1. Who We Are

KeepsakeVault ("we," "us," or "our") is a family memory preservation service that lets parents and family members capture, store, and share their children's moments privately. This Privacy Policy explains what personal information we collect, how we use it, and your rights regarding your data.

Questions? Reach us at privacy@keepsakevault.app.

2. Information We Collect

Account information

When you create an account we collect your email address, password (hashed by our authentication provider), and an optional display name.

Memory content

We store the content you actively upload: text quotes and captions, photos, videos, audio recordings, location names and coordinates (if you choose to add them), tags, and associated child profile information such as names, nicknames, and birthdays. This content belongs to you.

Usage and technical data

We collect standard technical data including your IP address, device type, operating system, app version, crash reports, and feature interaction logs. This helps us keep the app stable and improve it over time.

Payment information

Web subscription and billing details are processed by Stripe; mobile purchases are processed by Apple App Store or Google Play and managed in the app through RevenueCat. We never see or store your full card number. We receive provider identifiers, entitlement or subscription status, and billing-period information needed to provide your account tier, storage, and overage features.

3. How We Use Your Information

To provide, maintain, and improve the KeepsakeVault service.
To authenticate your identity and manage your vault.
To display memories to vault members you have explicitly invited.
To send transactional emails such as vault invitations, handoff notifications, and billing receipts.
To process payments and calculate storage overages.
To detect and prevent abuse, spam, or illegal content.
To respond to your support requests.

We do not sell your personal information or memory content to third parties. We do not use your memories to train artificial intelligence models.

4. How We Share Information

We share data only in these limited circumstances:

Vault members you invite. Memories marked as non-private are visible to other members of your vault (e.g. a co-parent or grandparent you have invited).
Service providers (sub-processors). We rely on the following providers, each of which processes only the data necessary for their function and is bound by their own privacy policies:
- Neon — managed PostgreSQL database and authentication (USA / EU regions).
- Cloudflare R2 — object storage for your photos, videos and audio.
- Stripe — subscription billing and payment processing.
- RevenueCat — Apple App Store and Google Play in-app purchase management.
- Apple App Store and Google Play — mobile in-app purchase billing.
- Emailit — transactional email (vault invitations, handoff notifications, billing receipts).
- Sentry — error monitoring on our API server, native mobile app and web app.
- Expo / Apple Push Notification service / Firebase Cloud Messaging — push notification delivery to your devices.
Oracle journaling prompts and monthly recap summaries are generated entirely on our own servers. No memory content, child names, or any other vault data is sent to a third-party AI provider.
Vault Handoff recipients. If you use the Vault Handoff feature to transfer a child's memories to them when they come of age, the recipient will gain access to the memories in that child's profile.
Legal requirements. We may disclose information if required by law, court order, or to protect the safety of our users or the public.

5. Data Storage and Security

Media files are stored in Cloudflare R2 object storage. All files are served via short-lived signed URLs (typically valid for one hour), meaning unauthorized parties cannot access your files by guessing URLs. Data in transit is encrypted using TLS. We apply application-level access controls so only authenticated members of your vault can retrieve your content.

Storage overages on paid plans are billed in whole-gigabyte increments, rounded up — for example, if your vault uses 50.01 GB on a 50 GB plan, you will be billed for one full GB of overage.

No system is completely secure. In the event of a breach that affects your personal data, we will notify you in accordance with applicable law.

6. Children's Privacy

KeepsakeVault is designed for parents and family members (users must be 16 or older to create an account). We store information about children (names, birthdays, memories) as entered by a parent or guardian — we do not knowingly collect information directly from children, and children do not create accounts.

If you believe we have inadvertently collected personal information from a child under 13 without parental consent, please contact us at privacy@keepsakevault.app and we will delete it promptly.

7. Data Retention

We retain account data and memory content while your account is active. When an individual memory is deleted, its app record is removed when the request succeeds; associated object-storage cleanup may run separately. A data-only deletion request removes the vault content while leaving the account active and starts cleanup of the associated media, which may finish separately. An account-deletion request locks the account and starts a 30-day recovery window. After that window, the account becomes eligible for final deletion processing and is surfaced by a daily sweep; final deletion may require operational processing. When it completes, the KeepsakeVault account, vault data, and uploaded media are removed from the app systems.

Payment providers may retain customer, billing, and transaction records under their own policies and applicable legal, tax, fraud-prevention, and dispute-resolution obligations. We do not promise a universal retention duration for those provider-held records. We may also retain limited records where required for legal compliance, security, fraud prevention, or resolving disputes.

8. Your Rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you.
Export your memories (use the Export feature in the app).
Correct inaccurate personal information.
Delete your account and all associated data.
Object to or restrict certain processing.

To exercise any of these rights, email privacy@keepsakevault.app. We will respond within 30 days.

9. Cookies and Tracking

The KeepsakeVault native mobile app does not use third-party advertising trackers or analytics SDKs beyond Sentry (crash reporting). The marketing website and web vault use Sentry for error monitoring and session cookies required for authentication. We do not use advertising cookies, behavioural tracking, or sell browsing data.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and, for material changes, notify you by email or in-app notice. Continued use of KeepsakeVault after changes take effect constitutes your acceptance of the updated policy.

11. Contact Us

For privacy questions, requests, or concerns, contact us at:
privacy@keepsakevault.app