Privacy Policy

01Who this covers

This policy covers the Heirloom iPhone app and this website, heirloom.page. Cutting Edge Services LLC, a Louisiana limited liability company, publishes both and is responsible for the personal information described here — the “controller,” where a law uses that word. Heirloom is offered in the United States; if you use it from somewhere else, your information is still handled the way this policy says, in the United States.

02What stays on your iPhone

Your scans, their transcriptions, your collections and folders, your family tree, your Archivist conversations, and the Log are stored on your iPhone. They are included in your device backup if you back your iPhone up. We do not hold a copy.

03What is sent to Anthropic

Heirloom cannot read handwriting on its own. To read a page, the app sends it to Anthropic PBC, which runs the Claude models. This is the disclosure that matters most, so it is set out plainly:

What is sent

The images of the pages you scan; the transcriptions and notes already attached to a document when you ask about it; the questions you type to the Archivist; and the names and dates in your tree when they are needed to answer.

To whom

Anthropic PBC, in the United States.

Why

To transcribe handwriting, to read dates and names off a document, and to answer the questions you ask the Archivist. Nothing is sent for advertising, and nothing is sold.

What happens to it there

Anthropic processes it as our service provider, under commercial API terms that do not allow it to use your content to train models. Anthropic deletes API inputs and outputs from its systems within about thirty days of the request. Two exceptions: content flagged by Anthropic’s automated trust-and-safety systems can be retained for up to two years, and content subject to a legal obligation is retained as that obligation requires. The details are in Anthropic’s privacy policy and commercial terms.

Nothing is sent until you act. Scanning a page, asking the Archivist a question, or asking about a document is the instruction to send it — there is no background upload of your archive, and a page you never scan is never sent anywhere.

One thing worth saying about family papers specifically: they often carry sensitive things — religion in a baptismal record, health in a letter, race and ethnicity in a census sheet, and the names of living relatives. Heirloom does not ask what is in a page and does not treat one page differently from another; whatever a page carries goes only where this section says, is used only to do the reading you asked for, and is never used for advertising, profiling, or training. Think of the people in your papers when you choose what to scan — on their behalf, that choice is yours.

04Sub-processors

The complete list of third parties that see any part of your data:

Each of these processes your information to provide its part of the service to us, under terms that restrict it to that. None of them is given your information for advertising, and none of them buys it.

05The ink ledger

Heirloom keeps one server, and it does one thing: it counts ink. It never receives your pages, your transcriptions, or your questions.

What it records, exactly: a randomly generated identifier for your install; each grant of ink and each spend of it, with the token counts that priced the spend and a one-word category for what kind of work it was (a scan, a chat); timestamps; and the bookkeeping around purchases — which purchase granted which ink, and notes our own staff write when they fix a billing problem by hand. The identifier is pseudonymous rather than anonymous in the strict legal sense: it identifies your install, and it is not connected to your name, email address, or Apple Account — Heirloom has none of those to connect it to.

Your IP address reaches this server the way it reaches any server, and Cloudflare processes it to deliver the request; the ledger does not write it into its records. Ledger records are kept for as long as they are needed to account for the ink granted and spent against purchases — they are the receipts — and records of an unresolved billing problem are kept until a person resolves it. To ask for the records tied to your install to be deleted, see section 08.

06Apple’s part

Everything you buy, you buy from Apple. Apple handles the payment and tells Heirloom only whether a subscription is active. We never see your card, your address, or your Apple Account. If you back your iPhone up to iCloud, your archive goes into that backup under Apple’s terms, not ours.

07What we do not collect

There is no Heirloom account, so there is no email address, password, or profile. This website sets no cookies and runs no analytics — no page-view tracking, no advertising identifiers, no third-party scripts of any kind. The one thing the website can hold is an address you give it on purpose: if you ask to hear when Heirloom is out, we keep that one address, use it for that one email, and then delete it — write to privacy@heirloom.page to be removed sooner. The app ships no analytics and no crash-reporting software; the one third-party component it does ship is RevenueCat’s purchase software, described in section 04.

And the statement the state privacy laws ask for, in their words: we do not sell personal information, and we do not share it for cross-context behavioral advertising, and we have not done either in the preceding twelve months. We do not use or disclose sensitive personal information for any purpose other than providing the service you asked for. We do not use personal information for targeted advertising, and we do not profile you.

08Deleting your archive

Deleting a document takes its pages out of your archive; Undo brings them back for the next thirty days. Settings → Erase All Data deletes everything at once — documents, page images, conversations, tree, and settings — and offers you an export first. Deleting the Heirloom app removes the archive stored on that iPhone. If your iPhone was backed up, the archive is still in the backup until you remove it. There is no Heirloom account to close, because none was ever created.

What deletion reaches, honestly: everything on your iPhone, immediately. What was already sent to Anthropic cannot be recalled by us mid-flight, but it ages out of Anthropic’s systems on the schedule in section 03 — about thirty days — without you doing anything. The ledger’s counting records are not deleted automatically, because they are the accounting for purchases; to have the records tied to your install deleted, write to privacy@heirloom.page and we will work through it with you, keeping only what the law requires us to keep.

09Your rights

The state privacy laws give residents of a growing list of states rights over their personal information: to know what a business holds about them, to get a copy of it, to correct it, to delete it, and to opt out of its sale, of its sharing for targeted advertising, and of profiling. Those laws apply to businesses above certain size thresholds, and Heirloom may sit below them — but the honest position is simpler than the thresholds: we honor these requests from anyone, from any state, without asking which law applies.

Most of the rights, you exercise yourself, on the device: your archive is on your iPhone, so access and correction are the app itself; the export in Settings is your copy, in readable files; and deletion is section 08. What we hold server-side is the ledger described in section 05, and a request about it goes to privacy@heirloom.page.

Because there is no account, verification works differently than you may be used to: we will ask you to confirm details only your install can show — from the Settings screen — and we will not ask you for identity documents to discuss a pseudonymous ledger row. We respond within forty-five days, and we will tell you if we need longer. There is nothing to opt out of — we do not sell, share, or profile — and we will never treat you differently for asking. If you are unsatisfied with our answer, reply and say so — a person will look again — and you may also raise it with your state’s attorney general.

10Children

Heirloom is meant for adults keeping a family’s records. It is not directed at children, we do not knowingly collect personal information from a child under thirteen, and there is no account a child could create. If you believe a child has used Heirloom and information about them reached our ledger, write to privacy@heirloom.page and we will delete it.

The documents themselves are a different matter: family papers naturally describe children, sometimes living ones. That content belongs to your archive, on your iPhone, and when you scan a page it is handled the way section 03 says — it is your family record, not data we collect about a child.

11Changes to this policy

Changes get a new effective date, and superseded versions stay reachable at their own permanent addresses, the same way the terms do.

12Contact

Privacy questions go to privacy@heirloom.page. Cutting Edge Services LLC, Louisiana.