Privacy Policy

Last updated: October 24, 2026

Heirloom ("we," "our," or "the app") helps families preserve stories from the people they love. We take privacy seriously because the memories you record in Heirloom are personal and irreplaceable. This policy explains what we collect, how we use it, and the choices you have. It applies to the Heirloom apps for iPhone and Android and to getheirloomapp.com.

1. Who we are

Heirloom is operated by Estes Labs LLC, an Indiana limited liability company ("Heirloom"). If you have questions about this policy or your data, contact us at privacy@getheirloomapp.com.

2. Information we collect

2.1 Information you provide

• Account information — your name, email address, and how you sign in (Apple, Google, or email and password). If you use Sign in with Apple and choose to hide your email, we receive Apple's private relay address instead.
• Storyteller profiles — the name, relationship, optional birthday, optional bio, and optional phone number or email you add for someone whose stories you want to record.
• Prompts — the questions you send to storytellers.
• Recordings — the video and audio stories recorded in the app, with their length, title, and the prompt they answer.
• Family membership — which families you belong to, your role in each (host, storyteller, or viewer), and the display name other members see. Invite codes record who created and who accepted them.
• Purchase information — subscriptions are bought through the Apple App Store or Google Play, which handle your payment details. We, and our subscription service RevenueCat, receive your purchase record and subscription status (plan, trial, renewal and expiry dates, store), linked to your Heirloom account ID. We never see your card number.
• Messages to us — anything you send to our support, privacy, or safety email addresses.

2.2 Information collected automatically

• Notification token — an identifier for your device that lets us deliver push notifications, plus the notification choices you make in Settings.
• Usage data — via Firebase Analytics, we collect app opens, which features are used, device type, and operating system version, to improve the app.
• Crash reports — via Firebase Crashlytics, we collect technical details when the app crashes or hits an error, so we can fix it.

2.3 Information we do not collect

• We do not collect your precise location.
• We do not read your contacts or photo library.
• We do not show ads or use your data for advertising.
• We do not sell your data.
• We do not use your data or recordings to train AI models.

3. How we use information

• Run the service — store your family's profiles, prompts, and recordings and keep them in sync across your devices and with the family members you invite.
• Notifications — tell you when a new story or prompt arrives, when someone joins your family, and when your free trial is ending. You can turn these off in Settings → Notifications or in your phone's settings.
• Subscriptions — confirm your purchase, free trial, and renewals with Apple or Google (through RevenueCat) so the app knows what you have access to.
• Account emails — send email verification, password reset, and subscription receipts and reminders.
• Scheduled prompts — if you turn on auto-prompts, the app sends a new question to a storyteller on the schedule you choose. You can pause or remove this at any time.
• Improve and protect the app — use aggregated analytics and crash reports to fix bugs and prioritize features, and investigate abuse reports.

Legal basis for processing (GDPR): If you are located in the EU or UK, we process your data under the following bases: contract performance — to provide the service you've signed up for; legitimate interests — for analytics, security, and fixing bugs, where those interests are not overridden by your rights; and consent — for optional features such as push notifications, which you may withdraw at any time.

4. Who can see your data

• Your family on Heirloom — everyone in a family (its host, storyteller, and viewers) can see that family's storyteller profile, prompts, recordings, and member names. Nobody outside the family can. A host can remove a viewer, and a viewer can leave at any time.
• Our service providers, who process data only to provide their service to us:
  • Google Firebase — hosting, sign-in, database, file storage, notifications, analytics, and crash reporting. Google and Heirloom operate under a Data Processing Agreement; for EU/UK users, Standard Contractual Clauses govern international transfers. See policies.google.com/privacy.
  • RevenueCat — keeps track of subscription purchases from the App Store and Google Play. See revenuecat.com/privacy.
  • Apple and Google — Sign in with Apple and Google sign-in, in-app purchase payments, and delivering push notifications to your device.
• Law enforcement — we disclose data only when required by valid legal process, and will try to notify you unless the law prohibits it.
• Business transfers — if Heirloom is acquired or merges with another company, your data may be transferred as part of that transaction. This policy will continue to apply to it unless you are notified otherwise.

5. Permissions

Heirloom asks for these permissions only when you use the feature that needs them:

• Camera — to record video stories.
• Microphone — to record audio stories and the sound for video stories.
• Notifications — to tell you about new stories, prompts, and family members.

You can turn any permission off at any time in your phone's settings.

6. Data retention and deletion

• Your data stays in Heirloom until you delete it. If your subscription ends, we do not delete your family's stories.
• Deleting a story, prompt, or profile in the app removes it from our live systems right away. Copies in our backups are removed within about 7 days.
• Deleting your account — use Settings → Delete Account in the app, or email privacy@getheirloomapp.com. This deletes your account and removes you from your families. It does not cancel a subscription bought through the App Store or Google Play; cancel that in your phone's subscription settings first. Step-by-step instructions: getheirloomapp.com/delete-account. Stories you recorded stay with your family so they are not lost for everyone else; delete them in the app first if you want them gone, or email us. If you are the only member of a family, its stories and prompts are deleted too. We complete any remaining deletion within 30 days.
• Apple, Google and RevenueCat keep purchase records for as long as tax and financial laws require.
• Analytics and crash data are kept by Firebase for up to 26 months.
• Your own backups — if you use Back Up Stories, copies are saved to the location you choose (for example iCloud Drive or Google Drive). We cannot access those copies, and deleting something in Heirloom does not delete them.

7. Children's privacy

Heirloom is not directed to children under 13. We do not knowingly collect data from children under 13. If you believe a child has used Heirloom without parental consent, contact us and we will delete the associated data.

8. Security

• All traffic between the app and our servers is encrypted with TLS.
• Data is encrypted at rest by Google Firebase.
• Access rules enforced on our servers ensure that only members of a family can read that family's content.
• We keep regular backups so your family's stories can be recovered if something goes wrong.

No system is perfectly secure. If you suspect a security problem, email security@getheirloomapp.com.

9. Your rights

You have the right to:

• Access a copy of the data we hold about you (Settings → Export My Data).
• Download your family's recordings (Settings → Back Up Everything).
• Correct inaccurate information.
• Delete your data.
• Turn off notifications (Settings → Notifications).

California residents (CCPA) and EU/UK residents (GDPR) have these rights plus the right to lodge a complaint with their local regulator. We do not sell personal information. To make a request, email privacy@getheirloomapp.com.

10. International users

Heirloom is currently offered in the United States, and its servers are located there. If you use Heirloom from outside the US, your data will be transferred to and processed in the US.

11. Changes to this policy

We may update this policy as the app evolves. Material changes will be announced in-app or by email. Continued use of Heirloom after a change indicates acceptance of the new policy. The "Last updated" date at the top reflects the most recent revision.

12. Contact

Email: privacy@getheirloomapp.com

Heirloom is built with care. Thank you for trusting us with your family's stories.