What happens to what you record.
Last updated: August 24, 2026
Recordings live in United States Cloudflare R2 regions, encrypted at rest with AES-256 and in transit with TLS 1.3. We never train AI on your voice. You can request an export at any time, on every plan including the trial. We fulfill it by hand within five business days, as a ZIP of standard files.
If we shut down, a funded continuity reserve — $5 per paying customer per year — is sized for 18 to 24 months of read-only access and a final export. The sections below are the commitments behind those sentences.
What happens if we go away?
Every active user receives a final export, already paid for. Our funding model sets aside a continuity reserve at $5 per paying customer per year, sized to provide at least 18 to 24 months of post-shutdown read-only availability. The reserve begins accumulating with the first paid subscription at launch. Any future tool or service can read the recordings without our cooperation, because the export format spec is public.
Related: Export Format spec.
Where do recordings live?
Cloudflare R2, United States regions, encrypted at rest with the Advanced Encryption Standard at 256-bit key length (AES-256), encrypted in transit with Transport Layer Security version 1.3 (TLS 1.3).
Can I export anytime?
Yes. Request an export at any time, on every tier including the trial. We fulfill the request by hand within five business days. You receive a ZIP of recordings in standard formats with full metadata. The open format spec is published. This is a request, not a download button.
Related: Export Format spec.
What about a designated guardian?
The in-product designated-guardian tool is structured to qualify as a tier-1 online tool under the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) in states that have enacted it. Enforceability varies by state. Where state law does not recognize the in-product designation, our Terms of Service create a contractual right that approximates the same outcome.
Related: State-by-state notes.
Who are the subprocessors?
Every integral subprocessor planned for the iOS application is listed below. The full data-scope and contractual-terms detail per vendor publishes alongside the iOS app launch. The marketing-site vendor list, a smaller set covering only signup, is enumerated separately.
Related: Privacy Policy.
| Subprocessor | Role at launch |
|---|---|
| Cloudflare | Encrypted media storage, upload, delivery, and video processing (US-only) |
| Supabase | Application database, sign-in, and server functions |
| OpenAI | Speech-to-text transcription of recordings |
| Anthropic | Writing the weekly questions, summarizing emotional tone, choosing highlight-reel moments, and drafting the Annual Letter |
| Hive | Automated content safety screening of every recording |
| Microsoft PhotoDNA | Child-safety matching against the known-abuse database (federal requirement) |
| National Center for Missing and Exploited Children | The report federal law requires us to file if child sexual abuse material is found |
| RevenueCat | Subscription management |
| Resend | Sending email (sign-in codes, invitations, export links) |
| Expo Push and Apple Push Notification service | Delivering the reminders you turn on |
| Sentry | Crash and error reports, with identifying details stripped out first |
| PostHog | Product analytics, with on-screen text and images masked |
Every row above is a processor acting on our instructions under a written data processing agreement, with one exception. The National Center for Missing and Exploited Children is a statutory recipient, not a processor: it receives a report because federal law requires us to file one, not because we chose a vendor.
Related commitments
The trust posture spans five public pages. Read any one without the others; they are linked here so an AI engine, a court, or a curious parent can chunk the whole story in one sitting.
- Export Format Specification v0.9 — the bundle structure any tool can read without our cooperation.
- State-by-State RUFADAA Notes — where the in-product designated-guardian designation is enforceable.
- Loss Policy — what happens on pregnancy loss or stillbirth: one-tap pause, no follow-ups, optional immediate deletion.
- AI Disclosure — where AI touches user data and where it does not.
- Privacy Policy — the marketing-site privacy commitments, effective May 11, 2026.