Privacy Policy

This Privacy Policy explains how we collect, use, share, and protect information when you access or use LifeThread websites, applications, and related services (the “Service”). The software license for LifeThread is owned by Astro Arpanet LLC. By using the Service, you agree to the practices described here. If you do not agree, do not use the Service.

This Policy should be read together with our Terms of Use. If there is any conflict regarding dispute resolution or liability, the Terms of Use control to the fullest extent permitted by law. This Privacy Policy describes data practices; it is not a warranty, service-level agreement, or promise of security or availability. Liability for the Service is governed exclusively by the Terms of Use.

For self-hosted or customer-operated deployments, the deploying organization is typically the data controller. For a hosted LifeThread service, the hosting operator is the controller (or processor under a DPA — see /dpa).

1. Information we collect

• Account data — name, email, password hash (when you use email/password), optional MFA secrets (encrypted at rest) and backup-code material, plan and billing identifiers.
• Workspace / archive data — archive name, subject profile (e.g. name, birth date, summary, cultural background), memberships and roles (owner, contributor, viewer).
• Life journey content — timeline events, memories (stories), people and relationships, knowledge/lessons, personality / portrait notes, diary entries, links between entities, consent-related flags you set, and optional external photo URLs/notes (not hosted media libraries under current product policy).
• Ephemeral file processing — you may optionally choose a single photo so we can suggest date/time or GPS from camera metadata. You review and save facts yourself. We do not browse your camera roll or host a photo library. File bytes are held only for that request and are discarded afterward. Optional external photo links you paste are stored as URLs only.
• Legacy / executor settings — executor email, posthumous access toggle, and notes you enter (technical controls only; not a will).
• Billing data — handled by our payment processor when you subscribe. We store plan status and identifiers needed for paid features. We do not store full payment card numbers.
• Contact messages — name, email, and message content you submit via the contact form.
• Security / ops — audit logs (logins, exports, deletes, billing events), approximate IP and technical logs for rate limiting and security.
• Optional AI (Ask / Speak) — when enabled and a provider is configured, retrieved archive snippets and prompts may be sent to a third-party AI provider to generate answers.
• Cookies & local storage — as described in Section 7.

2. Your content; software only; no liability for contents

The Service is software used to store life-journey facts and optionally ask questions of that archive. We do not create a legal will, trust, or estate plan. You determine the purposes of content you upload and whether you have the right to process it. We process that content only to provide the Service. You are responsible for notices, consents, and lawful grounds for people appearing in stories or linked materials.

• Storage — archive records are stored so you and invited collaborators can review and maintain the journey. We use service providers to host and store this data as needed to operate the Service.
• Ask / Speak (optional) — if you use Ask/Speak and a provider is configured, selected text may be sent to that provider. Answers are assistive archive reconstructions only. Provider processing is governed by that provider’s terms and privacy practices.
• Sharing & invites — collaborators you invite may see content according to roles. You control invitations and revocation.
• Your responsibility — you assume and own all liability for use of the Service and for any content you create, share, or deliver. You are responsible for authorizing uploads, reviewing Ask/Speak output, and any disclosures to family or others.
• No liability for contents or output — to the fullest extent permitted by law, the Protected Parties described in the Terms of Use have no liability for archive accuracy, emotional harm, family disputes, defects in Ask/Speak output, or reliance on your content. This Policy is not a warranty. See our Terms of Use.

3. How we use information

• Provide, maintain, secure, and improve the Service.
• Operate login, workspaces, archive CRUD, invites, Ask/Speak, import / export, and plan limits.
• Run optional AI answers when you request Ask/Speak.
• Process subscriptions, prevent abuse/fraud, and enforce plan limits.
• Respond to contact-form and support requests.
• Comply with law, protect rights and safety, and investigate suspected misuse.

4. Legal bases (where applicable)

Depending on your location, we may process personal data based on:

• Contract — to provide the Service you request.
• Legitimate interests — to secure, improve, and administer the Service, prevent abuse, and support users.
• Consent — where required (for example certain optional cookies or processing of sensitive materials you choose to add).
• Legal obligations — to comply with applicable law.

5. How we share information

We do not sell your personal data or personal information to third parties — including for advertising or data-broker purposes. We do not rent or trade life-journey archive content for money. We may share information only as described below:

• Service providers — hosting, database, email, payments, and (if you use Ask/Speak) optional AI providers. They may process data only as needed to provide those services and must protect it appropriately.
• Collaborators you invite — according to roles you assign.
• Business transfers — in a merger, acquisition, financing, or sale of assets, information may transfer to a successor.
• Legal compliance — when required by law, legal process, or to protect rights, safety, or the security of the Service.
• Aggregated / de-identified data — that does not reasonably identify individuals.

We are not responsible for how third-party providers or your collaborators store, use, disclose, or secure data once it leaves LifeThread under your direction. We are not liable for your invitees’ or recipients’ acts.

6. Retention & your rights

We retain information as long as needed to provide the Service, comply with law, resolve disputes, and enforce agreements. Account and journal archive data are retained until you delete them or your operator’s retention policy ends. Uploaded source files used only for extraction are not retained after processing under current product policy. Audit logs may be retained longer for security. Backups follow infrastructure retention (for example database PITR).

You may export via Settings → Export my data (where available). You may delete your account via in-product controls or request help via Contact. After deletion, associated archive records are removed subject to backup retention and legal holds. We retain billing records as required for law, accounting, and fraud prevention.

Depending on your jurisdiction (including GDPR, UK GDPR, PIPEDA / Canadian provincial rules, and similar laws), you may have rights to access, correct, delete, restrict, or port certain personal data, or to object to certain processing. Submit requests via Contact. We may need to verify your identity before acting. Exercising those rights does not create extra contractual liability beyond what that law mandatorily requires; liability remains as stated in the Terms of Use except to the minimum extent a statute requires otherwise.

7. Cookies & local storage

When you use LifeThread in a browser, we may use cookies and similar technologies as follows:

• Necessary — session / sign-in so you can stay signed in and use protected features.
• Preferences — optional local UI settings in your browser.
• Analytics — reserved for optional product measurement. We do not currently rely on advertising cookies. If third-party analytics are enabled in a future release, they should remain off until you opt in where required.

You can manage cookies via your browser settings. Clearing site data may sign you out or reset local preferences.

8. Security

We implement reasonable administrative, technical, and organizational safeguards appropriate to a commercial online product. No method of transmission or storage is 100% secure. We cannot guarantee absolute security. Statements in this Policy about safeguards are descriptive only and do not create a warranty, guarantee, or liability beyond the Terms of Use.

You access the Service at your own risk. We are not responsible for unauthorized access arising from factors outside our reasonable control, including your devices, networks, credentials, or third-party systems. Report suspected security issues via Contact.

9. International transfers

Your information may be processed in countries other than where you reside. Those countries may have different data-protection laws. By using the Service, you understand that transfers may occur as needed to operate the Service through our providers. Where required, counsel should document appropriate safeguards (for example SCCs) for your deployment region.

By using the Service, you take the risk of that transfer. We are not liable for your compliance with your local country’s data-protection or other legal requirements (including Canada and other jurisdictions). Where a data-protection law applies to you, you keep only those rights that law does not allow you to waive. Those rights do not change that we provide software only, and they do not create extra contractual liability for your archive content or Ask/Speak output beyond the Terms of Use, except to the minimum extent a statute mandatorily requires otherwise.

10. Children’s privacy

The Service is not directed to children under 13 (or the higher age required in your jurisdiction). Do not create accounts for children under that age. If you store information about minors in an archive, you are responsible for having a lawful basis and appropriate consents.

11. Changes

We may update this Policy from time to time. The “Last updated” date will change when we post revisions. Continued use after posting means you accept the updated Policy, except where mandatory law requires additional consent.

12. Contact

Privacy questions: Contact form · Related: Terms of Use · License · DPA