Last Updated: December 2025

Introduction

PhotoHeirloom ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our family photo preservation and sharing service.

Information We Collect

We collect the following types of information:

Account information: name, email address, and authentication data
Photos and videos you upload, including AI-enhanced versions
Family tree information: names, relationships, birth dates, and biographical details
Usage data: how you interact with our service

How We Use Your Information

To provide and maintain our service
To improve and personalize your experience
To communicate with you about your account
To ensure the security of our service

Google Contacts Integration

PhotoHeirloom offers an optional integration with Google Contacts to help you easily invite family members to your family tree.

What we access from your Google account:

Contact names from your Google Contacts
Email addresses associated with your contacts

How we use this information:

To provide autocomplete suggestions when adding email addresses to family member profiles
To help you quickly send invitations to family members

Important privacy protections:

Your Google Contacts data is NOT stored on our servers - it is only fetched temporarily when you use the autocomplete feature
We never share your Google Contacts data with third parties
You can disconnect your Google account at any time from your account settings

To revoke PhotoHeirloom's access to your Google Contacts, visit your Google Account settings at myaccount.google.com/permissions, or disconnect from your PhotoHeirloom settings page.

Data Sharing

We do not sell your personal information. We may share data:

With family members you invite to your family tree
With service providers who assist in operating our service (hosting, AI processing). For a complete list of our subprocessors, please see our Subprocessors page
When required by law or to protect our rights

Data Storage and Security

Your data is stored securely using industry-standard encryption. Photos are stored on Vercel Blob Storage with secure access controls. We use Clerk for authentication, which provides enterprise-grade security.

Data Retention

We retain your personal data for as long as your account remains active. Specific retention periods include:

Photos and videos: Retained while your account is active, plus 30 days after account deletion
Family tree data: Retained while your account is active, plus 30 days after account deletion
Account information: Retained while your account is active, deleted immediately upon account deletion request
Usage analytics: Anonymized data may be retained indefinitely for service improvement
Backup copies: Permanently deleted within 90 days of account deletion

You can request complete data deletion at any time from your account settings. Upon deletion, we will permanently remove all your data from our production systems within 30 days, and from backup systems within 90 days.

Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will:

Notify affected users via email within 72 hours of discovering the breach
Provide details about what data was affected and the nature of the breach
Explain what steps we have taken to contain and remedy the breach
Advise you on steps you can take to protect yourself (e.g., password changes, monitoring)
Notify relevant regulatory authorities as required by law (GDPR, CCPA, etc.)

We maintain robust security measures and continuously monitor our systems to prevent unauthorized access. Our incident response team is trained to act quickly to minimize any potential impact.

Your Rights

Under GDPR and similar regulations, you have the right to:

Access your personal data
Request correction of inaccurate data
Request deletion of your data (right to be forgotten)
Export your data in a portable format
Withdraw consent at any time

To exercise these rights, visit your account settings

Cookies

We use essential cookies for authentication and site functionality. We also use optional analytics cookies with your consent to improve our service. For detailed information about our use of cookies, please see our Cookie Policy.

Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe we have collected such information, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the 'Last Updated' date.

Contact Us

If you have questions about this Privacy Policy or your data, please contact us through our support channels.