Deara Privacy Policy

1. Key terms

• Memory. Content you keep in Deara: text, voice recordings, photos, videos, and the details attached to them, such as date, tags, and which child a Memory is about.
• Archive. The private space where a family's Memories are kept.
• Contributor. A person the Archive owner invites to add Memories to an Archive.
• Transcript. The machine-generated transcript of an audio recording, including any corrections you make after transcription, preserved separately as a source record.
• Source Materials. The original audio recording, the raw text you type, and the preserved Transcript associated with a Memory, kept as the authoritative record.
• Outputs. Derivative materials Deara generates from Source Materials, such as generated titles, Monthly Letters, and Keepsakes. Outputs may include text, formatted documents, and, if we introduce such features, audio or visual renderings created from your Source Materials. Outputs do not replace Source Materials.

2. Information we collect

Using Deara without signing in. You can use Deara without signing in. When you first use the app, Deara assigns an account identifier to you, and your Archive and Memories are kept on Deara's servers under that identifier, with the same protections described in this Policy. That identifier and the content connected to it are personal information under some laws even before you sign in. Signing in later connects this existing account to your sign-in identity so you can reach your Archive from another device or after reinstalling the app; it does not create a separate copy of your data. If you never sign in and you lose access to your device, we may not be able to verify which account is yours or restore access to it.

Information you provide.

• Account information: if you choose to sign in, your name, email address, and the authentication information and identifiers used to sign you in, including information provided through Sign in with Apple.
• Memories: the text you write, voice recordings you make, and photos and videos you add, together with the details you attach to them.
• Child profile information: a child's name, birth month and year, and a photo if you choose to add one. This information is provided by you, the adult account holder, not by the child.
• Family and language details: the languages spoken in your family and the reading language you choose for Monthly Letters.
• Future Delivery content: Memories you seal, the unlock date you select, and the recipient you designate within the Service.
• Invitations: the contact details you use to invite a Contributor, and the status of each invitation.
• Imported content: if you connect another service or import content from it, the content and details you choose to import.
• Communications: messages and attachments you send to our support.

Information generated when you use the Service.

• Transcripts and Outputs: the original audio recording and raw typed text are preserved as authoritative Source Materials. Where voice transcription is used, the Transcript is preserved separately as a source record. Generated titles, Monthly Letters, Keepsakes, and other shaped or AI-assisted materials are derivative Outputs and do not replace the Source Materials.
• Derived details: limited information computed from your content, such as a child's approximate age at the time of a Memory.
• Attribution details: the author of each Memory, including a snapshot of the display name at the time the Memory was kept, and each person's role in an Archive.

Information collected automatically.

• Device and app information: device model, operating system version, app version, language, time zone, and identifiers needed to operate the app and deliver notifications, such as a push token.
• Usage and diagnostics: interactions with app features, crash logs, and performance data.
• Technical and security records: IP address, authentication tokens and internal account identifiers, access and security event logs, notification and email delivery status, permission and consent records (including the version accepted and a timestamp), and metadata about AI requests and responses, such as request identifiers, timestamps, the provider used, and processing status.
• Subscription information: your plan, subscription status, renewal or expiration status, and transaction identifiers provided through Apple and our subscription infrastructure. Payments are processed by Apple. Deara does not receive your card number or bank details.
• Marketing measurement: if you installed Deara after seeing one of our ads, we may receive an attribution token or privacy-preserving measurement signal from the platform, such as Apple's attribution service. This does not identify the content of your Memories.

Deara does not request or collect your device's precise location. Location metadata is removed from media before it is uploaded to the Service. We do not sell personal information. Section 8 describes how we share information and our position on advertising.

3. Information about people who do not have a Deara account

Some information in Deara is provided by our users about people who may not have their own Deara account:

• a person invited to become a Contributor (name, contact details, and invitation status);
• a child or another family member who appears in Memories (their name, image, voice, or details of events involving them).

This information is provided by the user and is processed only for the applicable purposes described in this Policy, including keeping and rendering Memories, delivering invitations, and providing the features the user requests. It is kept as described in Section 9. Invitations sent through Deara include a short privacy notice with a link to this Policy.

If you are such a person and wish to ask about, object to, or request deletion of information concerning you, contact us at privacy@deara.app. We will respond in accordance with applicable law, taking into account applicable legal exemptions and the rights of the user who keeps the Memory. Where applicable law requires Deara to provide a separate notice to a person whose information was supplied by another user, Deara will provide that notice using the contact information reasonably available to it, subject to applicable exemptions.

4. Children

Deara is designed for adults keeping memories about their families. You must be at least 18 years old to create an account. The Service is not directed to children, and we do not knowingly collect personal information directly from children.

Information about children in Deara is provided by adult account holders. When you add information about a child, you confirm that you are the child's parent or legal guardian, or that you have the guardian's permission.

If we receive credible information that an account has been created by a child, or that information about a child may have been added without appropriate authority, we may restrict access to the relevant information while we review the matter, request information reasonably necessary to verify the relevant authority, and delete or otherwise act on the information where required or permitted by law. Deara does not determine parental responsibility and does not adjudicate custody, guardianship, family-law, or ownership disputes.

A parent or guardian may contact us at privacy@deara.app regarding a child's information.

5. Sensitive and biometric information

Deara does not ask for or require sensitive information. Because Memories are free-form, the content you choose to keep may incidentally contain sensitive or special-category information about you or your family, for example information relating to health, development, religion, or ethnicity, that you voluntarily include. Deara does not use sensitive information to infer characteristics about you for advertising purposes, create advertising profiles, or target third-party advertising. It is processed only as reasonably necessary to provide the features you request, secure and support the Service, comply with law, and exercise or defend legal rights, and the safeguards described in this Policy apply to all Memory content. Where Deara knowingly processes sensitive information for a defined feature and applicable law requires additional consent, a specific legal basis, or additional safeguards, Deara will apply the applicable requirements.

Where applicable law requires a specific basis for processing sensitive or special-category information that you include, we rely on your explicit consent, which you give by choosing to include that information in a Memory and can withdraw by editing or deleting the Memory. When the information concerns your child, you give that consent as the child's parent or guardian.

Biometric identifiers. Deara does not use facial recognition or voice-based identification to determine who a person is. Transcription converts speech into text; it is not used to identify anyone. If we introduce a feature that would use biometric identifiers, we will provide notice and obtain any consent required by law before enabling it.

6. How we use information

We use personal information to:

• Provide the Service: keep your Memories, maintain your Archive, sync across your devices, and operate the sharing you set up with people you invite.
• Create Outputs: transcribe your voice recordings and generate Monthly Letters and Keepsakes, as described in Section 7.
• Operate Future Delivery: keep sealed Memories until the future date you select, unlock the content on that date, and notify the creator that the content is available. Future Delivery is a storage and reminder feature. Deara does not guarantee that a notification will be delivered, received, opened, or acted upon. Where a Future Delivery is associated with another Deara user, the intended recipient may be resolved using the account information available within the Service at the time the content unlocks.
• Personalize Deara for your family: for example, by suggesting prompts or reminders based on a child's age or the Memories you have kept. This uses information Deara already holds and is not used for third-party advertising.
• Manage subscriptions: determine your plan, limits, and entitlements.
• Send notifications: the transactional, family-activity, and optional reminder notifications enabled for your account, subject to your notification settings.
• Communicate about Deara: show you messages in the app, and send you emails, about Deara's plans, features, and offers, as permitted by law and as described in Section 14.
• Measure our own marketing: understand which of our marketing efforts led people to Deara, using the measurement signals described in Section 2.
• Provide support and respond to your requests.
• Research: with your permission, invite you to take part in research such as interviews or surveys.
• Keep the Service secure: prevent fraud, abuse, and unauthorized access, and maintain records needed for security and integrity.
• Comply with law and enforce our Terms of Use.
• Operate, troubleshoot, and improve the Service using usage, diagnostic, security, and performance information. We do not use the content of Memories to create profiles for third-party advertising.

Authorized Deara personnel may access the content of Memories only when needed to provide support you request, investigate abuse or a security incident, comply with law, or diagnose a specific problem, subject to access controls and confidentiality obligations.

Deara does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Legal bases (EEA, UK, Switzerland).

Where the GDPR or equivalent laws apply, we rely on the bases below. An operating-system permission (for example, microphone or notification access) is a device-level control and is separate from the legal basis for processing.

Where we rely on legitimate interests, our interests are operating, securing, and improving a service you have chosen to use and telling you about it. You can object to processing based on legitimate interests as described in Section 10.

7. AI processing and your permission

Some features of Deara use artificial intelligence. Voice recordings are transcribed into text, and Monthly Letters and Keepsakes are generated from the Memories you select or that match a given period.

How AI processing works.

• AI processing supports your content; it does not replace it. Deara is designed to preserve Source Materials separately from Outputs while the associated Memory remains in your active account. Outputs do not overwrite the corresponding Source Materials.
• Outputs are generated from your Source Materials and may contain mistakes. Your Source Materials are always kept separately so you can check an Output against them.
• AI transcription and generation are performed by third-party providers acting on our documented instructions. The current providers, the categories of content sent to each, the feature each supports, and each provider's retention practices are listed at https://deara.app/subprocessors.

Your permission.

Before the first transmission of your Memory content to a third-party AI or transcription provider for a particular purpose, Deara will identify the provider by name, disclose the categories of content to be transmitted and the purpose of the transmission, and provide access to current information about how the provider handles your content. Deara will request your explicit permission before that transmission occurs. If you decline, the relevant AI-assisted feature will not process or transmit that content. Where more than one provider may be used for a feature, the provider actually used for the transmission is the one identified. We may request renewed permission if the provider, the purpose, the categories of information, or the relevant data-use terms materially change.

You can withdraw your permission at any time in Settings or by contacting us at privacy@deara.app. Withdrawal stops future transmissions and does not affect processing that has already taken place.

8. How we share information

We share personal information only as described below. We do not sell personal information, and we do not currently share it for cross-context behavioral or targeted advertising or use the content of your Memories to build advertising profiles. If that changes, we will update this Policy and provide any notice, choice, or opt-out required by law before the change applies.

• Within your Archive. Memories are visible to the people who have access to the Archive under the sharing rules shown in the app. Future Delivery content is private to its creator until its unlock date. Memories added by a Contributor are visible within the Archive with attribution.
• Service providers. Companies that support the Service, in each case under data-protection agreements limiting their use of your information to providing services to us and requiring protection consistent with this Policy. These providers currently fall into the following categories: cloud hosting and storage; authentication; AI transcription and generation (Section 7 and https://deara.app/subprocessors); notification and email delivery; subscription infrastructure; analytics, performance, and crash reporting; and website, waitlist, and support infrastructure. We may add providers in categories such as customer support tools, security and fraud prevention, location and place lookup, and marketing attribution and measurement. Current AI providers are named, and provider categories are described, on the providers page.
• Apple. Purchases and certain platform features are provided by Apple under Apple's own terms and privacy policy.
• Sharing features and referrals. If we introduce ways to share a Memory or Output outside your Archive, such as a link, anyone who receives it can view what it contains, and the app will explain the sharing scope when you use the feature. If we offer referral or invitation programs, we process the information needed to send the invitation, attribute the referral, and apply any reward, and the person you invite sees your name as the inviter.
• Legal reasons. Where required by law, legal process, or a governmental request, or where reasonably necessary to protect the rights, safety, or property of you, others, or Deara, or to detect, prevent, or address fraud or security issues.
• Business transfers. If Deara Labs LLC is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to the protections of this Policy. We will provide notice of a change in the controller where and as required by applicable law.
• At your direction. When you export your content or share it outside Deara, for example a Keepsake PDF shared through the iOS share sheet, you decide who receives it. Copies that leave the Service are outside Deara's control.

9. Retention and deletion

We keep personal information only for as long as it is needed for the purposes described in this Policy. Retention differs by category:

• Memories and Archive content: kept while the Archive they belong to exists, unless the content is deleted by an authorized user, removed as required by law, or otherwise handled as described in this Section. When you delete an individual Memory, it is removed from active production systems within the period shown in the in-app deletion confirmation.
• Account deletion: available in the app. When you delete your account, your personal account information and content associated solely with your account are removed from active production systems within the period shown at the time of deletion. Memories contributed to another person's Archive may remain as described under "Contributors" below. Residual encrypted copies may remain in backups for a limited period until those backups are overwritten or expire.
• Sealed Future Deliveries: kept until the unlock date you chose and, after that, as Memories. When you delete your account, sealed Future Deliveries you created are permanently canceled and deleted with it. The account deletion screen states this outcome before you confirm.
• Invitations: pending invitations that are not accepted are deleted after 60 days.
• Usage and diagnostic information: kept for as long as needed to operate, troubleshoot, and improve the Service, and no longer than the retention periods configured with our analytics and crash-reporting providers.
• Consent and permission records (including version and timestamp), policy acceptance records, subscription and transaction records, security and access logs, and fraud- and abuse-related records: kept for as long as necessary for security, legal compliance, dispute resolution, and enforcement of our agreements. Security and access logs are generally kept no longer than 24 months, except where an investigation, dispute, or legal obligation requires longer.
• Support requests and attachments: kept for 24 months after resolution.
• Content transmitted to AI providers: retained by each provider as described at https://deara.app/subprocessors.
• Information subject to a legal hold: kept until the hold ends.

Contributors.

Memories a Contributor keeps in an Archive become part of that Archive and may remain there after the Contributor loses access or deletes their account, as described below. This contribution rule is presented to and accepted by the Contributor when they accept the invitation.

• If a Contributor's access to an Archive is removed, Memories they added remain in the Archive unless they are deleted by the Archive owner or removal is otherwise required. Their attribution remains visible.
• If a Contributor deletes their Deara account, their personal account information is deleted as described above. Memories they added remain in the Archives where they were kept. The displayed name and direct connection to the deleted account are removed, and the Memory may be shown using a generic attribution such as "a family member." The account deletion screen explains this result before deletion is confirmed.
• Where applicable law gives a former Contributor a right to erasure of content that includes their own personal information, we will assess the request, taking into account the rights of the Archive owner and other family members and any legal exemptions.

We may retain de-identified or aggregated information that does not identify you, including for statistics we publish about Deara.

10. Your rights and choices

The app provides controls appropriate to your role. You can manage your Memories, delete your account, manage notifications, and use available export controls. Archive owners can also manage access to their Archives.

Depending on where you live, you may also have legal rights to access, correct, delete, or receive a copy of your personal information in a portable format, to object to or restrict certain processing, including processing based on legitimate interests, and to withdraw consent where processing is based on consent. Withdrawing consent does not affect processing that took place before withdrawal.

• EEA, UK, Switzerland. You have the rights provided by the GDPR and equivalent laws, and the right to lodge a complaint with your supervisory authority. We would welcome the chance to address your concern first at privacy@deara.app.
• Türkiye. If the Service is made available in Türkiye, you have the rights listed in Article 11 of Law No. 6698 (KVKK), including the right to learn whether your personal data is processed, to request information, correction, and deletion, and to object to a result produced exclusively by automated analysis.
• United States. Depending on your state, you may have rights to know, correct, delete, and port personal information, and to opt out of the sale or sharing of personal information or its use for targeted advertising or certain profiling. Deara does not sell personal information and does not currently share it for cross-context behavioral or targeted advertising.

To exercise any of these rights, use the controls in the app or contact us at privacy@deara.app. We will verify your request and respond within the time required by applicable law. Where the law permits, you may use an authorized agent. If we decline a request, you may ask us to reconsider by replying to our response, and, depending on where you live, you may complain to your data-protection authority. We will not discriminate against you for exercising your rights.

Tracking signals. Deara does not track you across other companies' apps or websites and does not currently respond to browser Do Not Track signals, which have no standard meaning. Our service providers collect information through Deara only to provide services to Deara and not to build profiles of your activity across other apps or websites. Where applicable law requires it, we honor recognized opt-out preference signals such as Global Privacy Control.

11. International transfers

Deara Labs LLC is based in the United States, and personal information is processed in the United States and in countries where our service providers operate. Where the law of your country restricts transfers of personal information, we rely on legally recognized safeguards, which may include standard contractual clauses in our agreements with service providers and, where a provider is certified, the EU-US Data Privacy Framework and its UK extension. You can request a summary of the safeguards that apply to a particular transfer at privacy@deara.app.

12. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including encryption of content in transit and at rest and access controls for Deara personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your device and sign-in method secure.

13. Your responsibilities

Deara keeps what you choose to put in it. When you add content about another person, including a child or a family member, you confirm that you have the right or the necessary permission to do so. You should not include sensitive information about another person unless you have the authority or permission required to do so. When you invite a Contributor or share content, you decide who can see your family's Memories; invite only people you trust. Once you share content outside Deara or authorize another person to access it, that person's subsequent handling of the content may be outside Deara's control.

14. Communications

Service messages, such as invitations you send, account and subscription notices, and Future Delivery unlock notifications, are part of operating the Service. Push notifications require your permission and can be turned off at any time in iOS Settings or in the app. We may also show you messages in the app, and send you emails, about Deara's plans, features, and offers, as permitted by law. Marketing emails include an unsubscribe link. These messages are not based on the content of your Memories.

15. Third-party services

The Service works with platforms and features we do not control, such as the App Store, Sign in with Apple, and the iOS share sheet. Their handling of your information is governed by their own terms and privacy policies.

16. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will provide notice appropriate to the significance of the changes and as required by applicable law, and where the law requires consent for a new use of your information, we will ask for it. The effective date above shows when the current version took effect.

17. Contact

Deara Labs LLC

777 Brickell Avenue, Suite 500, No. 94591, Miami, Florida 33131, United States

privacy@deara.app

Our privacy contact is responsible for Deara's compliance with this Policy and, for residents of Canada, is the person in charge of the protection of personal information.

If the Service is made available in Türkiye, requests under KVKK may be sent to privacy@deara.app.

Information practices for the Deara website and waitlist are described in our separate Website and Waitlist Privacy Notice.