Privacy

The short version

This site sets no cookies and runs no ad or analytics trackers. We never sell personal data. We share it only with the services that run the site, the email and the shop, and they are all named below. On your own computer, Hearthkeep never sends us your family’s names, photos or anything you add. On Hearthkeep Cloud, when we offer it, we host your archive and can see what you store.

Visiting the site

Cloudflare serves these pages and sees your IP address to do that, under Cloudflare’s own privacy policy. We do not store it.

We count visits as daily totals: which page, a few named moments (pricing seen, how it works opened, waitlist joined), the site you came from (its address only, never the page), your country (a two-letter code Cloudflare reads from your IP; we store the code, never the IP), and whether you were on a phone or a desk. No cookie, no id, nothing that identifies you. If your browser sends Do Not Track, we do not count you at all. Totals are deleted after 400 days.

Your browser keeps two things on your own device: your light-or-dark choice and whether you closed the banner. They never leave your device.

“Try the demo” opens the real app on our demo address and signs you in as a made-up family member. That page keeps a sign-in cookie for the demo only. The demo is read-only and is reset every night.

The waitlist

What you give us: your email address, your answer to “How would you run it?”, and whether you ticked the first-10 box.

When we keep it: from the moment you press Join. We store your answers, marked unconfirmed, and send you one email with a confirm link. If you join again before pressing it, we send the link again, at most twice more and an hour or more apart. If you never press it, we delete your address seven days after the last link we send. If you press it, you are on the list.

The human check: the form uses Cloudflare Turnstile to tell a person from a script. Turnstile runs in your browser under Cloudflare’s privacy policy. To verify it, we send Cloudflare the check’s result and your IP address.

Rate limits: to stop floods, we count joins per IP address and per email address for ten minutes. We store a keyed hash, never the address itself, and delete it after the ten minutes.

What we send: the confirm email, one email when Hearthkeep opens (if you ticked the first-10 box, it is the one that carries your code), and a short note if you leave. Emails go through Resend, which sees your address and the message. Every email to the list carries our postal address and a one-click leave link.

Leaving: one click in any email deletes your address at once. We keep no “unsubscribed” record. Or write to [email protected] and we delete it by hand.

How long: until the launch email has gone out, plus up to ninety days. Then we delete the whole list. We do this by hand, and the launch email says so.

“Help improve Hearthkeep” (off until you turn it on)

An admin can turn on “Help improve Hearthkeep”, which sends a weekly usage report and a daily crash report. It is off until then, and Admin shows exactly what is sent, before and after you turn it on.

The usage report carries a random report id (never the archive id or an email), the version, the operating system family, the computer’s kind, size ranges (how many files and how much space, how many members and people, never who), the week’s counts of uploads, stories, tree edits, searches and AI jobs, and error counts with no messages. Crash reports carry code locations, never content. We keep both for one year. Turning the switch off deletes the report id.

Hearthkeep Cloud and Hearthkeep Backup (when we offer them)

Today both are waitlist only.

Hearthkeep Cloud: we host your archive, so we can see what you store. Finding faces and search need it. If a Cloud plan goes unpaid, the archive is read-only for thirty days and every admin is emailed the date; after that it may be deleted. Taking your whole archive home is free at any time.

Hearthkeep Backup keeps an encrypted copy of a Home archive off-site. It is encrypted on your own computer before it leaves your house, and we hold only the encrypted copy.

Where it is kept: Cloud archives, their files and their database, and Backup’s off-site copies are kept in the United States, wherever you live. Files are stored with Backblaze B2.

A Cloud archive’s records are copied to our storage every few seconds and kept with 30 days of history. Its files are stored on redundant cloud storage with version history, so a file you delete or replace can be brought back. You can download your whole archive at any time.

Before we sell them, these pages will say exactly what applies.

Your family’s archive is not ours

Everything your family adds lives in your archive. On your own computer we never receive it. The archive’s own privacy, including who in the family sees what and how child accounts are governed, is set by your family’s admins inside the app.

Who we share data with

We never sell personal data. We disclose it only if the law requires us to, and we tell you unless the law forbids it. We may publish totals, like how many families use Hearthkeep, never anything about one person. If Hearthkeep is ever sold or passed to a successor, your data goes with it under this policy, and we tell you first.

We share it only with the services below. When this list changes, this page and the date at the top change.

• Cloudflare: serves the site, runs the waitlist, shop and check-in, stores their database, and runs the Turnstile check.
• Resend: sends our email.
• Backblaze B2: stores the files of Cloud archives and Backup’s off-site copies in the United States, once we offer them.

How long we keep things

• A waitlist address you have not confirmed: seven days after the last confirm email, then deleted.
• A waitlist address you confirmed: until the launch email has gone out, plus up to ninety days; deleted by hand.
• Rate-limit hashes (IP, email, key, session): ten minutes; one day for the daily caps on sign-in links and code resends.
• A sign-in link: fifteen minutes.
• An archive-link code: ten minutes.
• A check-in line per computer: thirty-seven days after we last heard from it.
• Visit totals: 400 days.
• Usage and crash reports, if turned on: one year; the report id goes when you turn it off.
• The demo sign-in: reset every night.

Cookies and your browser

Your light-or-dark choice and the closed banner live in your browser’s local storage and never leave your device. We never sell or share data for advertising, so an opt-out signal like Global Privacy Control has nothing to switch off; Do Not Track stops the visit count.

• This site: no cookies, no trackers.
• The demo: a sign-in cookie on the demo address only, reset every night.

Your rights

Wherever you live, you can ask us to show you what we hold about you, correct it, delete it, give you a copy, stop a use you object to, or stop emailing you. Write to [email protected]. We may first ask you to confirm you own the address. We answer within thirty days, and we never treat you differently for asking. Leaving the waitlist is one click in any email.

If you are in the EU or the UK

Our systems run in the United States. Our providers’ data processing terms include the EU’s standard contractual clauses.

You may complain to your data protection authority; we would rather you wrote to us first.

Our legal bases under the GDPR and the UK GDPR, one per use:

• the waitlist, your account, your order and the license check-in: the contract or service you asked for;
• visit counts, rate limits and fraud prevention: our legitimate interest in running a small site safely;
• order records: our legal duty to keep accounts;
• the usage and crash reports: your consent, given by the switch and withdrawn by it.

If you are in California

We collect the categories named on this page (contact details, order details, and non-identifying usage counts) and no sensitive personal information. We do not sell or share personal data for advertising, so there is no opt-out to offer. You have the rights to know, delete and correct described above, and we never treat you differently for using them.

Children

This site and the shop are for adults, 18 and over. We do not knowingly collect personal data from children under 13, and if we learn we have, we delete it. Accounts for children inside a family’s archive are the family’s, governed by its admins under the app’s own rules.

Security

Everything travels over HTTPS. Sign-in links, sessions and rate counters are stored as keyed hashes; activation codes are encrypted; the daily check-in’s answer is signed so a forged one is ignored. If a breach ever affects you, we email you as soon as we can and within the time the law sets.

Changes

When this page changes, the date at the top changes with it. If a change matters to people who have bought from us, we email them before it takes effect. Earlier versions are available on request.