Privacy Policy

Effective Date: June 19, 2026

Last Updated: July 29, 2026

This Privacy Policy explains how Heirloom ("Heirloom," "we," "us," or "our") collects, uses, and protects information when you use heirloomslides.com (the "Service").

We built Heirloom to handle some of your most personal content — photos of weddings, memorials, milestones, and family. We take that seriously. This policy is written to be genuinely readable, not just legally defensive.

1. Information We Collect

Content you upload. When you use Heirloom, you upload photos and music files so we can generate your slideshow video. This may include images of you, your family, friends, or other identifiable people, depending on what you choose to upload.

Google Drive / Google Photos (optional). Instead of uploading from your device, you can choose to import photos from Google Drive or Google Photos. If you do, Google will ask you to sign in and select the specific photos you want to bring in, using Google's own picker window. We only ever receive the exact photos you select — Heirloom never gains access to your broader Drive or Photos library, your other files, or anything you don't explicitly choose in that picker. Photos imported this way are then treated exactly like any other photo you upload — see "How We Use Information" and "How Long We Keep Your Information" below for how they're handled and retained. Heirloom's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See Section 8 ("Data Security") for how this data is protected.

Payment information. When you purchase a full-quality download, payment is handled by our payment processor, Stripe. We do not collect or store your full credit card number, CVV, or other sensitive payment details — Stripe processes that directly. We may receive limited transaction information from Stripe (such as confirmation that payment succeeded, the amount charged, and a transaction ID).

Usage and technical information. Like most websites, we may automatically collect some technical information when you use the Service, such as your IP address, browser type, device type, and general usage patterns (e.g., which step of the process you're on, whether a render succeeded).

Analytics. We use two analytics systems. The first is our own privacy-friendly, cookieless system: we measure aggregate activity such as pages viewed and general device type by converting your IP address and browser into a scrambled code using a key that is rotated daily and never stored alongside your IP, so it cannot be traced back to you or linked across days. The second is PostHog, a third-party analytics provider we use to understand how visitors navigate the site (for example, which pages are viewed, general click behavior, and technical details like browser, device, and approximate location derived from IP address). We share your IP address and browser/device information with PostHog for this purpose, and it may set a cookie or use similar browser storage to recognize repeat visits — see Sections 4 and 5 for more detail. PostHog also records a replay of on-screen activity (mouse movement, clicks, and page navigation) to help us see where people run into trouble. We've specifically configured it to never capture your uploaded photos, your finished video, or anything typed into a text field (title cards, your email address, feedback, etc.) — those are blocked from the recording at a technical level, not just by policy. Neither analytics system ever has access to the content of your photos or music, and we do not use either to track you across other, unrelated websites.

Optional contact email. If you choose our optional “email me when it’s ready” feature, you provide an email address. We use it solely to send you a notification (with a link back to your project) when your slideshow or HD download is finished. It’s never required to use the Service, and we don’t use it for marketing.

2. How We Use Information

We use the information we collect to:

• Generate the slideshow video you requested
• Process your payment
• Operate, maintain, and improve the Service
• Understand usage patterns through analytics
• Communicate with you if you contact us for support
• Detect, prevent, and address technical issues, fraud, or abuse
• Comply with legal obligations

We do not sell your personal information or your uploaded content to third parties. We do not use your uploaded photos or music for any purpose other than generating the video you requested, unless you separately give us permission (for example, if you ever opt in to something like a testimonial or showcase feature).

3. How Long We Keep Your Information

Unpurchased projects. The photos, music, and video tied to a project you have not purchased are automatically deleted after approximately 14 days of inactivity (no visits to your project link). Returning to your project resets this window, so an actively-used project can persist for as long as you keep coming back to it. Once an unpurchased project is deleted, we do not keep copies and cannot recover it.

Purchased Heirlooms. When you buy your Heirloom, we keep it indefinitely — the finished video along with the photos and music in it — so you can return to your private link and re-download it at any time. We do this so a keepsake you paid for is there when you need it. You can ask us to delete a purchased Heirloom at any time (see “Your Choices and Rights” below); deletion is permanent and cannot be undone.

Payment/transaction records may be retained longer than this, as required for accounting, tax, and legal purposes, consistent with standard business recordkeeping practices.

Heirloom does not use accounts, logins, or passwords. Instead, each project is accessible via a unique, private link generated when you start. This link — not an email or login — is what grants access to your project, including re-downloading a purchased video later. Because of this, your project link should be treated as sensitive: anyone who has it can access that project's content. We don't require an email, name, or login to use the Service. (If you opt into the “email me when it’s ready” notification, we store the email address you provide for that single purpose, as described in Section 1. Any information collected during payment is handled by Stripe as described above.)

(If we introduce optional accounts or saved-project history in the future, this policy will be updated to reflect how that data is handled before that feature goes live.)

4. Who We Share Information With

We share information only with the third-party services that help us operate Heirloom:

• Stripe (payment processing) — handles your payment information directly. See Stripe's own privacy policy for details on how they handle payment data.
• Hosting/infrastructure providers — the servers that store your uploads temporarily and run the video-generation process.
• Email delivery (Resend) — if you opt into a ready notification, the email address you provide is processed by our email provider solely to deliver that one message.
• PostHog (analytics) — helps us understand how visitors use the site, as described in Section 1. PostHog receives your IP address, browser/device information, and page-navigation activity; it never receives your photos, music, or project content. See PostHog's own privacy policy for details on how they handle this data.

We do not use advertising companies or ad-tracking networks, and we do not sell or share information for advertising purposes. Our own first-party analytics remain cookieless and stay entirely on our servers, as described in Section 1; PostHog is the only third-party analytics service we use.

If you use the optional Google Drive or Google Photos import feature described in Section 1, we do not share, sell, or transfer the photos you select — or any other Google user data — to any third party, and we do not use that data for advertising or for any purpose beyond generating the slideshow you requested.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

We may disclose information if required by law, subpoena, or legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Cookies & Local Storage

Our own first-party analytics remain cookieless, as described in Section 1. Our third-party analytics provider, PostHog, does use a cookie or similar browser storage to recognize repeat visits to the site. This is not used for advertising or for tracking you across other, unrelated websites. You can block it through your browser's cookie or privacy settings without affecting your ability to create or purchase a Heirloom.

We also store a small amount of information in your browser's local storage — specifically a private link/identifier for your current project — so that you can leave and return to that project on the same browser without creating an account. This information stays on your device; it is not an advertising or cross-site tracking identifier. You can remove it at any time by choosing “Start fresh” when you return, or by clearing your browser's site data. You can control cookies and local storage through your browser settings; disabling them may affect some functionality, including the ability to resume a project where you left off.

6. Your Rights & Choices

Depending on where you live, you may have rights regarding your personal information, such as the right to:

• Request access to the information we hold about you
• Request deletion of your information
• Object to or restrict certain processing

Unpurchased projects are automatically deleted after about 14 days of inactivity, so in most cases there will be little or nothing left shortly after you stop using one. Purchased Heirlooms are kept indefinitely so you can re-download them — but you remain in control: if you'd like any project deleted, whether unpurchased or purchased, contact us at help@heirloomslides.com with your project link and we'll delete it on request. Deletion is permanent and cannot be undone.

If you are located in the EU/UK or California, you may have additional specific rights under GDPR or CCPA, respectively. Contact us and we'll do our best to accommodate applicable requests.

7. Children's Privacy

Heirloom is not directed at, and is not intended for use by, anyone under 18. We don't knowingly collect personal information from children. If you believe a child has used the Service or provided us with information, please contact us at help@heirloomslides.com so we can address it.

(Note: photos of children uploaded by an adult user, e.g. for a family slideshow, are expected and fine — this section is about who is permitted to use and operate the Service itself.)

8. Data Security

We take reasonable measures to protect the information you provide, including the following:

• Encryption in transit. All communication with heirloomslides.com — including uploads, Google Drive/Photos imports, and downloads — is encrypted using HTTPS/TLS.
• Encryption at rest. Photos, music, and finished videos (including anything imported from Google Drive or Google Photos) are stored in Cloudflare R2, which encrypts stored data at rest.
• Access control. We don't use accounts or passwords. Instead, each project is protected by a private, unguessable link (see Section 3) rather than being broadly accessible, and our infrastructure only retrieves the specific files needed to build or serve your project.
• Limited retention. Unpurchased projects — including any photos imported via Google Drive or Google Photos — are automatically and permanently deleted after about 14 days of inactivity, as described in Section 3, minimizing how long sensitive data is retained.

However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. International Users

Heirloom is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data protection laws than your country.

10. Changes to This Policy

We may update this Privacy Policy from time to time, including as our features change (for example, if we introduce user accounts). We'll update the "Last Updated" date above when we do. Material changes will be reflected here before they take effect.

11. Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us at help@heirloomslides.com.

Heirloom is operated by Brett Goldfarb as a sole proprietorship.