Plain English on purpose. Last updated July 26, 2026.
You came here during one of the hardest seasons of a life. The least we owe you is not treating your grief as a data asset. Here is everything, plainly.
Your email address (that’s how you sign in), what you save inside your rooms (recipes, plans, stories, posts), your support conversations, and the basic facts of your subscription. Payment card numbers go to Stripe and never touch our servers.
We do not sell your data. We do not run ads. We do not let advertisers target grieving people through us — not now, not ever, not for any price. We do not read your private rooms out of curiosity; humans access member data only to fix a problem you asked us to fix, or where the law requires.
Most of what you write stays on your device.Your anchors, lists, check-ins and room entries are saved in your own browser’s storage. We do not hold a copy of those and we cannot read them. That has one real cost you should know about: if you clear this browser or switch devices, they do not follow you. Inside your circle there is a “Keep a copy” button that saves everything to a file you can put back on any device.
Legacy Circle is the exception, on purpose. Your memories, tributes, letters and the dates you hold are also saved to your account on Google Cloud (Cloud Firestore, US region) — because losing them to a dead laptop would be unbearable, and a memory vault that only exists in one browser is not a vault. This means they follow you to a new phone and survive a lost computer. Being straight with you about the trade: they are stored on our servers, they are not end-to-end encrypted, and that means we couldtechnically read them. We do not, and no human opens a member’s Legacy content except to fix something you have asked us to fix or where the law requires it. Access is locked to your own account at the database level — no other member can reach your vault.
And you can take it back at any moment, yourself. In your circle you will find Delete the copy you keep — which removes the server copy and leaves your device untouched — and Erase everything, everywhere, which removes it from both. No request, no waiting on a person, no talking you out of it.
What else we hold, on Google Cloud (US region): your sign-in (Firebase Authentication) and a small member record in Cloud Firestore — your email, your account id, and when you last visited. Payments and billing are held by Stripe; we never see your card. AI features send the relevant text to Google’s Gemini API on Vertex AI to generate the answer you asked for; we do not permit our providers to use member content for advertising.
If you type crisis language into our support box, that message is not sent to the AI and not stored — you are shown human help (988, and our email) immediately. Your hardest moment is not training data.
Ask — in the Concierge or by email — and a person erases your account and everything in it within 30 days, confirmed to you in writing. Some payment records must legally stay with Stripe (tax law); those are theirs to keep, not ours to use.
If this policy ever changes in a way that matters, we tell you by email in plain English before it takes effect — never a silent update.
Questions? The Concierge is an AI and answers instantly; reply to any email from us and a person answers. Anything that matters reaches a human. Terms of Service →