Built to protect the people inside.

1. Who we are

DearestEllie (dearestellie.org) is a private family memory archive, run as a mission-locked nonprofit commons. This policy explains what information we collect when you use DearestEllie, how we use it, who we share it with, and the rights you have over it.

If anything here is unclear, or you want to exercise any of the rights described below, write to [email protected]. A person reads every message.

2. Information we collect

We collect only what the service needs to work:

• Account information — your name, email address, and a securely hashed password (we never store your password itself).
• Archive content — the memories, photos, videos, audio, letters, timelines, and other material you and your invited contributors choose to add. This is the heart of the service, and it is private by default.
• People and invitations — the names and email addresses of people you invite to an archive, the role you give them, and their contributions and approvals.
• Order details — if you make a contribution, we keep the contribution record and payment status. Past printed-keepsake orders (no longer offered) keep their order record: what was ordered, the shipping name and address provided, and payment status. We never see or store your full card number (see section 5).
• Technical records — server logs (such as IP address, browser type, and pages requested) kept for security, abuse prevention, and rate limiting, plus an audit trail of sensitive actions inside an archive (like approvals, exports, and deletions) so stewards can see what happened.

3. How we use information

We use the information above to:

• Provide the service — store your archive, show it only to the people you've chosen, and generate the exports and keepsakes you ask for.
• Keep accounts safe — authenticate you, detect abuse, enforce rate limits, and invalidate sessions when a password changes.
• Send the email you'd expect — invitations you initiate, password resets you request, and notifications about activity in your archives. We don't add you to marketing lists you didn't ask for.
• Run the commons — understand aggregate service health (never advertising profiles) and meet our legal and nonprofit-accountability obligations.
• Support research, only if you choose it — a steward may optionally donate an archive to approved memory and remembrance research, named or de-identified. This is off by default, never happens without a steward's explicit consent, and can be revoked at any time.

4. What we never do

• We never sell your data, to anyone, for any reason.
• We never show ads or share your information with advertisers or data brokers.
• We never use third-party analytics or tracking scripts — the only cookie we set is our own session cookie (see section 6).
• We never train AI models on your private content, and AI features stay off until a steward explicitly turns them on.
• We never make remembrance depend on payment — privacy, access, and export are free, always.

5. Service providers we share with

We share the minimum necessary with a small number of processors, each only for the purpose named here:

• Payments — voluntary contributions are processed by Stripe. Your card details go directly to Stripe and never touch our servers; we receive only payment status and the details needed for the receipt.
• Retired print fulfillment — printed keepsakes are no longer offered. For orders placed before the retirement, the print file and the recipient's name and shipping address went to our print partner (Prodigi) so the order could be produced and delivered; those historical records remain covered by this policy.
• Email delivery — transactional email (invitations, password resets, notifications) is delivered through an email provider, which handles the recipient address and message content in transit.
• AI assistance — if, and only if, an archive's steward turns on the Family Archivist, the content it works with is processed by our AI provider under terms that prohibit training on it. We record who consented and when, and AI-assisted content is clearly marked.

6. Cookies

We set one first-party cookie, family_session, which keeps you signed in. It exists so the service can work, not to track you. We use no advertising cookies, no cross-site tracking, and no third-party analytics. If you block the cookie, the public parts of the site still work; signing in does not.

7. How long we keep things

Archive content stays for as long as the archive exists — that is the point of the service. When you delete a memory, an archive, or your account, the content is permanently removed from the live service; residual copies in encrypted backups age out on our backup rotation shortly after. We keep order and payment records, and the audit trail of sensitive actions, for as long as accounting rules and the safety of the archive require.

8. Your rights

Wherever you live — including under the GDPR, UK GDPR, and CCPA where they apply — you can:

• Access and export — download everything in your archive at any time, in an open, documented format, from the archive's export page. No request form required.
• Correct — edit or update anything you've added, at any time.
• Delete — remove individual entries, whole archives, or your account from your settings. Account deletion is blocked only while you are the sole steward of an archive, so a family never loses their archive when you go; export or hand off stewardship first.
• Object or complain — write to [email protected] about any use of your data. If you're in the EU or UK you can also contact your local data-protection authority, but we'd like the chance to fix it first.

9. If you appear in someone else's archive

Family archives are, by nature, about more than one person. If content about you appears in an archive you don't control — a photo that shouldn't be public, or something shared without your consent — write to [email protected] with a link and what concerns you. A person reads every report, and our acceptable-use rules require consent where it matters.

10. Children's privacy

A contributor marked as a child never has their memories shared until a named guardian approves. We don't ask children for more than the memory they want to share, and a steward reviews everything before it appears.

Children take part in DearestEllie only as invited contributors under a named guardian's supervision — they do not create their own accounts. We collect from a child only the memory they choose to share and the minimum needed to attribute it, and a guardian's approval is required before it is seen more widely.

11. Security

All traffic is encrypted with TLS. Media is stored encrypted at rest. Passwords are hashed, sessions are invalidated when a password changes, and access to every piece of content is checked against the archive's permission model on every request. No system is perfect; if we ever learn of a breach that affects your data, we will tell you promptly and honestly.

12. Changes to this policy

If we change this policy in any material way, we will give reasonable notice before the change takes effect — on this page and, for significant changes, by email. We will never use a policy change to quietly claim rights over your family's content.

13. Contact

Questions, requests, or concerns about privacy: [email protected]. We're a small team; the honest promise is a reply within days, not minutes.