Privacy Policy

Scope

This policy covers our applications (including the LifeSpool iOS app), our web surfaces (including guest/invite links), and our APIs. It does not cover third-party services you reach through the Service (e.g., Apple, Google) except as described in Section 5.

Information we collect

You provide directly

• Account information: name, email address, and authentication identifiers.
• Recordings and content: audio and video recordings, photos, written notes, story titles, chapter/event organization, and any other content you create or upload.
• Subjects of content: your recordings and stories may include information about other people (family members, including minors). See Section 9.
• Communications: messages you send us (support, legal, privacy requests).
• Payment information: handled by Apple (in-app purchases) or Stripe (web). We do not store full payment card numbers.

Collected automatically

• Usage and device data: app version, device model, OS version, IP address, and interaction events used to operate and improve the Service.
• Diagnostics: crash and performance data (via Firebase Crashlytics and Apple MetricKit).
• Invite metadata: redeemable invite-token identifiers and redemption status.

Generated by the Service

• Transcripts of your recordings.
• AI-generated prompts, follow-up questions, and recap excerpts derived from your content.
• Written descriptions of photographs and video generated by visual analysis, including descriptions of people who appear in them (see Section 4).

From third parties

• Sign-in identifiers from Apple (“Sign in with Apple”) and Google when you choose those methods. With Sign in with Apple, you may use Apple's private email relay.

How we use information

We use personal information to:

• Provide, maintain, and secure the Service (record, store, transcribe, organize, and play back your content).
• Generate personalized prompts and recap features.
• Authenticate you and manage your account and entitlements/subscriptions.
• Communicate with you about the Service.
• Diagnose problems, prevent abuse, and improve reliability and performance.
• Comply with legal obligations and enforce our Terms.

If you are in a jurisdiction requiring a legal basis (e.g., the EU/EEA/UK), we rely on performance of our contract with you, your consent, and our legitimate interests in operating and securing the Service.

AI processing

We use third-party AI APIs (currently Anthropic and OpenAI) to transcribe recordings, generate prompts and recap content, and to analyze photographs and video you upload. Your content is transmitted to these providers only to perform these functions.

Visual analysis

Visual analysis produces short written descriptions of what appears in an image — including descriptions of people who appear in it — which we use to caption your media, to assemble it into films, and to write narration. These descriptions are stored with your media and are visible only to you and to anyone you share that media with.

We do not collect or generate biometric identifiers

We do not create facial-recognition templates, face embeddings, voiceprints, or any other biometric identifier. Descriptions of people generated by visual analysis are ordinary text. They are never matched against any identity database, against other users' content, or used to identify anyone.

We use these providers under their API terms, which—at the time of writing—do not use inputs or outputs submitted through their APIs to train their general models. We do not authorize any provider to use your media for general model training. Because these are third-party terms we do not control, we will update this policy if those terms or our providers change.

Subprocessors and service providers

We share personal information with vendors who process it on our behalf, under contract, only to provide the Service:

We do not otherwise share your content. We may disclose information if required by law, to protect rights and safety, or in connection with a merger or acquisition (with notice as required by law).

We do not sell or “share” your data

We do not sell, rent, license, or trade your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and the Colorado Privacy Act (CPA). We have no plans to do so.

We do not serve advertising in the Service.

Storage and security

Your content is encrypted in transit and at rest and stored on industry-standard infrastructure. Customer data is logically segmented within our systems to keep each account's archive separated from others. We maintain administrative, technical, and physical safeguards designed to protect personal information.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. We design for long-term durability and availability of your archive.

Data retention and deletion

We retain your content and account information for as long as your account is active or as needed to provide the Service.

You may delete individual stories or your entire archive, and you may delete your account, at any time through the Service or by contacting us at privacy@onebloodlabs.com. When you delete content or your account, we delete or de-identify the associated personal information within a commercially reasonable period, except where retention is required by law. Residual copies may persist in encrypted backups for up to 30 days before they are overwritten on our normal backup cycle.

Children and family content

The Service is for adults only. You must be 18 or older to create an account, and only account holders use the Service. Minors are not permitted to register, sign in, or operate the Service in any way. We do not knowingly collect personal information directly from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA).

Adult-operated recording of minors

Across our apps, an adult account holder may capture and preserve a minor's stories, recordings, or other content on the minor's behalf. In every case, the account holder—not the minor—operates the Service, controls the recording, and is responsible for the content. The minor is a subject of content, not a user. By recording or uploading content involving a minor, the account holder represents that they are the minor's parent or legal guardian, or have obtained that person's authorization, and have the authority to record the minor and to store and share that content within their groups.

Because minors never interact with the Service directly and all collection occurs through an adult account holder acting as the responsible party, we do not knowingly collect personal information directly from children.

If you believe a minor has created an account or otherwise used the Service directly, or that content about a minor was recorded without proper authority, contact privacy@onebloodlabs.com and we will take appropriate steps, including removal where warranted.

Recordings involving other people

Recordings you make may capture other people — family members, friends, or people nearby. When you upload such a recording, we transcribe and store it as we would any other recording, and any photographs or video you upload may be analyzed as described in Section 4.

You are responsible for obtaining any consent required where you record. Consent requirements vary by state and country; some jurisdictions require the consent of everyone recorded, not only your own. By uploading a recording, you confirm you have any consent the law requires.

If you are recorded in someone else's content and want it removed, contact us at privacy@onebloodlabs.com. We will work with the account holder to address the request.

Your rights and choices

Depending on where you live, you may have rights to:

• Access and obtain a copy of your personal information (you can export your archive at any time through the Service).
• Correct inaccurate personal information.
• Delete your personal information.
• Opt out of sale/sharing and targeted advertising — note we do none of these.
• Appeal a denial of a request (Colorado and certain other states).
• For EU/EEA/UK residents: object to or restrict processing, withdraw consent, and lodge a complaint with a supervisory authority.

These rights arise under state comprehensive-privacy statutes including the California Consumer Privacy Act (CCPA/CPRA), the Colorado Privacy Act, and the comprehensive privacy laws of Virginia, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, and other states as they take effect. Recording-consent law is a separate body of law; see Section 10.

To exercise any right, contact privacy@onebloodlabs.com. We will verify your identity before acting and will respond within the timeframes required by applicable law. We will not discriminate against you for exercising your rights.

International transfers

We operate in the United States, and your information is processed in the U.S. and other countries where our providers operate. If you access the Service from outside the U.S., you consent to the transfer and processing of your information in the U.S. and these locations, which may have different data-protection laws than your own.

Cookies and tracking (web)

Our web surface uses strictly necessary cookies for authentication and session management. We do not use advertising or cross-site tracking cookies.

Security incidents

If we determine that a breach has compromised your personal information, we will notify affected users and regulators as required by applicable law.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you through the Service or by email. Continued use of the Service after changes take effect constitutes acceptance.

Contact us

This policy is provided for transparency and is not legal advice. Have qualified counsel review before publishing.