This Privacy Policy describes how Karla's Love App ("we," "us," or "the Service") collects, uses, stores, and protects your personal information. We treat your data with the same care we'd want for our own family's memories. This policy is the legal floor; the Sacred Covenant is our binding promise that goes further. Where the two ever conflict, the Covenant wins for you.
0. The Sacred Covenant
Before reading the legalese below, please read the Sacred Covenant. It is six binding promises in plain language about how your family's memories are held — including that we will never sell your data, never use your family to train other customers' AI, and that the founder personally reads every email at [email protected]. The technical enforcement of these promises is shown live on the Trust Dashboard.
1. What We Collect
| Data Type | What & Why |
|---|---|
| Account info | Email address, name, and optional phone number — used for login (magic links) and communication. |
| Photos & videos | Images and videos you upload to preserve family memories. |
| Written stories | Text memories and captions you share about loved ones. |
| Voice recordings | Audio stories you record through the browser. Stored for playback and AI processing. |
| Face labels | Bounding-box annotations and names you assign to faces in photos — used for person identification in storybooks. |
| Payment info | Handled entirely by Stripe. We never see or store your card number. We store only your Stripe customer ID and subscription status. |
| Usage data | Server logs (IP address, request timestamps) for security and debugging. Not linked to user profiles. |
2. How We Use Your Data
- AI story generation: Your photos, stories, and voice recordings are processed by our AI (Google Gemini) to generate illustrated storybook pages and narration.
- Character portraits: Photos are used with Replicate's image generation API to create LoRA-trained AI portraits of family members.
- Community memorial: Content you choose to share publicly is displayed on the community memorial page.
- Communication: Email is used for login links, billing receipts, and important service updates. We do not send marketing emails unless you opt in.
What we will NEVER do:
- Sell, rent, or trade your personal data to anyone.
- Use your photos or stories to train AI models for third parties.
- Share your data with advertisers.
- Use your loved one's voice or likeness for any purpose beyond this Service.
3. Data Retention
We retain your data for as long as your account is active. Memorial content is designed to be preserved long-term — that's the point of the Service.
- Active accounts: All data retained indefinitely.
- Canceled subscriptions: Content is preserved for 90 days after your billing period ends, giving you time to resubscribe or export.
- Deleted accounts: All data is permanently deleted within 30 days of your deletion request, except where retention is required by law.
- Server logs: Automatically purged after 90 days.
4. Third-Party Services
We use the following third-party services to operate:
| Service | Purpose | Data Shared |
|---|---|---|
| Stripe | Payment processing | Email, payment details (handled directly by Stripe) |
| Google Gemini | AI text/story generation | Text prompts derived from your stories and photo descriptions |
| Replicate | AI image generation (LoRA) | Photos used for training character models |
| Google Cloud | Infrastructure hosting | All data (encrypted at rest and in transit) |
| edge-tts | Text-to-speech narration and Memory Echo voice | Story text for audio generation (processed locally) |
| Resend | Transactional email delivery (magic-link sign-in, Memory Echo links, billing receipts) | Email address only; never the contents of your photos or stories |
Each service is bound by their own privacy policies. We choose services that offer strong data protection guarantees.
5. Your Rights
You have the right to:
- Access: Request a copy of all personal data we hold about you.
- Correction: Update or correct inaccurate information.
- Deletion: Request permanent deletion of your account and all associated data.
- Portability: Export your photos, stories, and generated content in standard formats.
- Objection: Object to specific data processing activities.
- Restriction: Request that we limit processing of your data while a concern is resolved.
To exercise any of these rights, email us at [email protected]. We respond within 30 days.
6. Data Protection & Security
We take security seriously:
- Encryption: All data is encrypted in transit (TLS/HTTPS) and at rest on our servers.
- Access controls: API key and JWT-based authentication. HMAC-SHA256 audit chains track all sensitive operations.
- Infrastructure: Hosted on Google Cloud Platform with firewall rules, private networking, and regular security updates.
- Minimal access: Only authorized personnel can access production systems. We follow the principle of least privilege.
- No database passwords in code: All secrets are managed via environment variables, never committed to version control.
7. Children's Privacy (COPPA)
The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent.
Photos of children may appear in family memorial content uploaded by adult family members. These photos are treated with the same privacy protections as all other content.
If you believe a child under 13 has provided personal information without parental consent, please contact us immediately and we will delete the information.
8. Cookies & Tracking
We use minimal browser storage:
- localStorage: Guest ID, name, and session preferences. No third-party tracking cookies.
- No analytics trackers: We do not use Google Analytics, Facebook Pixel, or similar tracking services.
- No ad networks: We do not display ads or participate in ad networks.
9. International Users
The Service is hosted in the United States. If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S. By using the Service, you consent to this transfer. We apply the same privacy protections regardless of where you are located.
10. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email at least 14 days before they take effect. The "Last updated" date at the top indicates the most recent revision.
11. Contact Us
For privacy questions, data requests, or concerns:
Karla's Love Memorial — Privacy Team
Email: [email protected]
Website: karlagardehenke.us
We aim to respond to all privacy-related inquiries within 30 days.