Privacy
Last updated: September 4, 2026
Your stories, photos, and voice are yours. MemoriesBox stores them encrypted in our EU data center and never sells or trains on your data. This page explains exactly what we collect and why.
What we collect
Email address (for sign-in), the answers you record (audio and text), photos and videos you upload, and the people you add to your family tree. Nothing else.
Where it lives
Stored in the EU: recordings and photographs in Amazon S3 in Stockholm, the database and its backups in Supabase's EU region, some media in Cloudinary's EU storage, and the application running in Frankfurt on Vercel. Four processors outside the EU touch content for a moment and do not keep it: OpenAI transcribes each answer, Anthropic writes the digital self's replies, Google restores a photograph only when you ask, and ElevenLabs builds and holds the voice model — the one thing stored outside the EU, deleted when you retire it. Stripe handles cards; Resend delivers our emails. Everything is encrypted in transit and at rest. The full list, with each country, is at memoriesbox.org/en/trust/where-your-data-lives.
Who can see it
Only you, until you give a key to an heir. An heir can see your family tree from the day you invite them, and add to it. Your recordings stay sealed until the archive is released. They can never reach your avatar or your cloned voice: those are not exportable by anyone, including you. Whether heirs may save the recordings to their own computer is your choice, in Settings → Trusted contacts.
AI providers
Claude (Anthropic) writes the digital self's replies and the character brief. OpenAI's Whisper turns your recordings into text. ElevenLabs builds the voice model and speaks the replies. Google's image model restores a photograph when you press the button. Each works under terms that exclude your data from training its general models, and none keeps your content beyond the request, except ElevenLabs, which holds the voice model until you retire it.
Your rights
You can export everything you put in, anytime. You can delete your MemoriesBox completely, anytime. We honor GDPR access and erasure requests within 30 days.
Contact
privacy@memoriesbox.org