Privacy Policy

Effective Date: July 3, 2026

I. Consent

By using our Services, you agree to the terms and conditions contained in this Privacy Policy and consent to the data processing practices described herein. Ourtifacts (“Ourtifacts,” “we,” “us,” or “our”) is operated by JMB Innovations LLC, a Nevada limited liability company, and provides a private, collaborative family memory-keeping platform at ourtifacts.com (the “Services”).

Ourtifacts lets a parent or family member (a “custodian”) create a private “Memory Vault” centered on a child, invite loved ones to contribute, and gather everyone's voice notes, photos, videos, and written stories into a lasting archive the child can treasure later. We use artificial intelligence to transcribe voice memories and turn them into warm, readable keepsakes.

The Services are currently offered as an open beta and continue to evolve. This Policy covers the Services as they exist today and the additional features we may introduce from time to time.

II. What Data We Collect

a. Account Information

When you create an account, we collect: your name, email address, and profile image (if provided via a third-party authentication provider). Authentication is managed by our provider Clerk. You may link third-party accounts (such as Google) to authorize limited information access per that provider's privacy policy. You can revoke access at any time through your account settings.

If you contact us or provide feedback, we collect your name, email, and any content or attachments you include in your message.

b. Family and Memory Vault Information

To set up and organize a vault, we collect the information you provide about your family, which may include:

A child's name (or nickname) and, optionally, their birth date or due date
A family name and your role or relationship to the child
The names, email addresses, and relationships of the loved ones you invite to contribute
Optional details contributors provide about themselves, such as a birth year, used to tailor the memory prompts they receive and to place undated memories in time

You are responsible for ensuring you have the appropriate authority to add this information; see Section VIII (Children's Privacy).

c. Memories and Content

To deliver the Services, we collect and store the memories and content you and your invited contributors create, including:

Voice recordings (audio) you capture or upload
Photos and videos you capture, upload, or import
Written notes and captions
Transcripts generated from your recordings
AI-generated keepsake stories created from your memories
Comments and reactions family members leave on memories
Albums, occurred-dates, tags, and other organizational metadata you create
Memory metadata such as duration, timestamps, and titles
Preferences (such as custom name-spelling dictionary terms and notification settings)

d. Technical Information

Our Services automatically collect certain technical data: browser type, operating system, IP address, device identifiers, domain name, and timestamps of your visit. This data is gathered in log files for authentication, security, and reliability purposes. If you enable push notifications, we store the notification subscription your browser provides so we can deliver those alerts to your device.

e. AI Processing Data

When you add a voice memory, your audio is sent to our transcription provider (OpenAI's transcription models) to produce a transcript. The resulting transcript is sent to our AI provider (Anthropic) to craft a warm, readable keepsake version of the memory and to power related features such as suggested prompts and approximate-date suggestions. We also generate vector embeddings from your transcripts so you can search your vault and use the “Ask” feature. You are responsible for ensuring you have the right to record, upload, and share the content you add, including content that features other people.

We use your audio solely to transcribe it and deliver the features you request. We do not use it to create voiceprints or any other biometric identifier, and we do not use photos or videos for facial recognition or any other biometric identification. We may change or add transcription and AI providers over time and will update this Policy accordingly.

f. Cookies and Tracking Technologies

We use cookies and similar technologies (such as local storage) to operate and improve the Services. We do not use advertising cookies or third-party marketing trackers, and we do not sell your information. The categories we use are:

Necessary cookies: Required for basic functionality such as authentication and session management.
Functional cookies: Enable features like preferences and the installable app (PWA) experience.
Analytics: We may use a product-analytics provider (PostHog) to understand how the Services are used and to improve them. This can include session-replay technology that records how you interact with the interface (clicks and navigation). Replay is configured to mask text and form inputs, and we do not use it to capture the contents of your memories, transcripts, or keepsakes.

You can remove persistent cookies at any time through your browser's settings.

III. How We Use the Data We Collect

We use your personal information for the following purposes:

Facilitate account creation and security
Identify you as a user of the Services
Create, operate, and administer your family Memory Vault
Transcribe your voice memories and turn them into keepsake stories
Power search and the “Ask the vault” feature across your memories
Send invitations to the contributors you choose to include
Deliver the notifications you enable (such as new-memory alerts, weekly family digests, and push notifications), which you can turn off at any time
Personalize the memory prompts and experience for you and your family
Respond to your inquiries, feedback, and support requests
Understand which features are used to inform product decisions
Comply with applicable laws and regulations
Respond to lawful requests and court orders
Detect, prevent, and respond to fraud or security incidents

We may also compile and use statistical or anonymized, non-personally identifiable information for any purpose, provided such data has been fully de-identified. We do not use your memories, transcripts, photos, videos, or content to train our own models, and our AI providers do not use your content to train their models.

IV. Information Sharing and Disclosure

a. Within Your Family Vault

Ourtifacts is a collaborative product. The memories in a vault are visible to the family members and loved ones the custodian (or a co-custodian) invites, according to the access level assigned to each person (for example, a co-parent with full access, a contributor who can add memories, or a view-only member) and any audience restrictions the custodian places on individual memories. People invited by email receive a private link, and ongoing contributors may create their own login to browse and add memories. The custodian controls who is invited and can change or remove a person's access. Please invite only people you trust with your family's memories.

b. Service Providers

We engage third-party companies and individuals to support the Services, including:

Railway (application hosting and database)
Cloudflare (private storage of voice recordings, photos, video posters, and vault exports via R2, and video hosting and playback via Stream)
Clerk (authentication and user management)
OpenAI (audio transcription)
Anthropic (AI generation of keepsake stories and related features)
Resend (delivery of invitation, notification, and administrative emails)
PostHog (product analytics and masked session replay)
Sentry (error and performance monitoring)

These providers are contractually bound to confidentiality and to only use your data as necessary to deliver the services we request from them. We may add, remove, or change service providers as the Services evolve and will update this list accordingly.

c. Law Enforcement and Safety

It may be necessary (by law, legal process, litigation, or requests from public and governmental authorities) for Ourtifacts to disclose your personal information. Disclosure may also occur if necessary to enforce our Terms of Use or to protect the rights, property, or safety of Ourtifacts, our users, or others.

d. Business Transfer

We may share your personal information if Ourtifacts engages in a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of our assets, or any other steps in contemplation of such activities. We will notify you before your information becomes subject to a different privacy policy.

e. With Your Consent

We may disclose your personal information with your prior informed consent for specific purposes you authorize.

Ourtifacts does not sell your personal information, memories, photos, videos, transcripts, or content to anyone.

V. How We Protect Your Data

We are committed to protecting the security of information we collect. We implement reasonable and appropriate administrative, technical, and physical security controls, which may include measures such as:

TLS/SSL encryption for all data in transit
Databases kept on access-controlled infrastructure
Voice recordings, photos, videos, and export files kept in access-controlled, private cloud storage, served only through authenticated requests
Industry-standard authentication practices (via Clerk)
Limiting access to user data on a need-to-know basis

Despite our efforts, no security controls are 100% risk-free. Ourtifacts does not warrant or guarantee that your personal information will be secure and free from unauthorized access.

VI. Data Retention

Ourtifacts retains personal data as long as required to provide the Services you have requested or registered for, and to comply with applicable laws. A Memory Vault is intended to be a lasting archive, so we keep its contents until you choose to remove them.

You may delete an individual memory at any time, which removes its audio, photos, video, transcript, and generated keepsake. A custodian may export the entire vault, or delete the entire vault and account, at any time through Settings; when a vault has more than one owner, we first email every owner a downloadable copy. Upon deletion, your personal data and content will be removed from our active systems within 30 days, though some data may persist in backup systems for up to 90 days. Export download links expire after 30 days. Aggregated and anonymized data may be retained indefinitely.

VII. AI Processing

Ourtifacts uses artificial intelligence to transcribe your voice memories and to turn them into warm, readable keepsake stories. AI also powers search across your vault, the “Ask” feature, and the memory prompts we suggest. These features are intended to help your family preserve and enjoy your own memories, and do not produce legal effects or significantly affect you outside the context of providing the Services you request.

AI-generated transcripts and keepsakes may contain errors, misheard words, or inaccuracies. You are responsible for reviewing them, and you can edit them at any time.

VIII. Children's Privacy

Ourtifacts is a service for adults. Account holders and contributors must be adults, and we do not permit children to create their own accounts or use the Services independently.

Ourtifacts is designed to help a parent or legal guardian build a private archive of memories about and for their own child. In doing so, a custodian may add information about their child (who may be a minor, including a child under 13), such as the child's name, birth date, photos, videos, and stories. A custodian provides this information in their capacity as the child's parent or legal guardian and is responsible for the content that they, and the contributors they invite, add about the child. Contributors are likewise responsible for ensuring they have the right to share what they contribute. A vault is private to the family members the custodian invites; Ourtifacts does not make a child's information public. A custodian may review, export, or delete their child's information at any time through the Services.

We do not knowingly allow anyone under 13 to create an account, and we do not knowingly collect personal information directly from a child under 13. If you believe a child has created an account, or you are a parent or guardian who wishes to review or remove information about your child, please contact us at [email protected].

IX. Your Rights

We make every effort to comply with applicable data protection laws, including the GDPR (European Union) and CCPA/CPRA (California). Your rights include:

Right to Access: Request a copy of your personal data
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Erasure (“Right to be Forgotten”): Request deletion of your data
Right to Restrict Processing: Request limitations on how we process your data
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interest or for direct marketing
Right to Know: Request information about collected, sold, or shared data
Right to Opt-Out of Sale or Sharing: Direct us not to sell or share your information (note: Ourtifacts does not sell personal data)
Right to Non-Discrimination: You will not be discriminated against for exercising these rights

Many of these actions (exporting your vault, editing memories, and deleting content or your account) can be done directly in the app. You may also email [email protected]. We will take reasonable steps to verify your identity before responding to protect your information from unauthorized requests.

X. Cross-Border Data Transfer

By accessing or using the Services, you understand that your information may be subject to processing, transfer, and storage in geographic locations outside your country of residence, including the United States. Where we transfer personal data from the UK or European Economic Area to a country not subject to an adequacy decision, we implement appropriate safeguards (such as Standard Contractual Clauses) to ensure an adequate level of protection.

XI. California Residents

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have specific rights regarding their personal information, including the rights listed in Section IX above.

Categories of Information Collected

We collect the following categories of personal information:

Identifiers: Name, email, IP address, account identifiers
Family Information: Child names and birth dates, family relationships, and the names and emails of contributors you invite
Internet/Network Activity: Usage data, page views, device info
Geolocation: Approximate location inferred from IP address
Audio, Images, and User-provided Content: Voice recordings, photos, videos, transcripts, AI-generated keepsakes, comments, and other content you and your invited contributors create
Inferences: Preferences and patterns derived from your use of the Services

Do Not Track and Global Privacy Control

We do not currently respond to “Do Not Track” signals. However, we recognize and honor Global Privacy Control (GPC) signals as a valid request to opt out of the sale or sharing of personal information under the CCPA. Note that Ourtifacts does not “sell” personal data as defined under CCPA, so opting out is generally not necessary.

XII. Changes to This Privacy Policy

Ourtifacts reserves the right to change this Privacy Policy. We will provide notice of material changes through our Site and, where we have your email on file, by email at least 30 days prior to the change taking effect. Continued use of the Services after the effective date constitutes acceptance of the updated policy.

XIII. Contact Us

Ourtifacts welcomes your comments, questions, and concerns regarding this Privacy Policy. Please contact us at:

Entity: JMB Innovations LLC (Nevada, USA)
Privacy inquiries: [email protected]
General inquiries: [email protected]

Related: Terms of Use