Privacy Policy

1. Who is responsible

Stumptown Ventures LLC, doing business as Gathered Lives (“we”, “us”), a limited liability company based in Portland, Oregon, operates gatheredlives.com and is the controller of the personal information described here. Contact us at support@gatheredlives.com. This policy applies to the website, the Service, the emails and links it sends, and printed products ordered through it. It should be read with the Terms of Service.

2. What we collect

Account information

When you create an account, our sign-in provider collects your email address and, if you use a sign-in like Google, the name and profile details that provider shares. We store your email, the name you choose to display, a confirmation that you are 18 or older, your email preferences, and the time you last signed in.

What you add to a Story

Memories: voice and video recordings, photographs, scanned letters and documents, and written text, along with the details you give about them such as a title, a date, a place, whose words they are, and who is in them. We keep the original file exactly as uploaded, plus copies we make to display it (a resized image, a converted format) and material we derive from it (a transcript, a labelled transcript of who said what, a passage index, facts, dates, people mentioned, and a numeric representation used for search).

Stories and the people in them

The Story’s title, introduction, settings, members and their roles, the people it is about and their names, years of birth and death, and relationships between people. Chapters, versions, editorial notes, guidance you give the writer, questions you ask, and frozen editions with their print files.

Information about people who are not users

Stories are usually about someone else, and the people who contribute may not have accounts. So we hold names, relationships, dates, likenesses and recorded voices of people who never signed up, added by their family and friends. A guest who contributes through a link gives us a display name and, if they choose, an email address, and we set a cookie so their next visit through the same link finds their earlier contributions.

Invitations and messages

When you invite someone we store the name and email you enter, the relation you describe, your note to them, and when the link was opened and used. Invitation links themselves are random and we store only a one-way hash of them.

Usage and technical information

Our own event log records that things happened, by identifier only: a Story was created, a memory was added, a draft was built, a page was viewed. It never contains the text of a memory, a name or an email address. Our servers keep ordinary request logs, including IP address and browser type, for security and troubleshooting. We keep an audit log of sensitive actions in a Story (who changed its visibility, who was added or removed, who deleted what) so that custodians and we can account for them.

Purchases

If you order a printed book we collect the shipping name and address and the details of the order. Payment card details are handled by our payment processor and never reach our servers.

Correspondence

When you write to us, we keep the correspondence.

3. How we use it

• To run the Service. Storing your memories, showing them to the right people, transcribing recordings, turning memories into chapters, laying out a book, and sending the emails and notifications the Service is built on.
• To write the Story. Recordings, photographs, documents and text are processed by software, including artificial intelligence models, to produce transcripts, facts, dates, people, chapters, captions, introductions and polished text. See section 5.
• To keep people informed. One note when others add memories, a note when yours is approved or lands in a chapter, invitations you or others send, and messages about your account. Recurring notification email can be turned off in your account and from a link in every such email.
• To keep the Service safe. Rate limits, abuse detection, security logging, and enforcing the Terms.
• To understand use and improve the Service. Using our identifier-only event log. We do not use third-party analytics or advertising trackers.
• To fulfil orders for printed products and to handle returns.
• To comply with the law and to respond to lawful requests.

Where the law requires a legal basis: we process your information to perform our contract with you (running the Service), on the basis of our legitimate interests (keeping the Service safe and improving it, in ways that do not override your rights), with your consent where we ask for it (optional emails, cookies beyond those needed), and to meet legal obligations.

4. What we do not do

• We do not sell or rent personal information, and we do not share it with data brokers.
• We do not show advertising or share information with advertisers.
• We do not use your memories, transcripts or chapters to train artificial intelligence models, and we require our providers not to.
• We do not read your Stories. Our staff can access a Story’s content only with a recorded reason, for support you have asked for or to investigate abuse, and every such access is logged.
• We do not put memory content, names or narrative text in analytics, logs, or in the link previews that messaging apps show.

5. Artificial intelligence and the providers that process your content

The chapters in a Story are written by large language models from the memories gathered. To do this, the text of your memories, transcripts of your recordings, and the details around them are sent to our model provider, currently OpenAI, under its business terms, which prohibit it from using that data to train its models and limit how long it may retain it. Recordings are sent for transcription the same way. We instruct the models to draw only on what was gathered and never to invent, and every sentence in a chapter is tied to the memories it came from, so that people can check it. The models can still make mistakes; the Terms explain that you should read a Story before relying on it.

We work with a small number of providers, each of which may only use your information to provide its service to us:

• Clerk, for sign-in and account security.
• Railway, which hosts the Service, its database and the storage where your files live, in the United States.
• OpenAI, for transcription, analysis and writing, as described above.
• Resend, for sending email.
• A print partner, when you order a book, which receives the print files and the shipping details for that order only.
• A payment processor, when you pay for a product, which handles your card details.

If we change or add a provider that handles your content, we will update this policy.

6. Who can see what

A Story is private by default: only the people its custodian has added can open it. A custodian can make a Story readable by anyone who has its link, or public. Within a Story, each memory has an audience: everyone in the Story, only its subjects, or only its custodians. The person who added a memory controls that audience and can narrow it at any time, and narrowing is never undone by the Story becoming more open. A public Story is readable by anyone and may be listed by search engines; a private or link-only Story is never listed, and its link previews show no names or photographs.

The people you invite see your display name and the note you write. Contributors’ names appear beside what they added and in the “Told by” page of a printed book.

We may disclose information if the law requires it, to protect the safety of a person, to enforce the Terms, or, with notice to you where we can, as part of a sale or transfer of the Service to a successor who takes on these commitments.

7. People who are the subject of a Story

If a Story is about you, you have rights in it whether or not you have an account. A living subject who signs in can claim their Story and take the lead of it, can make it more private at once, and must approve high-impact changes to it. If you learn that a Story about you, or content in which you appear, exists without your consent, write to us. We will verify who you are, and we may restrict, hide or remove the content or make the Story private while we look into it, without waiting for its custodian.

A custodian may name a successor who can be given the lead of a Story after the custodian’s death. We activate that only after a careful manual check.

8. How long we keep information

• Stories and memories are kept for as long as the Story exists. When a Story or memory is deleted it is hidden immediately and permanently removed after 30 days, a window that lets a mistake be undone. Derived material (transcripts, facts, chapters, search representations) is removed with it.
• Memories you added to someone else’s Story stay yours. They are not deleted when that Story is; you can delete them yourself at any time.
• Accounts are kept until you ask us to delete yours. Deleting an account removes your profile; Stories you led pass to another custodian if there is one, otherwise they are deleted with the same 30-day window, and memories you contributed are deleted unless you tell us to leave them with the Stories they are in.
• Guest contributions are kept with the Story they were added to. A guest can have their memories deleted by writing to us, or by creating an account, which places those memories under their control.
• Invitations expire after 30 days and can be turned off earlier. We keep a record that they existed.
• Email records hold a hash of the address, the type of email and whether it was delivered, never the content, for up to 12 months.
• Server logs are kept for a short period, typically no more than 30 days. The identifier-only event log and the audit log are kept for as long as the Story or account they describe, because custodians rely on the audit log.
• Backups of our database are kept for a limited time, typically no more than 30 days, and are then overwritten.
• Order records are kept as long as tax and consumer law require.

9. Security

Every request to read or change anything is authorised on our servers against the roles in the Story. Files are stored in private storage and served only through short-lived signed links issued after that check. Invitation links are long random tokens stored as one-way hashes, with expiry and revocation. Connections are encrypted in transit and files and database are encrypted at rest by our hosting provider. Staff access to content is limited, requires a recorded reason and is logged. No system is perfectly secure; if we learn of a breach affecting your information we will tell you and, where required, the authorities, without undue delay.

10. Cookies and similar technologies

We use only the cookies the Service needs: a session cookie set by our sign-in provider so you stay signed in, a signed cookie that identifies a guest contributor on later visits through the same link, and browser storage that keeps an unsent draft so a lost connection does not lose what you wrote. We set no advertising or third-party analytics cookies. You can clear cookies in your browser; you will need to sign in again.

11. Your rights and choices

Wherever you live, you can:

• See and correct your account details, and every memory, fact and chapter you have access to, within the Service.
• Export a Story you lead as a PDF, and download the original of any memory you added.
• Delete memories you added, Stories you lead, and your account.
• Restrict who sees a memory you added, or withdraw it from a Story.
• Turn off recurring email in your account or from the link in any such email. Messages needed to run your account, such as invitations you are sent and security notices, are still delivered.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the rights of access, rectification, erasure, restriction, portability and objection under data protection law, and the right to complain to your supervisory authority. Where we rely on your consent you may withdraw it at any time. If you are a California resident, you have the rights to know, delete, correct and to opt out of sale or sharing under the California Consumer Privacy Act; we do not sell or share personal information as those terms are defined there, and we do not discriminate against you for exercising your rights. Residents of other US states with privacy laws have similar rights.

To exercise any right, or to act on behalf of someone else, write to support@gatheredlives.com. We will verify your identity, which may mean asking you to sign in or to confirm from the email address we hold, and we will respond within 30 days, or tell you if we need longer. Requests about content added by other people are handled as described in section 7.

12. Where your information is held

The Service is hosted in the United States, and our providers process information there and in other countries where they operate. If you use the Service from elsewhere, your information is transferred to the United States. Where the law requires safeguards for such transfers we rely on standard contractual clauses with our providers and on the safeguards those providers offer.

13. Children

The Service is for adults. We do not knowingly collect information from anyone under 18, and a Story cannot be about a child. Children appear only incidentally, in a family’s photographs or memories added by adults who have the right to add them; such memories are kept to the people in that Story. If you believe a child has created an account or is the subject of a Story, write to us and we will remove it.

14. Changes to this policy

We will update this policy when the Service or the law changes. The date at the top shows the current version. If a change is significant, in particular one that affects how your content is used, we will tell you by email or within the Service before it takes effect.

15. Contact

Stumptown Ventures LLC, doing business as Gathered Lives, Portland, Oregon. support@gatheredlives.com. For anything about a Story you are the subject of, or content in which you appear, write “Subject request” in the subject line and we will treat it as a priority.