Privacy Policy

Spomen helps you record and preserve personal and family stories. This policy explains what data we collect, why, and the rights you have over it. Spomen is operated from Austria (EU); the operator's full legal details are in our Impressum.

What we collect

To provide the service, we collect:

• Account details. If you sign in with Google, Apple, or Facebook, we receive the basic account details that provider shares with us, such as your name, email address, and profile picture where available. If you sign in with email, we store your email and a securely hashed password.
• Your stories. The audio you record, its transcript, the AI-cleaned and edited versions, and details like titles, dates, places, people, and topics that you or the AI add. When you choose to have a story read aloud, we also generate and store narration audio of the written text.
• Scanned pages. If you choose to scan handwritten pages, we store the original page images, the text recognised by the scanning service, and the corrected text you approve as part of your story.
• Family & sharing. The groups you create or join, who is a member, which stories are shared with them, the people and the family relationships you record to build your family tree, and any share links you create.
• Usage & diagnostics. Basic, minimal technical data needed to run the service securely and fix problems. If you send feedback, we also store what you wrote, the page you were on, and your browser type to help us reproduce the issue.
• Payments and purchase support. Stripe and Link handle card and billing details for web purchases. Apple App Store or Google Play handles payment details for purchases made in the native apps. We never receive or store your full card number. RevenueCat receives the store receipt or purchase token, purchase history, subscription status, and a pseudonymous Spomen user ID so it can validate purchases, restore them across devices, and tell Spomen which digital entitlement to grant. We store the subscription purchase, amount, status, account email, and provider references needed for access control, receipts, support, refunds, and accounting. For an earlier purchase, we may also retain the transaction and support details required for refunds, accounting, and legal claims.
• Usage analytics. We use PostHog (hosted in the EU) to understand how the site and app are used. It stays off until you consent via the cookie banner, and we never record your screen or your story content.

Your original recordings and scans are never altered

Your original audio and its first transcript are kept unchanged. When the AI cleans up a story, or you edit it, those are saved as separate versions — so the words your family actually spoke are never overwritten. Original scanned pages and the first text recognised from them are also kept separately from the corrections you make.

Why we use it & our legal basis

• To provide the service you asked for — recording, transcribing, and storing your stories (contract, GDPR Art. 6(1)(b)).
• To process your recordings with AI transcription and writing providers, some outside the EU (your consent, GDPR Art. 6(1)(a), given when you record).
• Where a story touches special-category data — health, religious or political beliefs, ethnicity, sexual orientation — we process it only on your explicit consent (GDPR Art. 9(2)(a)), given when you record or share it.
• To keep the service secure and working (our legitimate interest, GDPR Art. 6(1)(f)).
• To measure website visits, only if you accept analytics cookies (consent).

How AI processing works — and what we won't do

When you record a story, your audio is sent to a speech-to-text provider to create a transcript, and the text is sent to a writing AI to suggest follow-up questions and to polish the story. The AI also recognises the people, places, dates, and topics in your story so it can tag and organise it and connect mentions to your family tree. If you ask to hear a story read aloud, its written text is sent to a text-to-speech provider that returns spoken audio in a single neutral narrator voice. If you choose to scan handwriting, the page image is sent to Google Cloud Vision's EU endpoint to recognise the text. Handwriting recognition can make mistakes, especially in names and dates, so Spomen requires you to review and correct the result before saving it. These providers process your content only to perform that task for us, under data-processing agreements.

• We do not use your recordings, transcripts, or photos to train, fine-tune, or improve any AI model — ours or anyone else's.
• We will never create a voice clone or synthetic likeness of you or anyone in your stories. The optional read-aloud narration uses a single neutral narrator voice — never a recreation of anyone's real voice. This is a permanent commitment, not a setting.
• We select providers that contractually commit not to train their models on the data we send through their API, and we use their data-retention controls where available. We cannot independently audit a provider's internal systems, so we commit to using providers with these protections, naming them below, and giving notice before adding a materially different one.

A story may touch sensitive topics (health, beliefs, family history). You choose what to record. By recording, you give your explicit consent to that content being processed by the providers below so we can turn it into a story for you.

Who processes your data (sub-processors)

We share data only with providers needed to run Spomen. Most process data under our instructions; a seller, payment service, or other provider may instead act as an independent controller for its own legal and compliance duties, as its notice explains:

• Supabase — database, login, and file storage (EU region)
• Cloudflare — audio recording storage in an EU-jurisdiction R2 bucket, and Turnstile security checks on account and public forms; Turnstile receives the browser and network signals needed to detect automated abuse, not the story or form content you enter
• Backblaze B2 — independently encrypted disaster-recovery copies of the database, file storage, and audio in its EU Central region; Backblaze cannot decrypt the archive contents
• GitHub Actions — temporary creation and client-side encryption of disaster-recovery archives on a short-lived hosted runner whose location is not fixed; plaintext working files are removed with the runner, and only encrypted archives are sent to Backblaze
• Vercel — website and app hosting
• LiveKit — real-time audio for live recording calls (EU region)
• Scaleway — speech-to-text transcription for all languages except Bulgarian and rendering of book PDFs; processed in the EU (France), not used for model training, with limited provider security/error retention possible under its service terms
• ElevenLabs — Bulgarian speech-to-text transcription only (USA)
• OpenAI, Anthropic — story writing, follow-up questions, and transcription fallback (USA)
• Google — sign-in with Google (only if you choose it), text-to-speech narration that reads stories aloud, and handwritten-page text recognition through the Cloud Vision EU endpoint
• Meta — sign-in with Facebook (only if you choose it); Spomen requests basic profile and email access for account creation and login
• PostHog — usage analytics, hosted in the EU (only if you accept analytics)
• Resend — sending account and notification emails (EU region)
• Migadu — receiving email you send to our support addresses (EU region)
• Stripe and Link — payment processing, billing, and tax calculation/collection as applicable; Link or another Stripe service is merchant of record only where the checkout identifies it as the seller
• Apple — Sign in with Apple (only if you choose it), plus native iOS payment processing, subscription management, purchase history, receipts, and refunds through the App Store
• Google Play — native Android payment processing, subscription management, purchase history, purchase tokens, and refunds
• RevenueCat — validating App Store and Google Play purchases, associating purchase and subscription status with a pseudonymous Spomen user ID, restoring purchases, and managing the digital entitlement shown in the app
• Lulu — support and legal records for earlier physical-book purchases only, including the book PDF and delivery details originally required to fulfil that order; Spomen does not currently offer new physical-book sales

We do not sell or rent your personal data, and we do not share it for third-party marketing.

Data sent outside the EU

Some AI, payment, entitlement, security, historical fulfilment, and backup-processing providers may process data outside the EU. Payment and entitlement services receive only the account, technical, and transaction data needed to process, validate, restore, support, and account for a purchase. The current hosted backup job temporarily handles story data before encrypting it, but keeps no plaintext archive after its short-lived runner ends; only the encrypted recovery archive is stored in Backblaze's EU Central region. Where a transfer requires a safeguard, we use an applicable lawful mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses. Your consent given when you record applies to story-content processing by AI providers; you can use the service without recording if you prefer not to have content processed that way.

Stories about other people, and recordings

Stories often mention — or record the voice of — family members. If you invite someone to record, or record a story about another person, you confirm you have their agreement, and that you have told everyone being recorded. When you add people and relationships to build your family tree, you may record basic details — such as names, relationships, and life dates — about relatives, including some who do not use Spomen themselves; we process this for the legitimate interest of preserving family history (GDPR Art. 6(1)(f)). Anyone whose personal data appears in Spomen can contact us to access or remove it.

Content you choose to share

Spomen is private by default. If you create a public share link for a story, you are instructing us to make that story — and any personal data within it, which may include the names, voices, images, or sensitive details of you and others — accessible to anyone who has the link. This is your decision and your explicit consent under GDPR Art. 6(1)(a) and, for any sensitive details, Art. 9(2)(a). A shared story is no longer protected by your account's access controls until you revoke the link. Share links are not indexed by search engines. You can revoke a link at any time; we cannot retrieve copies already viewed or downloaded while it was active.

How long we keep it

We keep your stories for as long as your account is active, because preserving them is the point of the service. When you delete your account, we begin deletion and erase your data from active systems within 30 days, except where the law requires us to keep limited records (for example, invoices, payment records, and records needed to establish or respond to a legal claim). Independently encrypted disaster-recovery copies of the database, file storage, and audio expire on a rolling schedule after approximately 90 days. The first 30 days of each recovery copy are protected against alteration or deletion. Backups are access-restricted, used only for disaster recovery, and are not restored as live account data after an erasure request except where technically necessary to recover the service; if a recovery occurs, deletion requests are re-applied. Purchase and tax records are kept for the period required by Austrian law. A provider involved in an earlier purchase may keep its own legally required transaction records under its privacy notice.

One honest exception: stories you contributed to a shared circle. Deleting your account erases everything in your private space and in circles only you own, and removes your name from contributions you made to shared stories — but the recordings and words themselves stay with that circle, because erasing them would tear holes in other people's family history. If you want your voice removed from shared stories entirely, remove those contributions before deleting your account, or email privacy@spomen.app and we will remove them for you.

After you're gone

Spomen is built to outlast its users. EU data-protection law does not, by itself, protect the personal data of people who have died, so what happens to your vault is set out in our Terms: where available you can name a legacy contact, and otherwise we respond to verified requests from your estate under the inheritance law that applies.

Your rights

Under the GDPR you have the right to:

• Access — get a copy of your data
• Portability — receive it in a machine-readable format
• Rectification — correct anything inaccurate
• Erasure — delete your data and account
• Restriction — ask us to limit processing in the circumstances the GDPR provides
• Object / withdraw consent — at any time, without affecting past processing

You can export or delete your account from your settings, or email us at privacy@spomen.app. We respond within 30 days.

Reporting illegal content

Your vault is private and we do not monitor its contents. If you believe content on Spomen — including something shared with you via a link — is illegal, tell us at privacy@spomen.app and we will act promptly, in line with the EU Digital Services Act. See our Terms for details.

Security

Your primary database, file storage, audio, and encrypted disaster-recovery archives are stored in EU regions. Some temporary processing may occur outside the EU as described above. Access controls limit story access to you and the family members you choose; connections are encrypted, and audio links are private and time-limited.

No online service can guarantee that a breach is impossible. If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours as required by the GDPR, and we will inform you without undue delay where the law requires it — telling you what happened, what data was involved, and what we are doing about it.

Children

Spomen is not intended for children under 16. If a child's story is recorded, it should be done by a parent or guardian who consents on their behalf.

Changes & complaints

We will update this policy as the service grows and tell you about material changes. If you believe we have mishandled your data, you can complain to the Austrian Data Protection Authority (Datenschutzbehörde) at dsb.gv.at.

Contact

Questions about this policy or your data: privacy@spomen.app