Privacy & Your Story

1.What we collect

We collect only what we need to produce your family's story. Here's what that includes:

• Intake information — the subject's name, age, addresses, family history, and stories you provide at signup.
• Audio recordings — sessions you upload, or calls conducted through our AI phone system.
• Transcripts — text versions of all recorded sessions, produced automatically after each call or upload.
• Photos and documents — images, letters, records, and other materials you upload to the vault.
• Social media exports — if you choose to upload a Facebook, Instagram, or WhatsApp export, that data enters your private vault only.
• Account information — the Keeper's name, email address, and billing details (billing is handled by Stripe; we never see your full card number).
• Session notes — any notes added by family members between sessions.

We do not collect information through tracking pixels, third-party ad networks, or behavioral analytics beyond basic site usage statistics (page visits, not personal data).

2.How we use it

Everything you share is used for one purpose: producing your family's story.

• Transcription — audio files are processed through automated transcription services to produce speaker-labeled text.
• Story synthesis — transcripts and intake information are used by our AI writing system to produce chapter drafts.
• Place and archive enrichment — locations and dates from your intake are used to find historical photos, maps, and context that enrich the narrative.
• Print fulfillment — when you order a book, your manuscript is transmitted to our print partner to produce and ship your hardcover.
• Communication — we use your email address to deliver chapter drafts, share updates, and respond to your questions. We do not send marketing emails without your explicit opt-in.

We do not sell your data. We do not share it with advertisers. We do not use it for any purpose other than the service you signed up for.

3.Where it lives

Your vault data is stored on secure cloud servers. Canadian customers have their data stored on Canadian-based servers in compliance with PIPEDA. US customers have their data stored on US-based servers.

The following third-party services are used to process and store data. Each has been selected for their strong privacy and security standards:

• Audio processing — OpenAI Whisper or Deepgram for transcription. Audio is transmitted over encrypted connections and not retained by these services beyond the transcription process.
• AI writing — Anthropic Claude API for story synthesis. Transcripts are sent to Claude for chapter generation. Anthropic's API terms prohibit using API data for model training.
• Phone calls — Twilio for telephony and ElevenLabs for AI voice. Call recordings are encrypted in transit and stored in your vault only.
• Storage — encrypted cloud storage with access controls limiting who can retrieve files.
• Payments — Stripe. Your billing data is handled entirely by Stripe and never passes through our servers.

4.Who can see it

Your vault is a walled garden. The only people who can see your family's content are:

• The Keeper — the person who created the account.
• Co-Keepers or contributors — family members you explicitly invite and grant access to. You control their access level and can revoke it at any time.
• Stories Echoed staff — only in the case of a reported technical issue, and only with your permission.

No other Stories Echoed customer, employee, or third party ever has access to your vault. Your content is never published, shared, or displayed anywhere without your explicit written consent.

5.AI and your data

Stories Echoed uses AI to transcribe conversations and write chapter drafts. Here is exactly how that works:

• Your transcripts are sent to the Claude API (Anthropic) to generate story drafts. Anthropic's API usage policy explicitly prohibits using API inputs and outputs to train AI models.
• Your audio is processed by a transcription service (Whisper or Deepgram) solely to produce text. Audio is not retained by those services.
• Your family's stories are never used to train any AI model — by Stories Echoed or any of our technology partners.

This is a core product promise, not a footnote. The stories in your vault belong to your family and exist nowhere else.

6.Your rights

You have the following rights with respect to your data. To exercise any of them, email us at info@storiesechoed.com.

• Access — request a copy of everything we hold about your family.
• Correction — ask us to correct any inaccurate information in your account.
• Deletion — request that we permanently delete your vault, including all audio files, transcripts, photos, and account data. We will confirm deletion within 30 days. Note: once deleted, your story cannot be recovered.
• Export — request a full export of your vault contents — all transcripts, chapter drafts, and uploaded files — in a portable format.
• Withdrawal — cancel your subscription at any time. Your vault and its contents remain accessible until you request deletion.

Canadian residents have additional rights under PIPEDA (Personal Information Protection and Electronic Documents Act). US residents in applicable states have rights under relevant state privacy laws. We honour all of these without requiring you to identify your jurisdiction.

7.Children and minors

Stories Echoed accounts must be created by adults (18+). Our service is designed for adult family members capturing the stories of elderly parents and grandparents.

If a family's story involves memories of childhood — the subject's own childhood, described in their voice — that content is treated with the same privacy protections as all other vault content.

We do not knowingly collect personal information from children under 13. If you believe a minor has submitted information to us, contact us at info@storiesechoed.com and we will delete it promptly.

8.Changes to this policy

If we make material changes to this privacy policy — changes that affect how your data is used or who can access it — we will notify you by email before those changes take effect. You will always have the opportunity to delete your vault before any new policy applies to your data.

Minor updates (clarifications, corrections, updated service provider names) may be made without notice. The date at the top of this page reflects the most recent revision.

9.Contact us

Privacy questions, access requests, and deletion requests go here: