Privacy Policy

1. Introduction

Welcome to Mum's Attic, a service provided by Mouthbreather LLC ("we," "our," or "us"). We respect your privacy and are committed to protecting the memories and data you share with us. This policy explains how we collect, use, share, and protect your information when you use the Mum's Attic app and website.

2. Information We Collect

• Account Information: When you register, we collect your name and email address through Firebase Authentication.
• Inventory Data: We store the photos, descriptions, voice notes, and audio stories you create and upload to your private library. This data is hosted securely in Google Firebase/Firestore and Google Cloud Storage.
• Family Connections: If you invite heirs or family members, we collect their email addresses solely to facilitate the invitation and sharing process.
• Device Permissions: The app requests access to your device camera and photo library (to photograph items or add existing photos), microphone and speech-to-text (to record audio stories and voice notes), and notification delivery (to alert you of family activity). We use these only for the features you actively choose to use.
• Purchase and Subscription Information: If you subscribe to a premium plan, our payment processor RevenueCat records your subscription status, purchase history, and a pseudonymous subscriber identifier. We do not store your payment card details.
• Analytics and Crash Data: We collect usage data, crash reports, and error reports via Firebase Analytics, Firebase Crashlytics, Firebase Performance Monitoring, and our own error reporting, to improve app stability and performance. This includes device model, OS version, app version, the screen where a problem occurred, and feature interaction events. Crash and error reports are linked to your account's internal User ID (not your name or email address) so that we can investigate problems reported to us. Usage analytics are not linked to your account.
• Push Notification Tokens: If you allow notifications, we store a device token to deliver alerts about family invitations and collection activity.
• AI-Generated Content: When you choose to use our optional AI features (AI Analysis or audio story transcription), we send the relevant item content to a third-party AI provider for processing and store the response alongside your item. See Section 6 for details.

3. How We Use Your Information

• To provide the core service of inventorying and sharing your items.
• To send account notifications, password resets, and family invitations via Postmark.
• To send marketing and product-tip emails via Brevo — only where you have opted in, and which you can unsubscribe from at any time.
• To process and manage your premium subscription via RevenueCat.
• To synchronize your data across your web, iOS, and Android devices.
• To diagnose crashes and errors, including problems you report to our support team, and to improve app performance.
• To deliver push notifications you have opted into.
• To generate item analyses and audio transcriptions when you explicitly invoke our AI features.

We do not sell your data. Your family stories and item inventories are private to you and the people you explicitly invite.

4. Data Sharing and Third Parties

We only share your data with the technical infrastructure required to run the app. Each third party is bound by their own privacy policies and, where required, data processing agreements with us:

• Google Firebase / Google Cloud — Database, file storage, authentication, analytics, performance monitoring, and crash reporting. Google Privacy Policy
• Google Cloud AI — Generative AI processing for the AI Analysis and audio transcription features. Content you submit is not used to train or improve Google's foundation models. Google Cloud AI Data Governance
• RevenueCat — Subscription and purchase management. RevenueCat Privacy Policy
• Postmark (Wildbit) — Transactional email delivery. Postmark Privacy Policy
• Brevo (Sendinblue SAS) — Marketing and lifecycle email delivery (opt-in only). We share your email, name, account level, and activity signals so we can send the promotional and tip emails you have consented to. Brevo Privacy Policy
• Family Members — Your inventory and stories are shared only with the specific individuals you choose to invite to your attic. You control this list at all times.

We do not use advertising networks or sell data to data brokers.

5. Device Permissions

You can revoke any permission at any time in your device settings. Revoking a permission disables the associated feature but does not affect the rest of the app.

6. AI Features

Mum's Attic offers two optional AI-powered features for paid subscribers:

• AI Analysis — Generates a historical background, suggested tags, and an estimated value range for an item, based on its photos, title, description, tags, and any attached audio transcription.
• Audio Story Transcription — Generates a text transcript of an audio story you have recorded.

These features run only when you explicitly invoke them on a specific item or story.

• Processor: Content is sent to Google Cloud AI, hosted in the United States. Your content is not used to train or improve the underlying AI models.
• What is stored: The AI's response is stored on your item or audio story and is deleted when you delete the underlying item or story. We also retain anonymous service-health logs (timestamps, success/failure, audio duration, photo count) that do not include your content.
• Informational only: AI outputs are for informational purposes and do not constitute professional appraisal, authentication, or valuation. AI can make mistakes.

7. Data Retention

• Account and inventory data is retained for as long as your account is active.
• Deleted items are removed from active databases within 30 days of deletion.
• Deleted accounts result in permanent removal of all personal data and inventory records from active databases within 30 days. Encrypted backups are purged within 90 days.
• Analytics and crash data is retained by Firebase for up to 14 months per Google's standard retention policy.
• AI outputs (analyses, transcripts) are deleted together with the item or story they belong to. Anonymous AI usage logs are retained for service-health monitoring.
• Subscription records are retained by RevenueCat as required by applicable financial regulations.
• Error reports that we store ourselves are deleted automatically after 30 days, or sooner if you delete your account.

8. Data Security

We use industry-standard encryption (AES-256) at rest and TLS encryption in transit. Our infrastructure is built on Google Cloud's secure backbone. Access to production data is restricted to authorized personnel only.

9. Account Deletion

You can delete your account and all associated data directly from within the app: go to Settings → Account → Delete Account. You may also request deletion by emailing support@mumsattic.com. We will complete the deletion within 30 days and confirm by email.

10. Your Rights

All Users

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may update your name or email at any time in Settings.
• Deletion: See Section 9 above.
• Portability: You may request an export of your inventory data in a standard format.

California Residents (CCPA / CPRA)

California law grants you the following additional rights:

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you and the purposes for which we use it.
• Right to Delete: You may request that we delete your personal information, subject to limited exceptions.
• Right to Correct: You may request that we correct inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at support@mumsattic.com or via the address in Section 13. We will respond within 45 days.

European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

If you are located in the EEA, UK, or Switzerland, you have the following rights under applicable data protection law:

• Lawful Basis: We process your data on the basis of contract performance (to provide the service you signed up for) and legitimate interests (analytics, diagnostics, and security). Where we rely on consent (e.g., optional notifications, optional AI features), you may withdraw it at any time by disabling notifications or by simply not invoking the AI features.
• Right of Access, Rectification, and Erasure
• Right to Restrict Processing
• Right to Data Portability
• Right to Object to processing based on legitimate interests
• Right to Lodge a Complaint with your local supervisory authority

International Transfers: Our infrastructure is hosted in the United States. If you are located outside the US, your data is transferred to and processed in the US. For EEA/UK users, these transfers are covered by Google's Standard Contractual Clauses with the European Commission. You may request a copy of these safeguards by contacting us.

To exercise your GDPR rights, contact us at support@mumsattic.com. We will respond within 30 days.

11. Children's Privacy

Mum's Attic is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information without parental consent, please contact us immediately at support@mumsattic.com and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email and by posting a notice in the app. The effective date at the top of this page reflects the date of the latest revision.

13. Contact Us

If you have questions about this policy or your data, please contact us at: