Privacy policy

What we collect

When you create an account or accept an invitation we collect your email address and the name you provide. When you contribute to a story we collect the photos, videos, audio, written memories, and any captions or metadata you upload. When you start a story — your own or someone close to you — we collect the details you choose to share about its subject (name, dates, places).

How we store it and who processes it

Account data lives in a managed PostgreSQL database operated by Supabase, and uploaded media lives in Amazon S3 — both in the United States. To produce a story we rely on a small set of reputable service providers, each handling only the data needed for its function:

• Amazon Web Services — Stores every photo, video, voice recording and written memory you add, and produces the finished videos.
• Vercel — Runs the website and its servers, and counts page visits. The visit counting is cookie-free and aggregated: it builds no advertising profile, follows no one between sites, and is not linked to your account.
• Google Cloud — Suggests captions and descriptions from what you add, and helps estimate when and where a memory comes from. Google does not use any of it to train or improve anything of its own, and the work stays within the United States.
• Supabase — Holds accounts and sign-ins, and all the information about stories and memories other than the files themselves.
• Stripe — Handles billing details and payments.
• Resend — Sends invitations, sign-in links and notifications — which means names, email addresses and the story they relate to.
• Inngest — Coordinates background work. It sees which records are being worked on, never the photos, videos or recordings themselves.
• Upstash — Holds short-lived sign-in state and the counters that limit repeated requests.
• OpenStreetMap Foundation — Turns location coordinates saved in a photo into a readable place name, and place names into map locations.

The full register — broken out by service, with what each one processes — is published at /legal/subprocessors and updated whenever a provider changes.

How we use it

Your data is used solely to produce the story you are gathering — assembling videos, building story pages, and notifying the people you invite. We do not sell or rent your data, and we do not share it with advertising networks or data brokers. We do measure how the product is used — page views and visits, counted in aggregate and without cookies — through our hosting provider. Those measurements are not linked to your account, do not follow you between sites, and are never used for advertising.

Retention

Stories are retained for the lifetime of the account that created them, unless you ask us to delete them sooner. You can request deletion at any time (see “Your choices” below). Audit logs (sign-in events, invitation redemptions) are kept only as long as needed for security review, then deleted.

Your choices

You can request a copy of your data, correct it, or delete it by emailing support@wetales.com. We acknowledge requests promptly and complete them within the time required by applicable data-protection law — normally within 30 days.

Sign-in providers

If you sign in with Google, Apple, or Facebook, those providers share your email and basic profile (name, avatar) with us. We do not receive your password, your contacts, or your wider account data. You can revoke our access at any time from the provider’s account settings.

Contact

For privacy questions, deletion requests, or any concerns, contact support@wetales.com.