Privacy Policy

1. The short version

Legado holds some of the most personal material a family has — a relative's voice, their stories, photographs of people who are gone. We treat it that way.

We do not sell your data. We do not advertise to you. We run no analytics, tracking pixels, or third-party trackers of any kind. We do not use your family's recordings or stories to train general-purpose AI models. You can export everything you have put into Legado, or delete all of it, at any time, from Settings.

The rest of this page is the detail behind those sentences.

2. Who we are

Legado is operated by HeyLegado LLC, a Wyoming limited liability company. For any privacy question, request, or complaint, write to legal@heylegado.com — a person reads that address.

3. What we collect

Account information. Your email address, which is how you sign in. During onboarding we ask for your date of birth, because the Service is limited to adults 18 and over and we have to be able to show we checked. We store the fact that you passed that check along with the date you gave.

Your phone number, which is required to create an account. We use it so that people who already have your number can find you on Legado and send you a connection request, and we intend to use it for sign-in codes in future. You can stop it being used for finding you at any time in Settings, under "Being found", without giving the number up. We do not use it for marketing and we do not give it to anyone.

Phone numbers you ask us to check. If you use "Find people you know", the numbers you supply are compared against the accounts that exist and then discarded. We do not store them, we do not keep a copy of your address book, and there is no table in our database that holds one. The people those numbers belong to are not told that you looked, and are not added to anything.

What you create. Profiles you build, the names and relationships on your family tree, timeline entries, written stories, photographs, videos, journal entries, vision boards, personality-quiz answers, and the messages you exchange with Legado or with a persona.

Voice recordings. Audio you record or upload, and the voice models built from it. Voice is handled under stricter rules than anything else here — see Section 9.

Things other people contribute about you. Someone can record a memory about you, answer a question on your behalf, or place you on their family tree. When that happens to a profile you control, we show it to you for approval before it appears.

Usage counts. We count minutes of AI conversation, messages sent, and megabytes stored, so that we and you can both see where you stand against your plan. These are counters, not a record of what you said.

Technical basics. Ordinary web-server information — IP address, browser type, timestamps — logged transiently by our hosting providers for security and reliability. We do not build profiles from it.

4. What we do with it

We use your information to run the Service and nothing else: to sign you in, to store and show you what you have created, to build and speak a persona's voice, to transcribe your recordings so they become searchable text, to send you the notifications you asked for, to connect you with people you choose to connect with, to enforce plan limits, and to keep accounts secure.

We do not use it to advertise, to score or profile you, or to make automated decisions with legal or similarly significant effects.

5. Who else touches your data

Running Legado means using a small number of infrastructure providers. They process data on our instructions, under contract, and only to provide their service. This is the complete list:

Supabase — the database, file storage, and sign-in system. Your account, profiles, stories, photos, videos, and audio files live here.

Vercel and Render — hosting for the website and the application server. They see requests in transit.

OpenAI — powers the conversation and transcription. Text and audio you send to Legado are transmitted to OpenAI to generate a reply or a transcript. OpenAI's API terms state that data submitted through the API is not used to train their models.

ElevenLabs — builds and speaks the cloned voice. Voice recordings and voice models are held there. See Section 9.

Simli — animates a persona's face during a video call. When a profile has a photograph and you place a call, that photograph and the persona's speech audio are sent to Simli to generate the moving image. Voice-only calls do not reach it, and profiles without a photograph do not reach it.

OpenStreetMap (Nominatim) — turns coordinates into a place name. If you tap "use my location" when filling in a place, your device's approximate coordinates are sent to OpenStreetMap's public geocoding service to get back a town and state. We round the coordinates first, we send nothing else, and the feature only runs when you tap it.

Stripe — takes payments when you buy a plan. Your card details go to Stripe directly, on its pages, and we never see or store a card number. Stripe receives your email address and an account reference so it can find your subscription, and, where sales tax applies, the billing address you give at checkout.

Beyond these, we disclose information only when the law compels it — a valid subpoena, court order, or legal obligation — or where necessary to protect someone's safety. If Legado is ever acquired or merged, your information may transfer as part of that business, and this policy continues to apply until you are told otherwise.

We have never sold personal information, and we do not share it for cross-context behavioral advertising.

6. What other people can see about you

Sections 3 to 5 are about us and the companies that run our infrastructure. This section is about other people using Legado, which is a different question and worth its own answer.

Nothing on your profile is visible to another person until you or they act. A profile you create is yours. It becomes readable by someone else in three ways, all of which require a decision: you connect with them as a friend or family, you invite them to help keep a profile, or you create a share link and give it to them.

Connecting is mutual. If you accept a friend or family request, each of you can read the stories, photographs, and recordings on the other's own profile. Whether you can also add to each other's profiles is chosen by whoever sent the request, and is shown to you before you accept. You can be removed from a profile, and you can remove someone from yours.

People you may know. Where you are already connected to someone, we may show you people they are connected to, so you can find family who are already here. Such a suggestion shows a name, a profile photo, and the first name of the connection you have in common. It shows nothing else, and it never draws on profiles of people who have died or of children — only on the profiles people keep about themselves.

Being found by your phone number. Someone who already has your number can learn from Legado that you have an account, and send you a request. We think most people want that; we also know that having an account here can suggest something private about your circumstances. So it is a switch, not a rule. Settings, under "Being found", turns it off, and with it off you will not appear to anyone searching by number. People you send a link to can still reach you.

What is never shown. We do not show your email address, your phone number, your date of birth, or your plan to another person, and we do not show anyone a list of the people you are connected to.

7. Cookies

We use three cookies and no others. None of them advertise, profile you, or follow you to another website.

Your sign-in session. Set when you sign in, so the next page knows it is still you. Cleared when you sign out.

Your reading preferences. The text size and light-or-dark setting you chose, so the very first frame of a page is already the size and colour you asked for rather than flickering into it. Lasts a year.

A short-lived sign-in check used while a magic-link code is being verified.

All three are strictly necessary or set because you asked for them, which is why there is no cookie banner: there is nothing here to opt out of. If we ever add a cookie that is not in that category, we will ask first, and this section will say so before we do. A fuller explanation lives at /cookies.

8. What we deliberately do not do

There is no advertising SDK, no analytics package, no session-replay tool, no A/B testing service, and no third-party tracker embedded in Legado. We do not set advertising cookies. We do not fingerprint your device.

We do not use your family's recordings, stories, or conversations to train our own models or anyone else's general-purpose models. A persona is built from your material for your family, and it stays scoped to that profile.

9. Voice and biometric information

A voice model built from recordings is treated as biometric information under laws such as the Illinois Biometric Information Privacy Act. It carries its own published retention and destruction schedule, which you can read at /biometric-policy.

In summary: we never use voice data to identify anyone, we do not run speaker matching, we do not sell or trade voice models, and a voice model is destroyed on request, when the persona is deleted or the voice replaced, or automatically after 3 years without interaction — whichever comes first.

If you are recording another living person, you need their permission first. If your voice was used without your agreement, write to legal@heylegado.com and we will act on it.

10. How long we keep things

Content you create is kept until you delete it or delete your account — the entire point of Legado is that a family's stories outlast the moment they were told, so we do not expire them on a timer.

Voice models are the exception, and are destroyed on the schedule in Section 9.

When you delete your account, we hold the data for 30 days and then destroy it permanently. That window exists so that a deletion made in grief, or by accident, can be undone — you can cancel it from the app at any point during those 30 days. After the window closes, deletion runs automatically and cannot be reversed. Backups expire on their own cycle shortly after.

Records we are legally required to retain — such as consent and age-verification logs — may be kept longer.

11. Your rights and how to use them

Get a copy. Settings → Your data → Export. This produces a machine-readable file containing your profiles, stories, timeline entries, chats, journal, vision boards, family tree, usage records, consent records, and the memories you have sent and received.

Delete everything. Settings → Your data → Delete my account, subject to the 30-day window described above.

Correct something. You can edit any profile or entry you control directly in the app.

Refuse a contribution. Memories other people submit about you require your approval before they appear.

Depending on where you live — California, Colorado, Connecticut, Texas, Virginia, the EU or UK, among others — you may also have the right to know what we hold, to have it corrected or deleted, to receive it in a portable format, to opt out of sale or targeted advertising (we do neither), and to appeal a refusal. The tools above satisfy most of these directly. For anything they do not cover, write to legal@heylegado.com; we will respond within 45 days and will not treat you differently for asking.

12. When someone has died

Legado exists largely to hold the memory of people who are gone, so this deserves saying plainly. A profile for someone who has died is controlled by the person who created it and by the co-creators they invited. If you are a family member and believe a profile of your relative should not exist, or should be corrected or removed, write to legal@heylegado.com. We will look at it, and we will tell you what we decide.

If you want to arrange now for what happens to your own account after your death, write to us and we will document your wishes.

13. Children

Legado is for adults. You must be 18 or older to create an account or to submit any content, including through a question link. We do not knowingly collect information from anyone under 18, and we do not knowingly collect information from children under 13 in any form. If you believe a minor has given us information, contact legal@heylegado.com and we will delete it.

14. Security

Traffic is encrypted in transit. Data is encrypted at rest by our infrastructure providers. Access to a profile is enforced at the database level, so a request for someone else's material fails at the data layer rather than relying on the app to be careful. Administrative access is limited to those who need it.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your information, we will tell you and the relevant regulators as the law requires.

15. Where your data is held

Legado is operated from the United States and your information is stored and processed there. If you use the Service from outside the U.S., you are sending your information to the U.S., where privacy law differs from your own country's.

16. Changes to this policy

If we change this policy in a way that materially affects how your information is handled, we will raise the version number, update the effective date, and tell you in the app before the change takes effect. Continuing to use Legado after that means you accept the updated policy.

17. Contact

HeyLegado LLC — legal@heylegado.com. Write to us with any privacy question, request, or complaint. If you are in the EU or UK and are not satisfied with our answer, you may also complain to your local data protection authority.