Legal
Privacy Policy
Your family's memories are private by default. Here's exactly what we collect, how we use it, and how we keep it safe.
Last updated: [Effective Date]
Template notice: this page is a starting draft, not a finished legal document. Because Our Years Together stores videos of minors, please have this policy reviewed by a qualified attorney — including for compliance with COPPA and any applicable state/international privacy laws — before it is published or relied upon.
1. Information We Collect
We collect the information you provide directly to us, including:
- Account information: your name, email address, and password when you create an account.
- Child profile information: a name and birth date (or due date) for each diary you create.
- Uploaded content: the videos, photos, and captions you and your invited contributors add to a diary.
- Payment information: billing details are collected and processed by our third-party payment processor, [Payment Processor Name]; we do not store full payment card numbers ourselves.
- Usage information: basic technical data such as device type, browser, and general access logs, used to keep the service secure and reliable.
2. How We Use Your Information
We use the information we collect only to:
- Provide, maintain, and secure the diary storage and delivery service.
- Communicate with you about your account, uploads, and contributor invitations.
- Process payments and manage subscriptions.
- Respond to support requests sent to support@ouryearstogether.com.
- Detect, investigate, and prevent fraud, abuse, or security incidents.
We will never use your family's videos or photos to train AI models, sell your data, or serve advertising. We do not have an advertising business, and we never will.
3. Children's Privacy
Our Years Together is intended for use by parents and guardians on behalf of their children; it is not directed at children, and children do not create their own accounts. Video diaries are owned and controlled by the parent or guardian who creates them, and only that account holder decides when — and whether — a diary is ever shared or gifted to the child it was made for.
We are committed to complying with the Children's Online Privacy Protection Act (COPPA) and equivalent regulations. [Add specifics here: consent mechanisms, data minimization for child profile fields, and how a parent can review or delete their child's information.]
4. How We Protect Your Information
Security is foundational to how we operate, not an afterthought. Uploads are transmitted over HTTPS and encrypted at rest using bank-grade AES-256 encryption with per-diary keys. Decryption keys are themselves encrypted and stored separately from the content they protect, using AWS Key Management Service (KMS), in a different account than our application backend. We maintain redundant backups across multiple geographically distributed data centers.
No method of storage or transmission is 100% secure, and we cannot guarantee absolute security — but we design every layer of this system around the assumption that your family's memories deserve bank-level protection.
5. Data Sharing and Third-Party Service Providers
We do not sell your personal information or your family's content, ever. We share information only with:
- Service providers who help us operate the product (for example, cloud storage, payment processing, and email delivery), under contracts that limit their use of your data to providing that service.
- Contributors you explicitly invite to a diary, limited to what you choose to share with them.
- Law enforcement or regulators, only when required by valid legal process.
[List specific sub-processors here, e.g. hosting provider, payment processor, email/SMS provider.]
6. Data Retention and Deletion
We retain your account information and diary content for as long as your account is active, so that it remains available for you to add to and eventually gift. If you close your account, [describe retention/deletion timeline after account closure]. You can request deletion of your account and content at any time by contacting support@ouryearstogether.com.
If Our Years Together were ever to wind down operations, affected users would receive advance notice (minimum 12 months) and tools to export their full collection before any data is deleted.
7. Your Rights and Choices
Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. [Add region-specific rights here, e.g. GDPR for EU/UK users, CCPA/CPRA for California residents.] To exercise any of these rights, contact us at support@ouryearstogether.com.
8. Cookies and Tracking Technologies
[Describe any cookies, local storage, or analytics tools used on the site and in the app, and how users can manage preferences.]
9. International Data Transfers
[Describe where data is stored/processed and, if applicable, the legal mechanism for transferring data internationally, e.g. Standard Contractual Clauses.]
10. Changes to This Policy
We may update this policy from time to time. If we make material changes, we will notify account holders by email and update the "Last updated" date above before the changes take effect.
11. Contact Us
Questions about this policy or your data can be sent to support@ouryearstogether.com.
[Add legal entity name and mailing address here.]