Privacy Policy

Who we are. LifeMantle is a private, invite-only family memory service. A parent or guardian creates a private “space” for their child and invites family members.

What we collect

• Account data: name, email, password (hashed), and optional profile photo.
• Content you add: photos, timeline entries, milestones, growth measurements, calendar events, comments, reactions, and letters.
• Technical data needed to run the service (log/security data, device/browser info).
• Essential cookies: a session cookie to keep you signed in, a small cookie to remember your language and which universe you’re viewing, and Cloudflare’s anti-bot cookie. We do not use advertising or third-party tracking cookies.

Children’s data (important)

Spaces are about children, and only a parent or guardian may create a space and consent, on the child’s behalf, to the collection of that child’s photos and information. Account holders must be adults — you must be 18 or older to create an account or a space. We do not knowingly allow children to create their own accounts, and we do not knowingly collect personal information directly from a child under 13. If you believe a child created an account, contact us and we will delete it.

Who can access your content

Your space is private to its invited members. Be aware of the honest technical reality (see our Security page):

• Letters are end-to-end encrypted in your browser; LifeMantle’s servers store only unreadable ciphertext and cannot read them. As a safety net, the space owner holds a recovery key and can recover any letter if a family member ever loses their passphrase.
• All other content (photos, timeline, growth, feed) is encrypted in transit and at rest, but is technically readable by our systems/operators to provide the service. It is never sold or shared for advertising.
• Direct messages (1:1) are visible only to the two people in the conversation — not to other members or to space admins.

Sub-processors

We use Supabase (database, authentication, file storage), Netlify (hosting), and Cloudflare (network, anti-bot/Turnstile, and encrypted off-site backup storage). We use Resend to send transactional email (invitations, notifications, digests) and Sentry for error monitoring. If billing is enabled, Stripe processes payments (we never store card numbers). These providers process data only to help us run the Service, under their own security and privacy commitments; we do not sell your data to anyone.

Your rights

You can export all of your space’s data at any time, and you can request deletion of your account and data. Depending on where you live (e.g. EU/UK GDPR, California CCPA), you may have additional rights to access, correct, or delete your data.

Retention

We keep your content for as long as your account and space are active. If a paid subscription lapses, the space becomes read-only (you can still view and export everything) and is retained for one year, during which you can reactivate, export, or delete it. After that period an unpaid space becomes eligible for permanent deletion, preceded by advance-warning emails. Complimentary (comped) spaces are never auto-deleted. Deleting content or your account removes it from the live service, except for copies that persist transiently in routine backups.

Contact

Questions or privacy requests (access, correction, deletion): privacy@lifemantle.com.