed is removed after completion. The legal bases are Art. 6(1)(b) and (f) GDPR. Retention follows section 11; where necessary, we handle purchase-data deletion requests together with the service providers involved.

5.7 Reminders

Story reminders are scheduled server-side as one shared setting for the relevant story and synchronized between the app and the guest-link browser. We process activation and confirmation status, cadence, local time, time zone, end date, next due time, technical versions, and delivery status. These details contain no story, question, or answer. Purpose: providing the scheduling and delivery that was explicitly requested. Legal basis: Art. 6(1)(b) GDPR.

For push notifications, we store a push token for each signed-in device together with platform, app version, selected app language, and technical delivery information. Expo and Apple Push Notification service (APNs) process the token and the deliberately content-minimized notification for delivery. Push is voluntary and can be disabled in the device settings. The notification contains no story, question, email address, or personal message.

For email reminders, we process the recipient address, language, schedule, confirmation and stop status, and an optional personal message. Addresses and messages are encrypted on the server, but are not end-to-end encrypted: we and Postmark need to read them for delivery. Please do not include private family content or secrets here. The email contains no private answer link and cannot open one; the invited person uses the link privately shared by their family to answer. External recipients must first confirm reminders by email (Art. 6(1)(a) GDPR). Every reminder email lets them stop the entire shared reminder, including any push channel.

5.8 App protection with Face ID or Touch ID

If you enable the optional app protection, the app uses your device's biometric features. Biometric data stays on your device and is handled by the operating system. We receive no biometric data; the app receives only the local confirmation.

5.9 Security and abuse prevention

When the app or the browser communicates with our servers, your device's IP address is processed temporarily for technical reasons in order to answer the request. It is not stored permanently together with your account.

To protect against abuse (for example, mass guessing of links or automated sign-in attempts), we limit how often requests can be made. For this, we process the IP address of the request in the form of a cryptographic hash (SHA-256). We do not store the IP address itself. The hash entries serve abuse detection only and are kept only as long as needed for that purpose. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, abuse-free operation).

5.10 Feedback in the app

When you contact our team through the feedback feature, we process the message you write to us there, the topics you select, and any images you choose to attach, such as a screenshot of a display problem. This means only the message and attachments you send to our team, not the answers or photos in your life stories. Nothing from your stories is attached automatically. Location and other EXIF metadata are removed from feedback images before upload.

We also process account and feedback identifiers, language, platform, app and operating-system versions, and timestamps. The "Include the technical log" option lets you attach technical details about recent app activity, such as error codes, screen names, timestamps, and the duration of technical operations. This log contains no text, photos, or voice recordings from your life stories. You can turn the option off before sending.

Your submission to our team is encrypted in transit and stored with access controls at Supabase in Frankfurt. Unlike your life stories, it is readable by our team so that we can help you, and is therefore not end-to-end encrypted. Please include only the details and parts of an image needed to explain your concern. Internal notifications through Postmark contain neither your feedback message nor images or links to them. A short acknowledgement is sent through Postmark to your account email address, without repeating your submitted message or images.

We use feedback for support, troubleshooting, and improving the app. The legal basis is Art. 6(1)(b) GDPR for contract-related requests, and otherwise our legitimate interest under Art. 6(1)(f) GDPR.

5.11 Support

When you contact us by email, we process your email address and the content of your message in order to answer your request. Legal basis: Art. 6(1)(b) GDPR, and for general inquiries Art. 6(1)(f) GDPR.

5.12 Technical stability, crash and error reports

We use Sentry (Functional Software, Inc.) to help keep the app reliable by processing technical stability data and crash and error reports. Technical app-session data is processed even when no crash occurs, for example whether the app runs without errors or a session ends because of an error. When an operation gets stuck, the affected function and the duration of the operation may be reported. This helps us fix problems and maintain stability; it is not used to analyse your life stories.

When the app crashes or a technical error occurs (in the app, on the website or in our server functions), a technical report is automatically sent to Sentry. It contains the location of the error in the program code, the app's technical steps immediately before it (for example "recording saved, transcription started, transcription failed"), app and operating-system version, device model, language, the name of the last opened screen, and a pseudonymous account identifier so that we can match feedback from you to the right report. The IP address of your device is processed on receipt for technical reasons and is not stored permanently.

These automatic technical reports contain no answers, voice recordings, transcripts, photos, names of family members, email addresses, invitation or guest-link secrets, or keys. Technical details are filtered accordingly before sending. We do not use session replay (screen recordings) or continuous performance recording. Messages and images you deliberately send to our team through "Report a bug" in the guest-link browser are handled separately (section 6). The legal basis for technical diagnostics is our legitimate interest in a stable, secure app (Art. 6(1)(f) GDPR). The data is held by Sentry in the European Union (Frankfurt am Main). Section 11 explains the retention periods.

5.13 QR codes for listening in PDF and Word files

If you create a PDF or a Word file in the app, it can contain a QR code beside answers that have a voice recording. Anyone who scans it with a phone hears the recording on a page of our website, without the app and without an account. The following applies:

• For each QR code we store at Supabase a random identifier, a check value for access, which family circle, story and answer it belongs to, which recording it currently plays, who created it and when, and an encrypted data package with the question, the name of the person telling the story, the answer text and the key to this recording. The QR code itself holds the key to this data package; in addition we keep it encrypted with your family circle's key, so a later file gets the same QR code and a family member's app can renew the data package. The secret part after the # sign stays in the browser. We can open neither the data package nor the recording.
• A QR code belongs to its answer. If the answer is recorded again or its text changes, the app of a family member who may edit the story seals the data package again, and the same QR code plays the new version. For this we also store which state of the answer the data package refers to (a sequence number, no content).
• Anyone who has the QR code can listen, including whoever receives the file, a printout or a photo of one of its pages, and this includes later versions of the answer. So only pass the file on where that is intended.
• The listen page sets no cookies, stores nothing in the browser, contains no analytics tools and appears in no search engine. To prevent abuse we process hashed IP addresses when a QR code is opened, as described in section 5.9.
• A QR code plays while the family circle has a plan or a trial, and after it ends for at least one more year (section 11). After that it rests until a plan is booked again. If the recording, the answer or its story is deleted, also after a grace period, we delete the QR code with all its stored data right away; at the latest this happens with the family circle. Section 5.14 applies to QR codes in an ordered book.

The legal basis is Art. 6(1)(b) GDPR (the listening function of the file you asked for) and, for abuse prevention, Art. 6(1)(f) GDPR.

5.14 Ordering printed books

Anyone who may read a story can order it in the app as a printed book. A printer can only print from a readable file. That is why the printed book is the only exception to end-to-end encryption, and it applies only when you explicitly want it. The following applies:

• The app builds the print files on your device. They leave it only after you have agreed with a separate tick box that is not pre-ticked and tapped the order button. With the order, we store which version of the consent text and of this privacy policy you saw, and the time.
• Exactly the print files of this book go to the printer: the book as a PDF (cover, pages and back cover) and the spine as a second PDF. They contain the texts and photos of the chapters you chose, exactly as they appear in the book, and the QR codes for listening. The delivery address is added. We ask for the recipient's phone number only for destinations whose carriers need it for delivery or customs, and for the state only for deliveries to the USA. Other answers, voice recordings as files, other photos and your email address do not go to the printer. Everything else in your family circle stays end-to-end encrypted.
• Until they are fetched, the print files are kept in a separate storage at Cloudflare (R2) with an EU data location, without public access and separate from the storage of your encrypted photos and recordings. Our servers check only the size, checksum and file format of the files, never their content. Our printer, Prodigi, fetches them through a link that is valid for at most 7 days, prints the book and gives the carrier only what belongs on the parcel.
• Books are printed close to the destination: for an EU country only in the EU or the EEA, for Switzerland and the United Kingdom also in that country, for the USA, Canada and Australia only there, for New Zealand in Australia or New Zealand, for Mexico and India only in the country itself, and for the other countries outside Europe in Europe, North America, Australia or the destination country. If the printer names another country, our servers refuse the order. For transfers to countries outside the EU, see section 10.
• At Supabase in Frankfurt we store for the order the order number, what was ordered (paper, number of pages, number of copies, prices and tax), the delivery address, where needed with phone number and state, the status at the printer, the carrier and the tracking number. The delivery address is not stored on your device. Only the person who placed an order can see it.
• You do not pay for a printed book through Apple but through our payment provider, Stripe. You enter your card or account details in Stripe's payment sheet; they never reach us. Stripe receives from us only the amount and the order number, not the book, the story or the delivery address. Of the payment we store only its identifier, the amount, its status and the payment method (for example card or PayPal). The amount is reserved when you order and only charged once the printer has accepted the order. If you pay with PayPal or Klarna, that provider also processes the payment under its own privacy notice. What Stripe processes is described in Stripe's privacy policy.
• As soon as the print file is complete and the amount is reserved, we send you an order confirmation through Postmark to your account's email address. It contains the order number, order date, what was ordered, the delivery address, the delivery time and the price. It never contains the title or content of the story, a phone number or payment details.
• Each printed recording gets its own QR code in the book. Its secret part is only in the printed code, never on our servers. For each code we store a random identifier, a check value for access, which family circle, story and recording it comes from, and an encrypted data package with the question, the name of the person telling the story, the answer text and the key of the recording. We keep a copy of the recording in a separate storage at Cloudflare (R2) with an EU data location; it stays end-to-end encrypted. We can open neither the data package nor the recording.
• Each QR code in the book always plays exactly the printed recording with its text, regardless of plan, family circle and account, and even if the answer is later changed or deleted. Anyone who has the book, a copy or a photo of a page can listen, and so can anyone who has the print file. Section 5.13 applies to the listening page.
• A QR code in the book ends only if the person speaking on the recording, or their legal representative, asks for erasure, by email to support@familystories.love. That recording then no longer plays in any ordered book, and it can never go into a new book. For seven days we can undo a mistake; after that we delete the copy of the recording and keep only a note without content (identifier, order, dates, reason and case number). We cannot recall printed books. The end of a plan and the deletion of the family circle, an account, the answer or the recording do not end the QR codes in the book.
• We delete our copy of the print files as soon as the printer has fetched them; this also makes every link issued worthless. If an order never gets that far, we delete the files after 90 days at the latest, for test orders after 7 days; if an order is cancelled, expires or is refused, at once. The delivery address with phone number and state is kept for 760 days after shipping for questions about delivery and warranty, or 7 days if nothing is shipped. After that we make it unrecognisable, together with the tracking number. For orders to the USA, all that remains recognisable afterwards is whether the book was printed in the east or the west of the USA. Under its data processing agreement, Prodigi keeps print files and address for as long as needed for production, quality control, reprints and support.
• If the person who ordered loses the right to read the story, or the story is deleted, before the book has gone to the printer, we cancel the order and delete the files. If you delete your account, we do not recall a book that is already with the printer. We delete our files as soon as the printer has them, and the address at once. The order then remains without any link to you for our accounting.

The legal basis for ordering, printing, delivery, payment and the order confirmation is Art. 6(1)(b) GDPR (purchase contract). That a readable copy of your family content goes to the printer is additionally based on your explicit consent (Art. 6(1)(a) GDPR). You can withdraw it by cancelling the order while that is still possible; a book that has already been printed cannot be recalled. Keeping the address for delivery questions and warranty is based on Art. 6(1)(b) and (f) GDPR, keeping the order data for accounting on Art. 6(1)(c) GDPR. For the QR codes in the book, the legal basis is Art. 6(1)(b) GDPR (the listening function of the book you ordered) and, towards the people on the recordings, Art. 6(1)(f) GDPR (the family's legitimate interest in listening to the printed memories).

6. Answering and reminders through a guest link in the browser

A family member can create a private guest link from the app and send it, for example, to grandma. The invited person then answers the questions directly in the browser. The following applies:

• No account and no sign-in are needed. During ordinary reading and answering, we collect neither the invited person's name nor their email address nor any other account data. We process an email address only if that person voluntarily sets up an email reminder.
• The secret part after the # character stays in the browser. It is not sent to our servers or the email provider, including when setting up a reminder.
• Answers and voice recordings are encrypted in the browser before they reach our servers. Here too, we store only encrypted data packages.
• Unsent answer drafts and the chosen display language are stored only locally in the browser (localStorage). A reminder save not yet confirmed by the server is stored in IndexedDB, encrypted with a key derived from the private link, until the server confirms it or you clear browser data. These technically necessary storage operations are based on Section 25(2)(2) of the German TDDDG.
• Music favorites: when you mark a piece with the heart in the music player of the guest page, we store the list of those pieces with your guest link on our server, so that you can find your favorites again in another browser too. This is only about favorite music: the list contains no names, no answers and no personal details. That is why it is not end-to-end encrypted, and it is deleted when the story or the family circle is deleted. The kind of music, repeat and volume are remembered only by your browser.
• For reminders, you can select an authorised person in the family circle or an external email address. The member picker shows only the necessary display names, not account email addresses. External addresses first receive a confirmation email. Other reminder data is processed as described in section 5.7.
• The guest pages contain no cookies, no analytics tools, and no tracking.
• For abuse prevention, we process hashed IP addresses when a link is opened and when answers are submitted, as described in section 5.9.

Through "Report a bug", you can choose to tell our team about a problem with the guest page and attach images you select, such as a screenshot of the problem. This is a separate message to our team, not an answer to a life-story question. Answers, photos, and voice recordings from your life stories are not attached automatically. Please select only the details and parts of an image needed to explain your concern.

The feedback message you write and the images you attach are sent to Sentry in a form our team can read. If you select "Send technical protocol", the submission also includes technical events, a random session identifier, and language, screen, and browser details, without answers or media from your life stories. This submission is encrypted in transit but is not end-to-end encrypted.

We also store the feedback message and any attached technical log at Supabase, together with a reference to the guest link without its secret key, a browser identity hash for abuse prevention if available, browser details, language, screen, timestamp, report identifier, image count, and any Sentry event identifier. The image files for this guest feedback are held by Sentry, not in this Supabase record. Postmark notifies our team of the submission using technical details only, without the feedback message or images. We do not ask for an email address for this bug report. We use this data for support and troubleshooting under Art. 6(1)(b) or Art. 6(1)(f) GDPR, as applicable. Retention is described in section 11.

The legal basis for processing when answering through a guest link is Art. 6(1)(b) GDPR with respect to the person answering (providing the answering feature) and otherwise Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the family circle).

Good to know: anyone who has the link can read and change this one story with everything in it, including all answers, photos and voice recordings, even those added in the app. The link should therefore be treated like a key and shared only with the person it is meant for. The link can be renewed in the app at any time; the old link then becomes invalid.

7. Website

When you visit familystories.love, our hosting provider Vercel (section 9) processes the technically necessary connection data (in particular IP address, time of access, page requested, browser type) in server logs in order to deliver the website and ensure its security and stability. Legal basis: Art. 6(1)(f) GDPR.

For audience measurement, we use Vercel Web Analytics. It may process the timestamp, page URL and route, referrer, filtered query parameters, location derived from the IP address, browser and operating-system versions, device type, and analytics-script version. The tool works without cookies or cross-device tracking. Visits are evaluated only in aggregate and are not tied to a person or stored IP address. The daily identifier derived from the request expires after 24 hours, so no lasting profile or cross-session browsing history is created. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement).

The website sets no advertising or tracking cookies. The guest link pages are fully excluded from audience measurement.

If you sign up for the one-time message announcing the app launch, we process your email address, selected language, and sign-up time solely to send that requested message. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time by emailing support@familystories.love. We delete the entry after sending the message or an earlier withdrawal, unless a legal obligation requires otherwise.

We store technically necessary settings in cookies and your browser's local storage for the language you expressly select. They are used only to display the website in that language and avoid showing the language selector again after you have made a choice. The basis for this storage is section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

If a technical error occurs on the website or while answering through a guest link, it is reported to Sentry as described in section 5.12: without answers, recordings, photos, names or guest-link secrets, only with technical details about the error, browser and operating system.

8. Legal bases at a glance

• Art. 6(1)(b) GDPR (performance of a contract): account, synchronization, family circle, explicitly configured reminder scheduling, purchases, support and feedback related to your account.
• Art. 6(1)(f) GDPR (legitimate interests): general feedback and improvement of the app, technical stability and error diagnostics, security and abuse prevention including purchase fraud, operational analysis of purchase history, notices to family members about payers and plan changes in the circle, server logs, and privacy-friendly website audience measurement.
• Art. 6(1)(a) GDPR (consent): an external email reminder starts only after confirmation through the email sent to you and can be stopped through every reminder email. The website launch message is also based on your consent. Independently, you control device permissions for the microphone, photo selection, and notifications in your device settings.
• Art. 6(1)(c) GDPR (legal obligation): retention where required by law (for example, tax-law obligations relating to purchase records).
• Printed books (section 5.14): Art. 6(1)(b) GDPR for ordering, printing, delivery, payment and the order confirmation; (a) for the readable print file sent to the printer; (b) and (f) for keeping the delivery address; (c) for the order data in our accounting; (f) for the QR codes in the book towards the people on the recordings.

9. Recipients and processors

We use the following service providers. Before engaging them and throughout the relationship, we check that they process personal data under the same or equivalent safeguards. Where they act as our processors, agreements under Art. 28 GDPR are in place.

We otherwise disclose personal data only when legally required. We cannot disclose family content in readable form because we do not possess its keys. The only exception is the print file of an ordered book while it waits with us for the printer.

10. Transfers to third countries

Your account and operational data, together with feedback data stored at Supabase, are held in Frankfurt am Main. Technical diagnostic data and the messages and attachments sent to Sentry through the guest feedback feature are held in Sentry's EU region in Frankfurt am Main. End-to-end encrypted media files are held in Cloudflare R2 with an EU data location. Some of our service providers are based in the USA or may access systems as part of support and operations. Where personal data is transferred to the USA in this context, we rely on adequacy decisions of the EU Commission (in particular the EU-US Data Privacy Framework, where the provider is certified) and on EU Standard Contractual Clauses under Art. 46(2)(c) GDPR.

You can request a copy of the safeguards we use by emailing support@familystories.love.

To send transactional email and internal feedback notifications, Postmark (AC PM LLC) processes the minimized data listed in section 9 in the USA. Feedback images, signed links to them, and the secret guest-link fragment are not transferred to Postmark. For app updates and voluntary push notifications, Expo (650 Industries, Inc.) processes the necessary technical data, and APNs relays the content-minimized notification through Apple. The safeguards described in the preceding paragraph apply to these transfers.

When a printed book is delivered to a country outside Europe, for example the USA, Canada, Australia, New Zealand, Japan or India, the print files and delivery address go to a printer outside the EU and to the carrier in the destination country. The EU Standard Contractual Clauses incorporated in Prodigi's data processing agreement apply. For some countries, such as Canada, New Zealand, Japan, Israel, Switzerland and the United Kingdom, there is also an adequacy decision of the EU Commission.

Your family content is also unreadable to these service providers because it is end-to-end encrypted. The only exception is the print file of an ordered book, which the printer has to read in order to print it.

11. Storage and deletion

• Account: you can delete your account in the app settings immediately or after 30 days. Normal app access ends immediately in either case. You can cancel a scheduled deletion until final processing, but not an accepted immediate deletion. Final deletion removes account data, sign-in, device associations, music favorites, keys, and personal recovery data. The limited purchase records described in section 5.6 remain to the extent explained there.
• Family content: contributions in a continuing family circle remain encrypted there; references to your account and devices are anonymised. Your own family circle is transferred to an active member with administrator rights or, if there is none, deleted together with its encrypted content and media.
• Full storage: if a family circle's storage is full, we delete nothing. New photos and recordings stay on the device where they were made until there is room again; text continues to be saved.
• Grace period after a plan or storage ends: when a plan (including a trial or a gifted plan) or additional storage ends, or additional storage becomes smaller, the smaller allowance applies at once. Nothing is deleted at first. Whatever lies above 50 GB (or above reduced additional storage) stays stored for three months from the day the storage last became smaller. As long as a plan or additional storage is running, nothing below that is deleted. If the family circle has neither a plan nor additional storage, everything else stays stored for one year from the later end of the plan or the additional storage. If the family circle is still above the allowance that then applies after one of these periods, we delete photos and recordings in answers, the most recently added first, until it fits again. Text, transcripts, stories, questions, profile pictures, story pictures, and the family tree remain. Booking a sufficient plan or storage during a grace period ends it; photos and recordings that have been deleted cannot be restored. Until a plan ends, you can save content as a PDF, a Word file, or an archive of your photos and recordings; after that, this is possible again with a new plan.
• Unused family circles: a family circle without a plan and without running additional storage that nobody uses for one year is deleted with all its content and media, on the server and on the members' devices. Use means that a member opens the app or that an answer arrives through a guest link; background synchronisation, emails, and notifications do not count. The members' accounts and their other family circles remain.
• Notices before deletion: before these two deletions (after a grace period and of unused family circles), we write to all members of the family circle 30 and 7 days in advance by email and by notification on the device where allowed; before photos and recordings are deleted after a grace period, also in the app. Deletion happens no earlier than the day after the stated date, and only if both notices for exactly that date were handed over for sending in time; immediately before, we check plan, storage, and use again. We cannot tell whether an email was read or a notification was shown. If the storage becomes smaller and something would be deleted afterwards, we also email all members right away.
• The legal basis for these periods is Art. 6(1)(b) GDPR (the booked scope of the service) and Art. 6(1)(f) GDPR (our legitimate interest in not storing data indefinitely that nobody uses anymore, in line with storage limitation under Art. 5(1)(e) GDPR).
• Reminders: stopping a reminder ends further deliveries but does not automatically delete the encrypted address, personal message, and configuration. This data may remain to keep the reminder safely stopped and allow a later setup that is deliberately confirmed again. It is removed when the email channel is fully removed or the related story, family circle, or account is deleted, unless a legal obligation requires otherwise. You can request earlier deletion at support@familystories.love.
• Notification device identifiers are disabled or removed on sign-out, account deletion, or proven permanent invalidity. Hashed IP addresses used to prevent abuse are retained only for the short rate-limiting windows and then deleted.
• In-app feedback: attached images are deleted within 90 days, and the feedback message, attached technical log, and other feedback data within twelve months. Incomplete submissions are removed within 24 hours after their reservation expires. Account deletion or a valid request for earlier erasure removes the associated data sooner, unless a legal obligation or overriding retention reason applies.
• Guest-page feedback: report and log data stored at Supabase is deleted within twelve months or when the associated guest link is deleted. The feedback message and attachments at Sentry are subject to the retention periods set out in the next item. You can request earlier erasure, where applicable, by emailing support@familystories.love with your report identifier.
• Technical diagnostic data and guest feedback at Sentry: Sentry's standard retention period is 30 to 90 days, depending on the plan and data type. After that, this data is no longer retrievable there. According to the provider, backups are deleted within 30 or 90 days of their creation. For more information, see Sentry's data retention periods and data deletion guidance.
• Email records: our delivery records for successful feedback notifications are deleted within 30 days. Postmark may retain the email content it processes and related activity data for up to 45 days.
• Website: runtime logs from our website functions are retained for one hour under our current Vercel plan. This period does not apply to all of the provider's security and operational data; those are subject to the retention periods necessary for their respective purposes. Launch notification entries are deleted after the message is sent or consent is withdrawn earlier, unless a legal obligation requires otherwise.
• Purchase data remains for as long as necessary for contract handling, renewals, refunds, secure restoration, preventing duplicate assignment, or legal obligations. The minimal record of a deleted account may remain even without a known purchase assignment while restorable purchases could still be presented later. For Lifetime, this may be a long period.
• Printed books: we delete the print files as soon as the printer has fetched them, after 90 days at the latest. We make the delivery address unrecognisable 760 days after shipping, or after 7 days if nothing is shipped. We delete the copies of the recordings for the QR codes in the book when the person on the recording asks for it. Details are in section 5.14.
• You can delete local data by removing the app or clearing browser data. An encrypted reminder request in the browser that has not yet been acknowledged remains until server confirmation or until browser data is cleared.

12. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time, on grounds relating to your particular situation.

An informal email to support@familystories.love is enough to exercise your rights. To protect your account, please write to us from the email address linked to your account.

We cannot read or export your encrypted family content for you. You can view, change, export, and delete it directly in the app. In the free allowance, only the first five questions of each story can be read and exports are locked; with a plan or during a trial, everything is open to you. For account, reminder, and other data we can read, you can exercise your rights through our contact address.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (www.ldi.nrw.de); you can also contact the supervisory authority where you live.

13. Responsibility within your family

Your family decides whom to invite and what content to share. Please respect other people's privacy and keep guest links confidential. We remain responsible for the processing by our Services described here; any household exemption that may apply to family members' private activities does not change this.

Permissions within the family circle control who can read and edit stories. The shared family tree is visible and editable by all members. We cannot retrieve copies that have already been downloaded or exported to other people's devices.

14. Children and teenagers

FamilyStories is intended for families. The legal age limits and consent requirements where you live apply to its use. Where required by law, a parent or legal guardian must consent to or be involved in use of the service and the processing of personal data.

Children can contribute family stories together with their parents or legal guardians. The privacy rules described here also apply to them. If you are a parent or guardian with questions or a request to delete a child's data, you can reach us at support@familystories.love.

15. Data security

In addition to end-to-end encryption, we protect your data through, among other things:

• modern, vetted encryption schemes for content and key material,
• storage of device keys in your device's protected key store,
• transport-encrypted connections (TLS) for all communication,
• server-side access controls and permission checks for every request,
• rate limiting and further safeguards against abuse.

No system can guarantee absolute security. On our servers, your family content remains encrypted and unreadable without your family's keys. The only exception is the print file of an ordered book until the printer has fetched it (section 5.14).

16. No advertising, advertising profiles, or AI training

We do not show advertising, sell personal data, or share it for advertising purposes. We do not create advertising profiles or make automated decisions within the meaning of Art. 22 GDPR. Family content and account, reminder, feedback, purchase, and operational data are not used to train our own or third-party AI models.

17. Changes to this privacy policy

We update this privacy policy when our Services or the legal requirements change. You can always find the current version in the app and on our website. If the changes are significant, we will additionally inform you in the app or by email.

18. Contact

For questions about data protection, you can reach us at:

FamilyStories UG (haftungsbeschränkt)
Gewalterberg 1
45277 Essen
Germany
Email: support@familystories.love