What we collect

Legacy Journal collects your voice recordings, written stories, and family-tree information to preserve your memories for future generations. We also collect your email address, display name, and (optionally) birthdate for account management and age verification.

Biometric information & voice cloning

Your voice is biometric information under several U.S. state laws — Illinois BIPA, Texas CUBI, Washington biometric and MHMDA laws, California CCPA / CPRA — the Tennessee ELVIS Act, the EU AI Act, and GDPR. We process your voice only after you accept the Legacy Contract, which authorises us to:

• Record and transcribe your voice during Ritual sessions.
• Store encrypted audio and transcripts in your secure vault.
• Process your voice over time to build a personal voice clone, used exclusively within your family's archive.
• Use your sealed transcripts as the sole knowledge source for your AI persona — your Eternal Voice.

Your voice clone is built passively during sessions and is never used during your lifetime without your knowledge. The clone is activated for heirs only after two-heir succession is verified.

Eternal Voice — what it is and isn't

Eternal Voice is your archive replaying or recombining what you actually said, in your own cloned voice, for the heirs you designated. It is bound to your sealed transcripts as the only knowledge source.

Eternal Voice will never fabricate a quote you did not say, never speculate on questions outside what you recorded, and never be used outside your family's archive.

Minors

Voice features are limited to users 18 and older. Users under 18 are not currently admitted to Legacy Journal. Under 13: never. When we eventually open to minors aged 13–17, voice features will remain restricted to age 18+ and we will implement parental consent in compliance with COPPA before any account is created.

How we use your data

Your voice recordings are used to: (a) create searchable transcripts of your stories, (b) build a voice clone for in-app navigation, Elora's voice, and posthumous Eternal Voice, and (c) deliver memories to the family members you designate. Transcripts may be processed by LLM services (Google Gemini, Anthropic Claude) to provide conversational guidance — these services receive text only, not raw voice.

Data storage & security

Memories are encrypted on-device with AES-256-GCM before they ever leave you. Audio is sent over TLS and stored encrypted at rest. Voice cloning is performed by ElevenLabs; transcription by Deepgram. Elora's guide voice is synthesized by Google Cloud Text-to-Speech and never receives your voice. Authentication is handled through Firebase. Legacy Journal staff cannot read your transcripts or listen to your audio.

Data sharing

We never sell, lease, trade, or otherwise profit from your biometric data. Your memories are shared only with the family members you explicitly designate. After the two-heir succession protocol completes, designated heirs gain access to the memories you sealed for them — and only those.

Succession — the vault opens only with two heirs

This is the most important commitment in this document. When two of your designated heirs independently confirm a passing within their authenticated Legacy Journal accounts, the vault releases to them. Never one heir alone. Never us, on anyone's instruction. Never anyone outside the heirs you named.

Until that two-heir confirmation, your archive remains private and inaccessible — to everyone, including Legacy Journal staff.

Permanence of sealed memories

Once a story is sealed, it is permanent. Sealed memories cannot be edited, deleted, or altered — by you, by an heir, or by Legacy Journal. This is by design: your stories must remain exactly as you told them. Unsaved session recordings are never persisted.

Durability

Legacy Journal uses a 3-2-1 redundancy posture — three copies, two storage media, one offsite — with periodic cryptographic fixity hashing to detect and prevent data degradation over time. We commit to preserving your archive for at least 100 years from your last active session.

Your rights

You may at any time:

• Request deletion of all your voice data or your entire account.
• Revoke Eternal Voice activation so your clone is not used after death even if heirs are verified.
• Request an export of your data.
• Request a copy of your consent and access history.

Email privacy@legacyjournalapp.com to exercise any of these rights. Standard response: within 45 days of receipt.

Third-party services

Legacy Journal uses the following third-party services:

• Firebase (Google) — authentication and real-time data.
• Supabase — encrypted database, vector search (pgvector), and file storage.
• ElevenLabs — voice cloning and clone-voice synthesis.
• Deepgram — speech-to-text transcription.
• Google Cloud Text-to-Speech — the AI guide voice Elora (does not receive your voice).
• Google Gemini and Anthropic Claude — AI-assisted conversation guidance (text only, never raw voice).
• Cloudflare — domain routing and edge caching.
• Sentry — application crash reporting (PII-redacted).
• Railway — backend hosting.
• Stripe — subscription billing.

Contact

Privacy questions or removal requests: privacy@legacyjournalapp.com

Heir & estate matters: heirs@legacyjournalapp.com

General correspondence: hello@legacyjournalapp.com