Skip to content
Aeternum

Legal

Privacy Policy

Last updated November 2, 2026

PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND OUR POLICIES AND PRACTICES FOR COLLECTING, PROCESSING, STORING, USING, AND DISCLOSING YOUR DATA. BY ACCESSING OR USING ANY PORTION OF THE PLATFORM, THE INDIVIDUAL ACCESSING OR USING THE PLATFORM (“USER”, “YOU”, “YOUR”) ACKNOWLEDGES THAT THEY HAVE READ THIS POLICY, UNDERSTAND IT, AND PROVIDE EXPRESS CONSENT TO THE POLICIES AND PRACTICES STATED HEREIN EFFECTIVE THE DATE YOU FIRST USED THE PLATFORM.IF YOU DO NOT AGREE WITH OUR POLICIES AND PRACTICES, YOUR ONLY CHOICE IS TO NOT USE THE PLATFORM, LEAVE IMMEDIATELY, AND STOP INTERACTING WITH US. PLEASE KEEP A COPY OF THIS POLICY FOR YOUR RECORDS.

01 INTRODUCTION

Aeternum Corp. (“Company”, “we”, “us”, “our”, “Aeternum”) is a company from Alberta, Canada that offers a private digital space to connect families, share cherished memories, and deliver loving messages, even after our passing. We provide the website and platform found at aeternumproject.com and as found on the Apple App Store and Google Play Store (the “Platform”). This Privacy Policy interacts with and User additionally agrees to our Terms of Service and User Licence Agreement. Please review those documents together with this Privacy Policy.

By accessing or using the Platform or in any other interactions with Aeternum you state that you clearly and irrevocably understand, accept, and consent to the practices described in this Privacy Policy. For greater clarity, User acknowledges and agrees that any of the following actions shall clearly evidence, constitute, and denote User’s express consent and agreement to this Privacy Policy, and any applicable agreement listed above, including when User interacts with any interactive function of the Platform, User enters into a written agreement with Aeternum, User submits any data to Aeternum or the Platform, User submits any user submission to the Platform, User publishes any user content on the Platform, User interacts with any other user on the Platform, or User engages in continued use of the Platform.

This Privacy Policy may change from time to time. Your continued use of the Platform after we make changes denotes your acceptance and consent to those changes. It is your responsibility to check this Privacy Policy periodically for updates.

03 EMAIL FROM US: SERVICE MESSAGES AND MARKETING

We send two kinds of email, and only one of them needs your permission.

Service messages. Every account receives the email the Platform needs in order to work: confirming your email address, resetting your password, security and billing notices, notices about your account, including check-ins when your account has not been used for a while (§16), and notifications about activity that involves you, such as a connection request, a message, or a digital inheritance request or notice. These are not marketing, and they are sent for as long as you have an account. They are delivered through Amazon SES (§10.3). They include warnings when your storage is nearly full or full, a notice to the members of a Family Sharing group when the plan that provides their storage is ending, and the email telling you that your Download My Archive files are ready (§17).

Marketing and newsletters. News about Aeternum, new features and offers are sent only to people who have asked for them. Creating an account does not add you to any mailing list. You are added only if you subscribe on our website, or tick the optional box, which starts unticked, on our contact, Help Center or tester application form. When you do, we record your email address, your name if you gave it, the page you signed up on, the time and your IP address, so that we can show you agreed. People who subscribed on our previous website are on the same list.

Unsubscribing. Every marketing email identifies us and has an unsubscribe link. You can also unsubscribe by writing to info@aeternumproject.com, and we will act on it within 10 business days. Unsubscribing does not stop the service messages described above.

04 AGE RESTRICTIONS

Use of and access to the Platform is not intended for individuals under 18 years of age. No one under 18 may provide any information to the Platform. We do not knowingly collect information from individuals under 18. If you are under 18, do not register for the Platform, submit any information to the Platform, use any of the interactive functions of the Platform, or submit any user submission or user content to the Platform. If you believe the information is submitted to the Platform by someone that is under 18, or that we might have information about individuals under 18 that is not provided with express consent by an authorized parents or guardian of the individual, please contact us. Any User that provides information to the Platform on behalf of an individual under the age of 18 is responsible for such information and such User acknowledges that they provide consent on behalf of such individual under the age of 18.

05 GEOGRAPHIC RESTRICTIONS

The Platform is offered only for access and use in the United States of America and limited areas of Canada. The Platform is not intended for use in any jurisdiction where its use is not permitted, including in Quebec, Europe, or United Kingdom. Such users must leave the Platform immediately. Aeternum does not have sufficient capabilities to determine where a user is located, including to block a user based on its geographic location, prevent a user’s access to the Platform or certain features or functionality of the Platform, manage a user’s interactions with other users of the Platform, or prevent a user from completing a transaction on the Platform. If you access the Platform from outside the permitted regions, you do so at your own risk and you are responsible for compliance with local laws and regulations of your jurisdiction. You must immediately stop using the Platform if your use of it, as it is offered by Aeternum, is prohibited under your local laws or regulations and in no way shall Aeternum be responsible or liable for your unauthorized or unlawful use of the Platform. Data may be transferred across regions and User expressly authorizes such data transfer in accordance with this Policy.

06 INFORMATION WE COLLECT ABOUT YOU

We collect and use several types of information from and about you (“data”), including: personal information, that we can reasonably use to directly or indirectly identify you, including demographic and psychographic information, your name, age, gender, location, mailing address, e-mail address, telephone number, IP address, username, billing and account information, or any other identifier we may use to contact you, or any personal information contained in any user submissions or user content uploaded to or submitted to the Platform by User;non-personal information, that does not directly or indirectly reveal your identity or directly relate to an identifiable individual, such as statistical or aggregated data; technical information, including your login information, browser type and version, device and device settings, time zone setting, browser plug-in types and versions, operating system and platform, advertising identifiers and trackers, and information about your internet connection, hardware, software, and your usage and interactions with the Platform; non-personal details about your Platform interactions, including URLs, clickstream to, through, and from our Platform (including date and time), products or services you viewed or searched for, page response times, download errors, length of visits to certain pages, and page interaction information (such as scrolling, clicks, and mouse-overs); and usage information, including as pertaining to User’s submission of user submissions, posting of user content, User’s interactions with content, features, functionality, products, services, and other users on the Platform, and User’s back-end information and settings as set by User.

07 HOW WE COLLECT DATA

We use different methods to collect your information, including through: direct interactions with you when you provide it to us, for example, by submitting or publishing a user submission or user content, through interactive functions on the Platform, or when corresponding with us by phone, email, social media, mail, or otherwise;automated technologies or interactions, for example, information may be collected automatically as you use the Platform, including through cookies; third party software, including the use of third party plugins, applications, or APIs that enhance the Platform which may collect information on you; and third party tracking technologies, which may include usage details, demographic or psychographic information, IP addresses, advertising data, tracking information, identifiers, and information collected through cookies and other tracking technologies.

08 DATA YOU PROVIDE TO US

The information we collect directly from you on or through the Platform or through other means may include:

  • Information that you provide in a user submission or user content, including by interacting with interactive functions on the Platform.
  • Technical information embedded in the files you upload by the device or software that created them, including the date and time a photograph or video was taken, the make and model of the capturing device, the geographic coordinates of the place of capture, the author and the creation and modification dates recorded in a document, and the artist, album and title recorded in a sound file. Where a file contains coordinates, we resolve them into a civic or postal address and store that address alongside the file. The place of capture recorded in a photograph or video is frequently a private residence.
  • When you choose photos or videos from your phone in our iPhone or Android app, information about the items it shows you, so that we can mark the ones that may already be in your Archive: your phone’s own identifier for each item and, on Android, your phone’s Android ID, its original file name, when it was taken, its picture size and a video’s length, and, for items on your screen, a video’s exact size and a fingerprint the app works out from the item’s contents. This includes items you never upload and, while Hide Uploaded is on, your whole photo library. Our servers compare them with your own uploads and answer with the matches; they neither keep nor log what was sent.
  • With each photo or video you upload from your phone’s photo library in our app, your phone’s identifier for that item and, on Android, your phone’s Android ID; and with every file you upload, a fingerprint of its contents that our servers work out, so that the app can recognize it later. These are deleted with the file.
  • When you copy the files in someone’s memory that has Share a Copy turned on (§12): the original files, with the information stored inside them and the details we read from them. They are saved in your own Archive.
  • Information you give us about other people, such as how the people on a family tree you manage are related to each other, when you answer the questions we ask to place them on it.
  • If you invited someone to collaborate on a memory, or accepted an invitation, while we offered Collaborative Memories, a record that you agreed to how they worked: the version of the wording you were shown, whether you were inviting or accepting, the memory it was for, whether you used our iPhone, Android or web app, and the time. We also kept a record of each invitation and of how it was answered or ended. We no longer offer Collaborative Memories, and we make no new records of either.
  • If you report a memory, a comment or a profile, with Report or by turning on Send a Report Too when you block someone, the reason you picked and anything you wrote, with what you reported, so that our team can review it. Our support inbox is emailed that a report was filed, with its reason, number and time, but no names and none of the words. The person you report never learns who sent it. If we take down a memory or comment you reported, we tell them by email that it was reported, without saying by whom (§11).
  • Information provided to us during the registration process, subscribing to our services or products, or mailing list, or as uploaded to your user profile.
  • When you create an account, a record that you agreed to our Terms of Service, User Licence Agreement, Privacy Policy and Community Guidelines: the version of each that you agreed to, and when.
  • Information and copies of your correspondence and details if you contact us.
  • Details of transactions you carry out through our Platform and of the fulfillment of your orders.
  • Interactions with other users on the Platform.
  • Contract details if you enter into a contract with us.
  • Your search queries on the Platform and through usage of the Platform.

09 DATA WE COLLECT THROUGH AUTOMATIC MEANS

As you navigate through and interact with our Platform, we may use cookies or other automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns.

This may include details of your visits to our Platform, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Platform; usage information about your use of the Platform; and information about your device and internet connection, including your device make and model, IP address, operating system, and browser type.

We may also use these technologies to collect information about your online activities over time and across third-party websites or other online services.

The information we collect through automatic means allows us to improve our Platform and to deliver a better and more personalized service, including by enabling us to estimate our audience size and usage patterns; store information about your preferences; customize our Platform according to your interests; speed up your searches and load times; personalize your user experience; and recognize you when you return to our Platform and allow you to pick up where you left off.

The technologies we use for automatic data collection may include Cookies (small files placed on the hard drive of your device or your internet browser), Flash Cookies (that collect and store information about your preferences and navigation to, from, and on our Platform), and Beacons/Pixels (small electronic files that permit us to monitor usage and gather aggregate statistics). We do not use any of these technologies for advertising, and we do not sell or share the data they produce. Our Cookie Policy lists each cookie and item of browser storage we actually use, and how to choose which ones are allowed.

10 THIRD PARTIES ON THE PLATFORM

Certain services on the Platform including content, functions, features, links, plugins, or APIs may be operated or provided by third parties. They may collect and use your data when you use the Platform. The Platform may also include outbound links to third-party sites and pages off the Platform. These third parties have their own privacy and data policies and practices, and we do not accept any responsibility or liability for such policies and practices.

This list covers the whole Platform, not only the forms on our website. It includes the systems that host and store your content, take your payments, deliver your email and notifications, monitor for faults, measure product usage, handle your support requests, and power our AI features Memoria and Aela.

Two things to understand about how this list is maintained:

  1. A provider remains listed for as long as it may still hold your data, not only for as long as we actively send it more. When we stop using a service, the data already transferred to it remains in that provider’s hands until it is deleted under their own retention terms. Removing the name on the day we stop using it would misrepresent where your data actually is, so retired providers are listed in §10.9 rather than deleted from this policy.
  2. This list describes categories as well as named vendors. Where a type of provider is structurally part of how the Platform works, we tell you what it receives and name who we currently use, so that a routine change of vendor within a category does not leave you relying on a document that has silently gone stale. Where we name alternatives, treat them as disclosed even if a given feature is not yet enabled for you.

We do not sell your data. We do not use any provider below for advertising, ad targeting, or profiling. None of the providers we currently use is permitted to use your content for their own purposes.

10.1 Hosting, storage and infrastructure

Amazon Web Services (AWS) operates all of our infrastructure and is therefore able, in principle, to access everything you store with us. This covers compute, our databases, object storage for your photos, videos, audio and documents, our content delivery network, message queues, logging and DNS. Your data is held in AWS regions in Canada and the United States — see §13.

The one exception is notifications about Google Play purchases. Google delivers these to us through Google Cloud Pub/Sub in our own Google Cloud project. Each carries our app’s package name, the time, the purchase’s token and what changed: for a subscription, the plan and the kind of change; for a refund, the order number and the kind of refund. They carry nothing else about you (§10.2).

10.2 Payments

Who takes your payment depends on where you subscribe.

In our web app: Stripe. When you add a card, save your billing details or start a subscription in our web app at app.aeternumproject.com, Stripe receives your email address and the name and billing address you give (your country and postal code, and your province or state). On Get Premium, your address is also sent through our servers to Stripe as you type it, before you save anything, so that we can show you the price with tax. The card details you enter go straight to Stripe. Stripe uses your billing address to work out sales tax. While you use the card form, Stripe’s own software in your browser also sends Stripe information about your device and connection, including your IP address, so that it can prevent fraud, and sets the cookies listed in our Cookie Policy. Versions of our iPhone and Android apps from before our plans were sold through the App Store and Google Play take payment through Stripe in the same way, and Stripe’s software in those versions sends Stripe the same kind of information about your device and connection.

When you sign in, if your account is not yet linked to Stripe, our servers ask Stripe whether it holds a customer with your confirmed email address. That way a plan bought before you had an account, such as a founding membership, is linked to you. This check creates nothing at Stripe. If you bought a plan before creating an account, we may use the name and email address Stripe holds to send you notices about that plan.

We never receive or store your full card number. We keep with your account your Stripe customer and subscription identifiers, which plan and price you are on, its status, and when any trial or the plan itself ends. We also keep the brand and last four digits of your default card, which we update whenever it changes, so that we know a card is on file. Your billing name and address, your saved cards and your invoices stay with Stripe. When you open Settings › Subscription & Billing, our servers fetch them from Stripe to show you, including each saved card’s expiry date, and do not keep a copy.

If you delete your account, any plan Stripe still bills stops renewing when you ask, and is cancelled when the deletion is carried out, with no refund. We erase your card’s brand and last four digits. We keep your Stripe customer identifier and our record of your plans, and your customer record stays in our Stripe account, with your name, email address, billing address, saved cards and invoices, as part of our billing records (§16).

In our iPhone and Android apps: Apple or Google. Plans bought in our mobile apps are sold through the Apple App Store or Google Play. They take the payment through your Apple or Google account, under their own terms and privacy policies. We do not receive your name, email address, billing address or payment details from them. When you buy, the app gives Apple or Google the identifier our servers gave your account, a code that contains neither your name nor your email address, so that the purchase can be matched to your account. Our servers then ask Apple or Google for the subscription’s current state after a purchase, a plan change or a restore, when Apple or Google notify us that it has changed, and once a day while it is running and for a time after it ends. For Google Play, our servers also confirm each new purchase to Google, as Google requires, except while you also have a plan Stripe bills that is set to renew: then we leave the purchase unconfirmed, so that you do not pay twice for one plan, and Google refunds and ends a purchase that is not confirmed within 3 days. That refund is Google’s, not ours. We keep with your account which store sold the plan, the plan itself, and the store’s identifier for the subscription (Apple’s original transaction ID or Google’s purchase token). We also keep its status, whether it renews, when it ends, whether it was a test purchase, and the latest record the store sent us. That record can include the country of your store account, the price and currency, the purchase, renewal and refund dates, the store’s order number, and why a plan lapsed. If you cancel through Google Play and answer Google’s cancellation survey, it can also include your answer. You change or cancel these plans in your App Store or Google Play subscription settings.

If you delete your Aeternum account, a plan bought through Google Play stops renewing when you ask, and when your account is deleted we stop it for good, so that it can never renew again. It stays valid until the end of the period you paid for, with no refund from us; a refund you ask Google for is Google’s decision. If you recover your account before then, only you can turn its renewal back on, in Google Play. Deleting your account does not cancel a plan bought through the App Store. Cancel it in your Apple subscription settings, or Apple will go on charging you. We keep our record of these subscriptions, including the store’s reference for each and the last details Apple or Google sent us about it, as part of our billing records (§16).

10.3 Email and messaging

  • Amazon SES sends our service email (§03) — account, security, billing and notification messages — the emails our website forms produce (§10.12), and alerts to our own team, such as a new report (§08). AWS processes your email address, the message, and whether it was delivered or bounced.
  • Brevo holds our marketing and newsletter list and sends those messages. You are on it only if you asked to be (§03), and every message carries an unsubscribe link. Brevo receives your email address, your name if you gave it, and the record of your agreement: the page you signed up on, the time and your IP address. Brevo can also record whether each message it sends is opened and which of its links are clicked.
  • Google Workspace hosts our own company email. If you write to us, and when our website forms, the app’s support reports or your cancellation feedback (§10.8) send a copy to our inboxes, the message and your address are processed by Google. If preparing your Download My Archive files fails, our support inbox is sent your email address, and your account’s deletion date if it has one, so that we can help (§17).

10.4 Notifications and push delivery

The Platform shows you notifications inside the app. If notifications for Aeternum are turned on in your device’s settings, we can also send some of them to your phone or tablet through our mobile apps as push notifications. On iPhone, iPad and Android 13 or later, your device asks you first; on Android 12 and earlier, they are on unless you turn them off. We keep what a push notification carries deliberately small:

  • Its title and text are fixed wording that we wrote, such as “New message from Sam”. The only personal detail they can contain is the first name of the person whose action caused the notification. The words of a message, comment or memory are never included.
  • Routing data, so that tapping the notification opens the right screen: the kind of notification, and our internal reference codes for it and for the people, memory, conversation, profile or request it concerns.
  • The number of unread notifications you have, which your device may show on the app icon.
  • The push token of the device it is addressed to, described below.

A new memory, a new comment or reply, a new connection made by someone else in your network, and a memory added to a chain you can see are shown only inside the app and are not sent as push notifications. Storage warnings and Download My Archive notices come in the app and by email, never as push notifications. A push notification is still sent when someone tags you, or a profile you look after, in a memory; mentions you in a comment; opens a memory you shared with a link (§12); or takes a copy of the files in your memory with Share a Copy (§12). One is also sent when a copy you are taking is ready or could not be finished, in words that name nobody.

To reach your device, every push notification passes through:

  • Expo’s push service, operated by 650 Industries, Inc. in the United States, which receives each notification from our servers, tells us whether it was passed on successfully, and relays it onward to:
    • Apple Push Notification service for iOS devices; or
    • Google Firebase Cloud Messaging for Android devices.

Push tokens. When notifications are on and you are signed in, your device obtains a device token from Apple or Google, and our app exchanges it with Expo for an Expo push token, which is the address we send your notifications to. That exchange gives Expo the device token, an identifier for this installation of the app, the app’s identifier and your IP address. On Android, the Google Firebase software built into our app, which issues the device token, also creates a Firebase installation identifier and registers the app with Google as soon as the app is opened, whether or not notifications are on.

We store the Expo push token with your account, together with whether the device runs iOS or Android, which of our apps it belongs to, the sign-in it was registered under, when it was registered, and when we last sent to it. We keep at most ten devices for each account. A device’s record is deleted when you sign out on that device; when you change your password while signed in, for every device other than the one you used to change it; when you ask to delete your account (§16), for every device; when Apple or Google, through Expo, tell us the token no longer works, for example because the app was uninstalled; and, once you have more than ten devices, for the one you used least recently. If someone else signs in to Aeternum on the same device, its record moves to their account. Expo, Apple and Google keep their own records of tokens and deliveries under their own retention terms.

Turning it off. You can stop push notifications at any time by turning off notifications for Aeternum in your device’s settings, or by signing out of the app on that device. In the app, Settings › Push Notifications also lets you choose which kinds of notification are sent to your devices. A few important notices, about a declaration of death or an offer or request to take over a profile, cannot be switched off individually there; only your device’s settings or signing out stops those. None of this affects the notifications shown inside the app.

Web browsers. We do not currently send push notifications to web browsers. If we introduce them, they will pass through the push service of your browser vendor, which may be operated by Google, Mozilla, Microsoft or Apple depending on which browser you use.

10.5 Mobile applications

  • Apple App Store and Google Play distribute our mobile apps and sell the plans offered in them. They handle their own account, download and purchase data under their own policies. What we exchange with them about your in-app subscriptions is described in §10.2.
  • Expo, operated by 650 Industries, Inc. in the United States, provides our mobile build and over-the-air update infrastructure, and relays our push notifications (§10.4). When your app checks for an update it transmits technical information such as the app version, the platform, and a device or installation identifier.

10.6 Memoria and Aela — our AI features

This part of the Platform works differently from the rest, so we would rather be precise than reassuring.

What stays with us. The search index that lets Memoria find the right memories and files is built by a model running on our own infrastructure. Your memories and files are not sent anywhere in order to be indexed or searched. When you mention someone by name or nickname, our own servers work out who you mean; your list of connections is not sent to an AI provider to do it.

Your permission first. Before anything is sent to our AI provider, our apps ask for your permission, under Before Aela and Memoria Help. If you choose Not Now, nothing is sent and nothing is recorded. If you choose Allow, we record on your account when you first allowed it, and the app also keeps your answer on your device (see our Cookie Policy). You can withdraw it at any time under Settings › Privacy & Sharing › Aela & Memoria, and the app will ask again before sending anything more. Older versions of our apps that have not been updated do not ask, and using Aela or Memoria in them sends what is described below.

What leaves us. Once you have allowed it, the following is sent to a third-party AI provider over an encrypted connection:

  • Questions and drafts. When you ask Memoria or Aela something, use Search with Memoria when choosing files from an Archive or memories to chain, or ask Aela to draft a memory or rewrite one you are editing, we send your question or search, what you told Aela or the text being rewritten, and the recent conversation. We also send your own date, time and time zone, so that words like “last week” can be worked out. When Memoria answers you, it also sends excerpts of the memories and profile details relevant to it, with whose they are, their date and place, and the names of the people tagged in them. If what you asked uses one of your own Custom Tags (§12), it also sends the full name of the person the tag stands for, for example that by “Mom” you mean “Maria Lopez”, so that the answer is about the right person. When you ask about your files, it also sends the details of the matching files in your Archive or in an Archive you look after: each file’s name and type, the day it was taken or dated, the town, region and country it was taken in, the day it was uploaded, a video’s length or a document’s number of pages, whose Archive it is in and who added it. Profile details are the parts of a profile its owner has shared with you, such as a birthday, places, work, beliefs or life events. Those excerpts are real content — the words you or your connections wrote. We never send what is inside your files, their GPS coordinates or their street addresses. When Aela drafts a memory from photos or videos you attached, Aela is told only whether they have a date and a place, not what those are.
  • Relationship descriptions. When you describe in your own words how you are related to someone — for example when you invite them, or answer an invitation or connection request — what you type is sent as you wrote it, so that the AI can work out the relationship. It can name other people (“Sam Lee’s dad”); nothing else about you or your connections is sent with it. Simple descriptions such as “my cousin” or “my sister’s daughter” are worked out on our own servers and are not sent. If you have not allowed Aela and Memoria, only our own servers try, and if they cannot tell, the app asks for your permission before anything is sent.
  • Support reports. When you file a support report through Aela, the report is sent so that the AI can suggest a subject line for it, even if you wrote it yourself. If you ask Aela to help write it, what you told Aela is sent too, so that it can draft the report.

Who receives it. Anthropic is our only AI provider. Until October 8, 2026, we also used Google’s Gemini when Anthropic could not answer; §10.9 explains what that means for anything sent to it before then. We may add or change AI providers as the technology changes.

The terms that apply. Anthropic provides its service to us under commercial terms that do not permit it to train its models on what we send, and that limit how long it keeps it.

If you would rather not. Memoria and Aela are optional, and in current versions of our apps nothing is sent to an AI provider until you allow it. Without your permission Aela does not open, so Help & Support in Settings, which opens Aela, needs it too; a report filed there is sent to our AI provider so that it can suggest a subject line (§10.8). To reach us without AI, write to support@aeternumproject.com or use the Help Center form on our website. Memories and profile details you share with other people can still appear as excerpts when they use Memoria or Aela, just as those people can already read them, and if they use a custom tag for you, your full name can be sent with their question. Describing a relationship is part of inviting or connecting with someone; a simple description, such as “my cousin”, keeps it on our own servers.

10.7 Analytics and search reporting

We use Google Analytics 4 to understand how the Platform is used and to improve it, never for advertising. It reaches Google in two ways.

  • In your browser, in the web app only. On app.aeternumproject.com, Google Analytics runs only after you allow Analytics cookies; until you choose, or if you say no, it does not load at all. You can change your answer at any time under Settings › About & Support › Cookie settings, or with the Cookie settings link on the signed-out welcome screen, and our Cookie Policy lists the cookies it sets. Once allowed, Google receives the address and title of each screen you open, with anything after a ”?” removed and the private codes in invitation, inheritance, check-in and death-report links taken out; the activity Google records automatically, such as scrolling; your account’s ID, a random code rather than your name or email, while you are signed in; and what any browser sends, such as your IP address, browser, device, language and screen size. Advertising features and Google signals are switched off. The iOS and Android apps contain no analytics or advertising software.
  • From our own servers. Our servers also report to Google each request the web and mobile apps make to them — what kind of request it was, its address and whether it succeeded — together with your account’s ID while you are signed in, and events such as signing up, signing in and out, posting, commenting and updating a profile. These reports set no cookie and do not include your IP address. Your cookie choice does not control them.

Google Search Console and Bing Webmaster Tools report on how our public pages appear in search results. They receive aggregate search data only, and have no access to your account or your content.

10.8 Support and feedback

Help & Support in Settings opens Aela, and support requests you send from inside the app are filed through it. Each report is stored in our own systems on AWS (§10.1) as you wrote it, together with an identifier for your account and the device or browser you were using. It is emailed to our support inbox (Google Workspace, §10.3), where a copy stays with your name, email address and account identifier; sent to our AI provider so that it can suggest a subject line (§10.6); and confirmed to you by email through Amazon SES. If Aela helps you write the report, what you told Aela is sent to the AI provider too.

Earlier versions of the app opened a form instead, and an app that has not been updated may still show it. A request sent with that form is stored on AWS with an identifier for your account, the device or browser you were using, the app’s recent technical log messages, on the web the address of the page, and any file or screenshot you attach. Until January 2026, those requests were also copied, with your name, email address and account identifier, the page and device or browser details, any file or screenshot you attached and those log messages, into Jira, the issue tracker from Atlassian that our team uses to track fixes, where they remain. Nothing has been copied into Jira since.

Why you cancelled. If you choose to tell us why you cancelled a plan, we store the reason you picked and anything you typed. We store them with the plan you were on, when your access ends, an identifier for your account, and the kind of app you sent them from (at present, always our web app). A copy, with your name, email address and account identifier, is emailed through Amazon SES to a member of our team and kept in our company email (Google Workspace, §10.3). If your account is later deleted, we remove your account identifier, the words you typed and when your access ended from our record, and keep only the day it was sent, not the time. The reason, the plan and the kind of app stay. The copy already emailed to our team is not deleted.

10.9 Providers we have retired, which may still hold data

Our previous website was built on WordPress and carried a number of analytics, advertising and form-handling services. That website has been replaced. The site you are reading now carries no advertising or social pixels, no tracking cookies, and no analytics of any kind. It does load one third-party script on every page — the spam check on our forms — which is described in §10.12.

Data those services collected before the change, however, remains with them under their own retention terms, and is not within our power to erase retrospectively. We therefore continue to disclose them rather than quietly drop them from this list: WordPress, Google Tag Manager, Google Site Kit, Google Ads, Meta (Facebook) Pixel, LinkedIn Pixel, JotForm, Contact Form 7, WPForms, and Vercel.

Until October 8, 2026, Memoria and Aela also used Google Gemini (§10.6) when Anthropic could not answer. We used it through Google’s unpaid Gemini API service, and we no longer send it anything. Google may still hold what was sent to it before then, under that service’s terms, which allowed Google to use it, and the replies, to improve its products and AI models, and allowed people at Google to read them.

Until October 22, 2026, our servers also sent the IP address of anyone viewing our plans to ipapi.co (Kloudend, Inc., United States), to find which country they were in. We no longer send it anything, but it may still hold what it received, under its own terms.

If you want to know whether any of these providers holds data relating to you, or you want it erased, write to us at info@aeternumproject.com and we will tell you what we know and help you make the request. Each of those providers also has its own privacy policy and its own process for access and deletion.

10.10 Signing in

You sign in with your email address and password. We do not offer sign-in through Google, Apple or any other third-party account, so no sign-in provider receives your details or learns that you use Aeternum.

Checking for leaked passwords. When you choose a password, whether you are signing up, accepting an invitation, resetting it or changing it, our servers check whether it has appeared in a known data breach, using the Pwned Passwords service of Have I Been Pwned. They send it only the first five characters of a scrambled form of your password (its SHA-1 hash); it answers with the scrambled forms of leaked passwords that begin the same way, and our servers look for yours among them. Your password, your email address and your IP address are never sent to it. If your password has been leaked, we warn you, and the choice is yours.

The Platform may link to third-party websites and pages that we do not operate. Those sites have their own privacy practices, and we accept no responsibility or liability for them.

10.12 Our public website

Our marketing website at aeternumproject.com serves its own fonts and images, sets no cookies, keeps nothing optional in your browser and runs no analytics. The only record of visits is the access logs that our content delivery network, Amazon CloudFront (§10.1), keeps for every request: the address asked for, including anything after a ”?”; the time; your IP address; your browser’s user-agent string; the page that linked to ours, if your browser sends it; and technical details of the request and connection, such as the protocol and encryption used and how long the response took. The logs do not record cookies, put nothing in your browser, stay in our own AWS account and are deleted after 30 days. Beyond that, the site makes two kinds of third-party request, and we would rather name them than describe the site in general terms that are not quite true.

Cloudflare Turnstile, on every page. Our forms were receiving automated spam, so every form on the site — the contact form, the Help Center form, the newsletter signup and the tester application — is now behind a check that confirms the sender is a person rather than a script. Because the newsletter signup sits in the footer, that check loads on every page, whether or not you go near a form.

To perform it, Cloudflare receives your IP address, your browser’s user-agent string, and signals about how the page behaved in your browser. It is a privacy-preserving alternative to a conventional captcha: it does not ask you to identify photographs, it is not used to build an advertising profile, and Cloudflare states that it does not use the data for cross-site tracking. We receive none of it — only a yes or no.

Turnstile sets no cookies. It keeps one security entry in your browser’s storage, inside Cloudflare’s own frame (challenges.cloudflare.com). That entry is the only thing stored in your browser when a page of this website loads, and it is strictly necessary to protect our forms from spam.

YouTube, on our tester application page only, and only if you press play. That page offers a video introducing Aeternum. Until you press play it shows a still image stored on our own site, and nothing is requested from YouTube or any other Google service. When you press play, the video loads from YouTube’s youtube-nocookie.com player. From then on YouTube receives your IP address and viewing information, such as your browser details and what you play, and may store data in your browser, under Google’s own terms and privacy policy. If your browser does not run JavaScript, the page offers a link instead, which opens the video on youtube.com in a new tab under YouTube’s own terms.

Why this website has no cookie banner. Turnstile is necessary to protect our forms, and nothing optional runs until you choose it by pressing play, so there is nothing to ask before then. Our web app at app.aeternumproject.com is different: it asks first, as described in §10.7 and our Cookie Policy.

What our forms do with what you type. Submitting the contact or Help Center form sends your name, email address and message, with your IP address and the page you sent it from, to Amazon SES so it can reach our inbox. Applying to be a tester sends your name, email address, device type and referral answer, with your IP address, to Amazon SES so we can email you a confirmation and notify our support team. Subscribing to the newsletter, or ticking the optional box on any of those forms, adds you to Brevo (§03, §10.3), and a copy of the signup, with the same details, is emailed to our inbox through Amazon SES. The box starts unticked, and nothing is added unless you tick it.

10.13 Places, pricing and content delivery

Geoapify (Geoapify GmbH, Germany) finds places for the Platform’s location fields and turns the location in a photo or video into an address. When you type into a location field, what you type and your device’s IP address go to Geoapify. When a photo or video you upload carries location data — the GPS coordinates many cameras and phones save, which are often where you live — our servers send those coordinates, rounded to about 11 metres, to Geoapify to look up the address, and we store that address with the file (§08). If we re-read a file uploaded before we began storing addresses, its coordinates are sent the same way. If a file’s address was not stored, the app looks it up from your device when you open that file in your Archive or in an Archive you look after, which sends Geoapify the file’s coordinates and your device’s IP address. When a memory’s place is filled in from your photos or videos, with Fill From Photos or by Aela, or Aela suggests a place from what you told Aela, the app sends the name of that place to Geoapify’s place search from your device, with your device’s IP address.

DB-IP. To show subscription prices in US or Canadian dollars, our servers work out which country you are in. If you already have a plan or a billing address with us, they use that. Otherwise they look up your IP address in a list of the address ranges used in each country, which we download from DB-IP’s free data and keep on our own servers, so your IP address is not sent to anyone.

jsDelivr, a public content delivery network, serves the emoji images on some of the app’s welcome screens. Your device requests those images directly, so jsDelivr receives your IP address and your browser’s or app’s user-agent, but no account information.

Hugging Face (Hugging Face, Inc., United States) hosts the open AI model that Memoria uses to search your memories. Our servers download the model from Hugging Face and then run it on our own servers; none of your data is sent to Hugging Face.

11 HOW WE USE YOUR DATA

We use information that we collect on users or that is provided to us in order to:

  • Offer our Platform and its content and functionality to our users; provide users information and fulfill their requests; send marketing communications to people who have asked for them (§03); and provide users with notices about their account.
  • Carry out our obligations and enforce our rights arising from any contracts with a user, including for billing and collection purposes or to comply with legal requirements.
  • Verify the accuracy or appropriateness of any user submission or user content; monitor our Platform and enforce our standards; notify users about changes to our Platform or any products or services we provide.
  • Review what is reported to us and, where it breaks our Community Guidelines, take it down. A memory or comment we take down is hidden from everyone, Memoria stops using it and any link to it stops working, but nothing is deleted until its owner deletes it or their account is deleted. We tell its owner by email, without saying who reported it.
  • Allow users to register for the Platform; participate in interactive functions; publish user content or submit user submissions; manage our relationship with users; and, where they have asked us to (§03), contact users about Aeternum goods and services that may be of interest to them.
  • Collect and measure data used to make the Platform and Aeternum and our products and services more effective; create recommendations, legacy summaries, and emotional analyses; or in any other way we may describe when a user provides the information or for any other purpose with their consent.

12 DISCLOSURE OF YOUR DATA

We may disclose your information that we collect or you provide:

  • Directly on the Platform when you submit a user submission or user content or interact with an interactive function of the Platform; to other users of the Platform for the purposes of facilitating the Platform’s digital inheritance functionality; or to third parties authorized to receive such information by User.
  • Together with user content you share, the details we read from your files (§08), as follows. Each user, circle, or other recipient you share content with sees your photos and videos only in versions from which we have removed the embedded information, and is not shown the place, dates, device or address we read from them, unless you let them take a copy with Share a Copy (below). Sound recordings and documents are shared as the original file, with whatever information is embedded in it, such as an author’s name. A Digital Inheritor, on a Digital Inheritance, receives your user content as its new owner (User Licence Agreement 04(D)), including the original files, the information embedded in them and the details we read from them. The originals of your photos and videos, and the details we read from your files, including any address worked out from a file’s coordinates, are otherwise available only to you, to anyone who looks after the profile whose Archive holds them, to a Digital Inheritor as just described, and to the people you let take a copy of them with Share a Copy. When a memory’s date or place is filled in from your photos or videos — when you press Fill From Photos, or when Aela fills them in a draft from files you attached — that date and place become part of the memory, and everyone who can see the memory sees them. Sharing user content is a deliberate act and discloses what is described here to every such recipient.
  • Share a Copy. By tagging someone in a memory that has Share a Copy turned on, you authorize each person you tagged to take a copy of the original photos, videos and other files you added to that memory, including when and where they were taken, which is often someone’s home, and to keep them for their own use.
    • When it is on. In current versions of our apps, Share a Copy is on for each new memory you post as yourself unless you turn it off. Memories posted before Share a Copy began on October 31, 2026 start with it off, and you can turn it on when you edit one. It is never on for a memory you post as a profile you manage.
    • What they receive. The original files, with the information stored inside them, such as when and where a photograph was taken and the device that took it, and the details we read from them, including any address worked out from their coordinates (§08). The files are saved in their own Archive, and they can also put them in a new memory of their own. If they do, they can fill in its date and place from your photos and videos, with Fill From Photos or Aela, as you can, and everyone who can see their memory sees that date and place.
    • What is not copied. Nothing else of your memory: not its title, its words, its date, its place or who is tagged in it. Never a file someone else added to it, or a file you copied from someone else.
    • Who can take a copy. Only someone you tagged as themselves, and only while they can still see the memory. Tagging a profile someone manages, a pet or a memorial lets nobody take one. Someone you kept out with Except… can never take a copy, even if tagging them lets them see the memory.
    • What we tell you. We tell you, in the app and by push notification, the first time each person copies files from a memory of yours.
    • Copies stay with them. A copy is kept by the person who took it. It counts towards their storage, and they can share it with their own circles, who see photos and videos in versions without the information stored inside them. The copy stays with them if you later untag them, block them, turn Share a Copy off, delete the memory or delete your account.
    • Who it stays hidden from. Wherever they share it, the files you added stay hidden from people in a block with you, from people you had kept out of that memory with Except… when the copy was taken, and, while your account is open, from people you have kept out of any of your circles. Turning Share a Copy off is described in §14.
  • Share Memory links. On a memory you posted, Share Memory › Share a Link makes a link that works for 7 days. Anyone who has the link, including anyone it is passed on to, who signs in to Aeternum with a confirmed email address can open the memory with it while it works, even if they are not connected to you or in any of your circles. They see the memory’s title, date and words, its city and country (never a street address or an exact location), the people tagged in it, the comments and reactions on it, and your name and profile picture, and they receive its files as the people in your circles do (above). They can react, comment and report it. It does not appear anywhere else for them: not on Home, on your profile, in search or in Memoria. When someone opens one of your links for the first time, we tell you their name, in the app and by push notification. Anyone who has the link, signed in or not, can see your name and profile picture on the page it opens, even after the link has ended. A link never opens the memory for anyone you kept out of it with Except… or anyone in a block with you, and no link opens it if your account is banned or deleted; they are told only that the link is not available.
  • Collections. If you choose circles under Who Can See This Collection, the people in them, except anyone in a block with you, can open that collection and see its name, description and cover. A cover you chose is shown to them even if it is a photo from a memory they can’t see; if you chose none, the cover is a picture from a memory in the collection that they can open. Inside, each person sees only the memories they could already see.
  • Custom Tags. A custom tag is a private name you give someone you are connected to, or a profile you manage, such as “Mom”. When you use it to tag that person in a memory or comment, the tag’s word appears there, linked to them, for everyone who can see that memory or comment.
  • Claiming a profile. When someone who made a profile for you approves your claim to it, they stay on to help look after it while the two of you are connected, so they can still see its Archive, including the original files and the details we read from them. We tell you this when the claim is approved, and you can change who helps from the profile’s settings.
  • Your family tree. Unless you choose Only Me under Who can see the family tree? in Tree Settings, people you are connected to and have described as family can see your family tree, as long as neither of you has blocked the other and they can see your profile. Friends, godparents, godchildren, godsiblings, former spouses and lovers are not counted as family here. They see your parents, siblings, partner, children and pets, as far as they can see those people’s profiles, with how each is related, and only links that both people agreed to. They never see Your Tree Answers, the answers you gave us about where people belong on your tree, which only you see and can change or clear in Tree Settings. For a profile you manage, only its owner makes this choice.
  • On family trees. The connections you and your relatives make with each other, and how you describe them, are used to draw your relatives’ family trees, including the trees of blood relatives and in-laws you are not connected to. Unless you turn off Show Me on Relatives’ Trees in Tree Settings, such a relative (or, on the tree of a relative’s managed profile, that profile’s owner) can see you on that tree, marked “Not Yet Connected”, with your name, your profile picture and how you are related, and can open your profile or ask to connect with you. Your birthday and marital status shape that tree only where your settings let them see those details. You never appear this way to someone you have blocked or who has blocked you. For a managed profile, its owner makes this choice.
  • Suggestions. People connected to someone you are connected to may see you in their Suggestions, with your name and profile picture, the person you both know, and how you are related to that person. Your gender is shown only if your settings let them see it. For a profile someone manages, they also see the manager’s name, and for a pet, its owners’ first names. You are never suggested to someone you have blocked or who has blocked you, or to someone you are already connected with or have a request with. Separately, when someone who manages a family tree tells us how two people connected to that tree’s profile are related, for example that they are married or are siblings, each of those two people may see the other in their own Suggestions, labelled with that relationship (for example “May Be Your Spouse”). We never say who gave the answer, we send no notification or email about it, and it connects nobody. These suggestions are made only between living people with active accounts who have no connection or request between them, have never disconnected from each other, are not blocking each other, and could already see each other. We keep a record of whose answer led to each suggestion, which is never shown to anyone, so that we can limit how many suggestions one person’s answers create. If you close one of these suggestions, we keep that choice so that person is not suggested to you again, until you clear it under People We No Longer Suggest in Tree Settings; nobody is told either way.
  • Friend Groups. You can sort the people you call Friend into groups of your own, such as “Colleague” or “Best Friend”. A friend is never told which group you put them in. If you choose a group for a circle, its members see what you share with that circle. The Friends tab on your family tree, which lists your friends and your groups, is seen only by you unless you choose circles under Who can see your Friend Groups? in Tree Settings, and people in those circles see it only if they can already see your family tree, which friends never can.
  • Family Sharing. If you take part in Family Sharing, where one member’s paid plan provides storage for others, we share details with every member of that group. They see each member’s name, the relationship label the plan’s owner gave them, whether the owner marked them as a guardian, how much storage they use and when they joined. They also see the name, email address and label of everyone the owner has invited who has not yet answered. If someone invited already has an account under that email address, they see the owner’s name, the label and any message the owner wrote with the invitation. If the owner cancels their plan, every member is told that the family plan is ending, and while the owner has no paid plan, the group shows as paused.
  • To each Digital Inheritor and Legacy Steward you have named who has accepted that role, the fact that you have not used the Platform for nine (9) months, as described in §16. That notice includes your name and that fact, and nothing else about your account or your content. You are told about this when you name them, and again on the day any such notice is sent.
  • To our subsidiaries, assigns, and affiliates; to contractors, service providers, and other third parties we use to support our business or deliver our products and services.
  • To comply with any court order, law, or legal process, including to respond to any government or regulatory request, in accordance with applicable law; to enforce our Terms of Service and User Licence Agreement including for compliance and billing and collection purposes; or if we believe disclosure is necessary to protect the rights, property, or safety of Aeternum, our customers, other users, or the public.

13 STORAGE OF YOUR DATA

We currently use Amazon Web Services to host our servers and data, which stores your information in the USA and Canada. One part of our own systems runs outside Amazon Web Services: the notices Google sends us about purchases made through Google Play (its Real-time Developer Notifications) reach us through Google Cloud Pub/Sub, wherever Google runs that service (§10.1). The service providers described in §10 keep what they receive where they operate, under their own terms, and some of them are outside Canada and the USA, such as Geoapify in Germany (§10.13). In instances where your data is held outside of Canada, different privacy laws may apply that may not be as comprehensive as Canadian standards. In these circumstances, the governments, courts, law enforcement, regulatory agencies, and other third parties in that country may be able to obtain access to your data through the laws of the foreign country.

14 CHOICES ABOUT YOUR DATA

You can control the collection and use of your data including with:

  • Browser and device choices, including by setting your browser to refuse cookies, and in our web app with Cookie settings, as described in our Cookie Policy.
  • Opting out of marketing communications, by using the unsubscribe link in any marketing email or by writing to us, as described in §03.
  • Choices about information embedded in your files, including by removing it from a file before you upload it if you do not want it stored with us; by removing it from a sound recording or document, or not sharing that file, if you do not want others to receive it; by turning Share a Copy off for a memory if you do not want the people tagged in it to receive the originals of its photos and videos (§12); and by changing or clearing a date or place filled in from your photos or videos before you save a memory.
  • Who can see your family tree, with Who can see the family tree? in Tree Settings: My Family, the default, or Only Me (§12).
  • Your Tree Answers, which you can change or clear in Tree Settings (§12).
  • Your place on relatives’ family trees, with Show Me on Relatives’ Trees in Tree Settings (§12).
  • Who sees a memory you share, by keeping particular people out of it with Except… under Who Can See, even when they are in a circle you share it with. If you tag someone you kept out, they can see the memory while they are tagged, and are kept out again if you untag them. Nobody is told.
  • Share a Copy, by turning it on or off for a memory when you post or edit it, or by untagging someone. Turning it off or untagging someone stops new copies; copies already taken stay with the people who took them (§12).
  • Share Memory links, by ending one early with Expire, or all of them with Expire All under Settings › Privacy & Sharing › Shared Links. An ended link stops working for everyone, including people who already opened it (§12).
  • Friend Groups, with Who can see your Friend Groups? in Tree Settings, which starts at Only Me (§12).
  • Suggestions, by closing one that says someone may be family, which you can undo under People We No Longer Suggest in Tree Settings; and, for a profile you manage, by choosing who can see it under its Privacy & Visibility, since a profile is suggested only to people who can see it (§12).
  • By opting out of any feature, you may be unable to access or use some or all of the Platform.
  • To withdraw your consent to the practices stated in this Privacy Policy, please provide us notice in accordance with the notice provision at the end of this Privacy Policy.

15 DATA SECURITY

We use physical, electronic, and administrative measures to help secure your data from accidental loss and from unauthorized access, use, alteration, and disclosure. The safety and security of your data also depends on you. You are responsible for your profile on the Platform and for keeping your login and password confidential. The transmission of data via the internet is not completely secure and we cannot guarantee the security of your data on the Platform. Any transmission of data is at your own risk.

16 DATA RETENTION

Except as otherwise permitted or required by applicable law or regulation, we will only retain your data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Under some circumstances we may anonymize your data so that it can no longer be associated with you. We reserve the right to use and retain such anonymous data indefinitely for any legitimate business purpose without further notice to you.

Deleted files and backups. When you delete a file, or we replace a copy we made of it (such as a video’s still), an earlier version can stay in our file storage so that a mistake can be undone, and we erase it from there automatically after 30 days. Separately, to protect everyone’s memories from loss, we keep backups of our database and snapshots of our servers’ disks. They are held by Amazon Web Services in Canada (§10.1, §13), and they can contain copies of your account, your memories and the details of your files, including after you delete them or your account.

Deleting your account. You can delete your account yourself at any time, in our iPhone or Android app or in our web app at app.aeternumproject.com, under Settings › Account › Delete Account. When you ask:

  • we sign you out on every device and stop push notifications to them (§10.4);
  • we hide your profile and memories from everyone;
  • we stop any plan Stripe bills, or that you bought through Google Play, from renewing; a plan bought through the App Store is not cancelled, and you cancel it in your Apple subscription settings (§10.2);
  • we tell anyone who helps you look after a profile you manage that it will be deleted, and when;
  • we email you the date your account will be deleted, 30 days later.

We remind you three days before. Until that date you can sign in and choose Recover My Account, and you can download your files with Download My Archive (§17); if you ask for it before that date, your account is deleted only once that download has ended, 7 days after it is ready or after it fails. When your account is deleted, we end anything left of your plan with Stripe, with no final bill and no refund, stop any Google Play plan for good, and then permanently delete:

  • your profile and connections;
  • the profiles you manage for others, with everything in them;
  • every file in your Archive, including files you copied from other people’s memories with Share a Copy;
  • your memories, comments, replies and reactions, so a chain of memories that included one of yours breaks where it was;
  • your Collections, including which memories are in them and who they were shared with;
  • the direct messages you sent;
  • what you shared and what others shared with you, including the links you made with Share Memory, our record of who opened them, and our record of the links you opened;
  • your notifications, and those your actions caused in other people’s lists;
  • your place as a helper on profiles other people manage;
  • the search index Memoria uses for all of these.

We then email you to confirm.

Some records stay. Unless we say otherwise in this list, they have no end date yet:

  • a closed record of your account that no one can sign in to, which keeps your email address so it cannot be used to open a new account, the dates you joined and asked to delete it, the date any free trial ended, the dates of any ban and of any review of it, the time you agreed to our terms on signing up and the versions you agreed to, if we recorded them, and your Stripe customer identifier if you had one;
  • the record of your request, with your name, email address and any reason you gave;
  • invitations you sent, answered requests to claim a profile, and Family Sharing groups;
  • the custom tags you gave people, and your notification choices;
  • blocks you made, or that others made on you; a block that is lifted is erased 90 days later;
  • reports you filed with us, with the reason and anything you wrote; a report someone made about you, or about one of your memories, is deleted with your profile or that memory;
  • which of other people’s memories you hid from your Home feed, until each memory is deleted;
  • reports that someone has passed away, and disputes of them, whoever made them;
  • your agreement to how Collaborative Memories worked, if you gave it, and the record of invitations to collaborate and how they ended (§08), tied to the closed record of your account so that we can show what was agreed; they keep no reference to a memory that has been deleted;
  • our record of who copied files from which memory with Share a Copy, including from your memories and the copies you took, which keeps no reference to a memory that has been deleted;
  • what you sent to our support team, including the copies described in §10.8;
  • any cancellation feedback you gave, without your account identifier or the words you typed (§10.8);
  • our billing records, including our record of your plans, and your customer record at Stripe (§10.2);
  • for at least 400 days, our security log of anything our staff did on your account.

What belongs to other people, and the copies they took, stay with them: memories they wrote, with your tag removed; files you added to a profile someone else manages; copies of your files that people you tagged took with Share a Copy; and messages they sent you.

Banned accounts. When we ban an account, we stop any plan Stripe bills, or that was bought through Google Play, from renewing at the ban. A plan bought through the App Store is not cancelled, because only its member can cancel it, in their Apple subscription settings. The account is then deleted in the same way 30 days after the ban, unless a review it asked for is still open. If we lift the ban before then, any plan Stripe bills that the ban stopped renews again, unless its period has already ended; only the member can turn a Google Play plan’s renewal back on, in Google Play.

Share Memory links. While your account is open, a link you made, and its list of the people who opened it, is deleted 90 days after the link ends. Our record that you made a link and of who opened it stays until your account, or theirs, is deleted.

Relationships after a disconnect. When you disconnect from someone, we keep the record of how the two of you were related, and that you disconnected. A relative who is connected to both of you, and who could see that relationship before you disconnected, may still see it on their family tree as an earlier link; an ended partnership shows only through a child you share, with no partner line between you. It is not shown while there is a block between the two of you, or between that relative and either of you. We also use it so that answers on a relative’s family tree never suggest the two of you to each other (§12). The record is deleted when either of your profiles is deleted.

Accounts that go quiet. If you have not used the Platform for a while, we will check in with you by email and on the Platform after six (6), nine (9), and twelve (12) months without activity, and after nine (9) months we will also let your Digital Inheritors and Legacy Steward know you have not used the Platform recently (§12). Signing in, using the Platform while signed in, or answering a check-in starts the count again. If your account has no active subscription and no user activity for twelve (12) months, it may become subject to inactive status, and its data may be deleted under section 09(D) of our User Licence Agreement, but not before these check-ins have been sent.

17 ACCESSING AND CORRECTING YOUR DATA

It is important that the data we hold about you is accurate and current. Please keep us informed if your data changes. By law you have the right to request access to it and to correct the data that we hold about you. By withdrawing your consent, you will not be able to access and use the Platform or our products or services. If you want to otherwise review, verify, correct, or withdraw consent to the use of your data, you may send us written notice in accordance with the notice provision at the end of this Privacy Policy. We may not accommodate a request to change data if we believe the change would violate any law or legal requirement or cause the information to be incorrect. We may request specific information from you to help us confirm your identity and your right to access the data, and to provide you with the data that we hold about you or make your requested changes. Applicable law may allow or require us to refuse to provide you with access to some or all the data that we hold about you, or we may have destroyed, erased, or made your data anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your data, we will inform you, subject to any legal or regulatory restrictions.

A copy of your files. You can download your files yourself at any time with Settings › Download My Archive. We prepare ZIP files of the originals, with the information stored inside them, of every file your storage pays for: your own Archive, everything in the profiles you manage, and the files you copied from other people’s memories with Share a Copy. They do not include the words of your memories, files that are only shared with you, or files in a profile you only help look after. We tell you in the app and by email when they are ready. They are deleted 7 days after they are ready and, like any file that is deleted, erased from our file storage 30 days after that (§16). If preparing them fails, we tell you, and our support team is told so that we can help.

You can also delete your account yourself, as described in §16 and on our Delete Your Account page. If you cannot sign in, use Forgot password? on the sign-in screen, or write to support@aeternumproject.com and we will help you.

18 CHANGES TO OUR PRIVACY POLICY

It is our policy at Aeternum to post any changes we make to our Privacy Policy on this page. We include the date the Privacy Policy was last modified at the top of the page. You are responsible for ensuring we have an up-to-date, active, and deliverable email address for you, and for periodically visiting our Platform and this Privacy Policy to check for any changes.

Any hyperlink in this Privacy Policy is provided for convenience only and is subject to change from time to time as the server, data, or destination changes, or as posts or pages are taken down or moved. You understand that a wrong or missing hyperlink shall not affect the interpretation of this Privacy Policy.

20 NOTICES

All notices and communications to Aeternum shall be delivered in writing via email to:

Aeternum Corp. Attention: Privacy Officer legal@aeternumproject.com

All notices and communications to User shall be delivered to User by email to the email address User used to contact Aeternum and/or the email address we have on file for User.

We welcome your questions, comments, complaints, and requests regarding this Privacy Policy and our privacy and digital practices.

If submitting a notice, complaint, or request to withdraw consent or remove your account, content, data, or information from the Platform, please particularize and substantiate all information and evidence Aeternum needs to comply with such notice, complaint, or request, including to comply with all relevant rules, regulations, and this Privacy Policy, within TEN (10) days of the circumstances of such notice, complaint, or request was made known to User.