Privacy policy

Muistola is in a test phase. This policy describes the service as it works today. When the service changes, we will update the policy (section 18). This English version is a translation; if the versions differ, the Finnish version applies.

1. Controller and contact details

The controller of personal data is the provider of the Muistola service:

Muistola is a small company. All privacy questions and requests are handled at [email protected]. We have not appointed a separate data protection officer; the owner of the company is responsible for privacy.

2. Whose information we handle

This policy covers the Muistola app (iPhone, Android and the browser version at app.muistola.com) and the website muistola.com. We handle information about four groups of people.

• Family members. People who create a Muistola account with an email address and a password. Usually an adult child sets up the service and invites other family members, such as siblings and grandchildren, with an invite link.
• Storytellers. Grandparents and others who tell their memories. Storytellers have no email address or password in Muistola. The family adds them and creates a six-digit joining code, and the storyteller’s phone signs in with the code using an anonymous ID.
• People mentioned in memories. Memories often talk about other people too, such as relatives, friends, neighbours and colleagues.
• Visitors to the website.

3. What information we handle

3.1 Family members

• Account details: name, email address, password, app language, when the account was created and when you signed in. The password is stored only as a hash, and nobody can see it.
• Family details: the family’s name and language, who founded the family and who belongs to it.
• What you tell us about storytellers: the storyteller’s name and relationship, for example “Mum”, and photos if you add them (section 3.7).
• Content you add: questions for the storyteller as text or voice messages, and the hearts, written comments and voice messages you send in reply to memories. A voice message records your voice. When you record a question as a voice message, AI turns it into text in the question field, and you can correct it before sending (section 6).
• Listening information: which memories you have listened to or opened, when you last did so and how many times you have listened. Your family and the storyteller see a small circle with your initials on a memory once you have listened to it, opened it or replied to it. The number of listens is not shown.
• Invitations: the family’s invite link and the storyteller’s joining code, with their expiry times.
• Referrals: your own referral code and, if your family started Muistola with someone’s referral link, a record of that (section 3.8).

3.2 Storytellers

• Details from the family: name, relationship and language, and photos if the family adds them (section 3.7).
• An anonymous user ID, created when the phone joins the family with a code. We do not know the storyteller’s email address or phone number.
• Memories: the voice recording with the storyteller’s voice, a word-for-word transcript and a readable text, a title, the question or topic the storyteller answered, an estimate of the year the memory is from (or the storyteller’s own answer to “When did this happen?”), and follow-up questions suggested by AI.
• The storyteller’s choices: the week’s questions and the topics they have set aside because they do not want to talk about them.
• Technical details of a memory: length, file format, processing stage, and which service and model wrote the text and how long it took.
• Consent: the time when the storyteller gave permission at the end of the introduction to save their memories, and the version of the introduction text they agreed to (section 5).

3.3 People mentioned in memories

When storytellers talk about their lives, memories also hold information about other people: names, events and sometimes sensitive matters such as illnesses. This information is part of the memory’s recording and text. We do not extract it, we do not search or sort memories by it, and we do not use it for anything other than showing the memory to the family.

We cannot inform everyone mentioned in a memory separately, because we do not know who they are or how to reach them. That is why this policy is publicly available. If you are mentioned in a memory and want to use your rights, please contact us (section 12).

3.4 Devices and technical information

• Notification token: if you allow notifications, we store your device’s push token and whether the device is an iPhone, an Android phone or a browser.
• Server logs: when the app or a browser connects to our servers, the providers’ logs record things like the IP address, time and request. Logs are used only for security and troubleshooting.
• Protecting joining codes: to prevent codes from being guessed, we record the time, the user ID if one has already been created, and a hash calculated from the IP address for every code attempt. These records are deleted after seven days.
• Analytics: Muistola does not currently use any analytics or error tracking service. If we start using one, we will ask for your permission and update this policy first.

3.5 Visitors to the website

The website muistola.com does not collect information about visitors for our own use. The site is delivered through a content delivery network (section 8), whose logs technically record IP addresses. If you send feedback with the form on the site, it is stored as described in section 3.6.

3.6 Feedback

You can give feedback in the app and at the bottom of the website: thumbs up or down and a message in your own words. We store the rating and the message, which screen or page the feedback came from, the type of device, the app version, the language and the browser’s identifier. Feedback sent from the app is linked to your account, your family and whether you are a family member or a storyteller.

Your email address is stored with the feedback only if you would like a reply: in the app with the switch “You may contact me by email” (your account’s address), on the website by writing your address in the form. To prevent misuse, we store a hash calculated from your IP address, which is deleted after a week. Only Muistola’s administrator reads feedback; other users cannot see it.

3.7 Photos the family adds of the storyteller and the family

A family member can add two photos for each storyteller. Photos are optional, and Muistola works the same without them.

• A photo of the storyteller. The family sees it at the top of the Muistola page and as a small picture next to the storyteller’s name.
• A photo the storyteller sees. Shown on the storyteller’s own home screen, for example a photo of the grandchildren or the whole family.

A photo may show other people besides the storyteller, including children. The person adding a photo is responsible for having the right to use it and the permission of the people in it (terms of use, section 6).

• What is stored: the photo and which storyteller it belongs to. The app makes the photo smaller (at most 1,600 pixels on the long side) and saves a new copy of it before sending. This removes the file’s extra details (EXIF and XMP), such as where and when the photo was taken and the camera or phone details. Before sending, the app also checks that the photo has no location information. We do not receive or store the original photo.
• What we do not do with photos: we do not recognise people in photos, we do not analyse photos, and we do not send them to AI services.
• Who sees them: only your family members and the family’s storytellers (section 7). Storytellers cannot change or remove photos in the app, but they can ask their family or us to do it.
• Keeping and deleting: until a family member changes or removes the photo or the family is deleted (sections 10 and 11).

3.8 Referrals

A family member can tell a friend about Muistola with their own referral link (terms of use, section 13). For this we handle the following information:

• Referral code: each family member’s own short code, which is part of the referral link. The code is created when you open the Family tab or Tell a friend in the app, or when we send you an email about a new memory, because the email includes your own link at the bottom.
• Referral: when a new family creates an account with a referral link, we store whose link and which family it came through, when, and with which code. Later we store whether the family has started a paid Muistola year and when the reward was credited.
• Who sees it: the referrer sees only numbers in the app: how many families have started with their link and how many of them have started a paid year. They do not see the referred families’ names, members or memories, and the referred family does not see the referrer’s details in Muistola.
• How the link reaches sign-up: when you open a referral link, the website and the app store the code in your browser or phone (section 14). The code also travels with your account details until your email address has been confirmed and the family has been created.

4. Why we handle information and on what legal basis

The references are to the EU General Data Protection Regulation (GDPR).

Providing the service

Accounts, connecting the family and storytellers, saving memories and turning them into text, showing memories to the family, questions (including turning a question recorded as a voice message into text), replies and notifications. Legal basis: contract, meaning the terms of use (Article 6(1)(b)). Storytellers are also parties to the contract when they use the app.

Adding a storyteller before they have joined

The family gives the storyteller’s name and relationship so that they can be invited. Legal basis: the legitimate interest of the family and Muistola in setting up the service (Article 6(1)(f)). Very little information is involved, and storytellers see it when they join.

People mentioned in memories

Legal basis: legitimate interest (Article 6(1)(f)). Storytellers have the right to tell about their own lives, and families have a legitimate interest in keeping their family’s memories. Memories are visible only to the storyteller’s family and are not used for anything else.

Photos

Showing the photos the family adds to the family and the storyteller (section 3.7). Legal basis: the contract with the family member (Article 6(1)(b)) and, for other people shown in the photos, the family’s legitimate interest (Article 6(1)(f)). Photos are visible only to the family and are not used for anything else.

Referrals

The referral link, recording referrals and crediting rewards (section 3.8). Legal basis: contract, meaning the terms of use, section 13 (Article 6(1)(b)). For the referred family, the legal basis is also legitimate interest (Article 6(1)(f)): the reward requires knowing whose link the family started with, and very little information is involved.

Sensitive information in memories

The storyteller’s explicit consent, see section 5.

Feedback

Receiving feedback, replying to it and improving the service based on it. Legal basis: legitimate interest in developing the service and handling enquiries (Article 6(1)(f)). We reply by email only when you have asked for a reply.

Security, preventing misuse and backups

Logs, recording code attempts and backups. Legal basis: legitimate interest in keeping the service and families’ memories safe and recoverable (Article 6(1)(f)).

Messages about the service

Email confirmation, password changes, notifications about new memories and important information about changes to the service or the terms. Legal basis: contract. We do not send marketing messages without your consent.

Legal obligations

When payment opens, we will keep payment records as required by the Finnish Accounting Act. Legal basis: legal obligation (Article 6(1)(c)).

We do not sell information, use it for advertising or profile anyone. Muistola makes no automated decisions that have legal or other significant effects on you.

5. Sensitive information in memories

Illness, faith, politics and family relationships are part of people’s lives. That is why memories can contain special categories of personal data as defined in the GDPR, such as health information, religious beliefs, political opinions or ethnic origin. We do not ask for this information, and we do not classify or analyse memories based on it.

• The storyteller’s own information. Storytellers decide what they tell. The processing is based on their explicit consent (Article 9(2)(a)). Consent is given at the end of the app’s introduction: the last page explains that memories are saved as recordings and as text for the family to listen to and read and that AI turns speech into text, and the storyteller gives permission by pressing OK, let’s begin. Memories can be told only after that. We store the time of consent and the version of the introduction text so that we can show what permission was given. Storytellers who joined before consent was asked in this way see the introduction once more and give permission in the same way.
• Withdrawing consent. Storytellers can withdraw their consent at any time. They can delete a single memory in the app. To withdraw consent completely, they or their family can ask us at [email protected] to delete their memories and information (section 11). Withdrawal does not affect processing that took place before it.
• Family members’ information. The same applies to family members’ questions, comments and voice messages: they contain only what you choose to write or say to your family.
• Information about people mentioned in memories. We handle it only as part of the storyteller’s account of their own life, and only for their family to see. We do not use it for anything else.

Memories are kept in the family’s private space and protected as described in section 17.

6. Artificial intelligence in Muistola

In Muistola, AI turns speech into text and makes that text readable. Here is what is sent and where.

From speech to text

The recording of a memory is sent to a US speech recognition service, which writes down the speech word for word. Processing may take place outside the EU, for example in the United States. Only the audio and the language are sent, although the speech itself can include names and other details.

A question that a family member records as a voice message is sent to the same service right after recording so that the question can also be shown as text. The family member can correct the text before sending. The voice message is saved in Muistola only when the question is sent.

Readable text, title and suggestions

The word-for-word transcript and the question the storyteller answered are sent to a US AI service, and processing takes place in the United States. The model writes a readable version in the first person without changing the dialect, suggests a title and up to three follow-up questions, and estimates which year the memory is from. Our instructions forbid the model from adding anything the storyteller did not say. For a question recorded as a voice message, the same service only fixes punctuation and capital letters and removes filler sounds such as “um”.

Information is not used to train AI

Under the providers’ terms, the information we send is not used to train AI models or to develop their products. The services process the information only on our behalf (section 8). They keep requests to detect misuse: the speech recognition service for 55 days and the text service for 30 days. If the text service’s monitoring flags a request as violating its usage policy, it may be kept for up to two years.

AI does not decide anything for you

AI does not make decisions about you or evaluate you. The storyteller and the family decide for themselves whether to use its texts and suggestions.

Mistakes are possible

AI can mishear things, especially names, places and dialect words. Passages that cannot be made out are marked as unclear in the text. The original recording is always kept, and storytellers can correct the text of their memories.

The example memory

The example memory in the app is made up, and its voice was created with AI.

Changing services

We may replace the speech recognition or text service with another one, for example one that operates in the EU. The new service meets the same conditions. If the country of processing or the safeguards change, we will update this policy before the change.

7. Who can see the information

• Your family. Family members can see all of the family’s memories, questions, comments, voice messages, listening information and photos. Storytellers can see their own memories, the finished memories of the family’s other storytellers, the family’s replies, who has listened to or opened each memory and the photos the family has added. A family member who joins later with an invite link can also see earlier memories.
• Anyone who opens an invite link. Before joining, a person who opens a valid invite link can see the family’s name and the first names of the person who invited them and of the storytellers. So please share the link only with people you want in the family.
• Anyone who has a joining code. Before joining, a person who knows a valid joining code or opens a joining link can see the storyteller’s name, the first name of the person who invited them and the family’s name. That is why the code is given only to the storyteller.
• The referrer. If your family started Muistola with someone’s referral link, they see only numbers (section 3.8), not your family’s name, members or memories.
• Muistola. The administrator has technical access to the database. We look at information only when it is necessary to fix a problem, for security reasons or at your request.
• Service providers. The services listed in section 8 process information only on our behalf and according to our instructions.
• Authorities. We disclose information only when the law requires it.

Memories are not visible outside the family, and they cannot be found with search engines.

8. Service providers that process information

Muistola uses the services described below. They are processors of personal data that may process information only on our behalf, under a data processing agreement and the GDPR. We describe the providers by category: what the service does, where the information is processed and how any transfer outside the EU is protected (section 9). We name the notification services, because phone notifications always pass through them.

Database, sign-in and server service (EU, Sweden)

Database, sign-in and server functions. The servers are in Sweden. The provider’s support staff and subprocessors may also process information from outside the EU. Safeguard: standard contractual clauses.

File storage and backup service (EU)

Audio files, photos and encrypted backups. The files are kept in the EU jurisdiction. The provider is a US company. Safeguard: Data Privacy Framework.

Website and app delivery service (global content delivery network)

Delivers the website and the app’s browser version from a server near the visitor and manages the muistola.com domain. The servers’ logs record IP addresses. The provider is a US company. Safeguard: Data Privacy Framework.

Email sending service (EU, Ireland)

Emails such as address confirmation, password changes and notifications, and forwarding feedback to the administrator. The emails are sent from Ireland. The provider is a US company. Safeguard: Data Privacy Framework.

Email forwarding and mailbox service (United States)

Messages and feedback sent to [email protected] are forwarded to the administrator’s mailbox, where they are read and stored. The providers are US companies, and processing may take place outside the EU. Safeguard: Data Privacy Framework.

Speech recognition service (AI, United States)

Turns the speech in memories and in questions recorded as voice messages into text (section 6). Processing may take place outside the EU, for example in the United States. Safeguard: Data Privacy Framework.

AI service for writing the readable text (United States)

Writing the readable text, title, estimated year and suggestions, and fixing the punctuation of questions recorded as voice messages (section 6). Processing takes place in the United States. Safeguard: standard contractual clauses.

Backup automation service (United States)

Runs the backup on a temporary server, which is wiped after the run (section 10). Safeguard: Data Privacy Framework.

Expo (650 Industries, Inc., United States)

Relays push notifications to the app. Safeguard: Data Privacy Framework.

Apple, Google and browser makers

Deliver push notifications to your device (Apple Push Notification service, Firebase Cloud Messaging and the browser’s own push service).

You can get an up-to-date list of the service providers we use by asking at [email protected].

App stores (App Store and Google Play) process information under their own terms when you download the app. Payment is not possible yet. When it opens, payments will be handled by a separate payment service, and we will update this policy before then.

9. Transfers outside the EU

Families’ information is stored in the EU: the database in Sweden and files in the storage service’s EU jurisdiction. Some processing, however, takes place outside the EU and EEA, mainly in the United States. This includes speech recognition, writing the readable text, running the backup, relaying push notifications (Expo), storing messages sent to [email protected] and the providers’ technical support. In addition, the delivery network operates worldwide, so loading the site may also pass through a server outside the EU.

These transfers are protected as follows:

• The European Commission’s adequacy decision on the EU–US Data Privacy Framework, where the provider is certified under it. This applies to the storage, delivery and email services, speech recognition, the backup automation service and Expo.
• Standard contractual clauses approved by the European Commission, included in the providers’ data processing agreements. Among others, the processing by the AI service that writes the readable text and by the database, sign-in and server service relies on these.

You can ask for more information about these safeguards and a copy of them at [email protected].

10. How long we keep information

• Memories, questions, comments and voice messages: for as long as the family uses Muistola or until they are deleted. Storytellers can delete their own memories, and a family member’s comments and voice messages are deleted when they delete their account.
• Photos of the storyteller and the family: until a family member changes or removes the photo or the family is deleted. Photos stay with the family even if the family member who added them deletes their account.
• When a year of Muistola ends: the memories stay available to the family, and you can still listen to them and read them (terms of use, section 12). We will always tell you before we delete memories, and you can ask for a copy of them.
• Family member accounts: until you delete your account.
• Storyteller information: for as long as the storyteller belongs to the family or until the family is deleted. After a storyteller has died, their memories stay with the family until the family deletes them or asks us to delete them.
• Joining codes and invite links: valid for 14 days. A joining code that has been used still works for one day, so that the storyteller can join again, for example after installing the app. Records of them are kept with the family’s information.
• Records of code attempts: 7 days.
• Push token: until the account is deleted or the token moves to another user on the device.
• Server logs: in the providers’ logs for a short time, usually from a few days to a few weeks.
• AI services: up to 55 days at the speech recognition service and 30 days at the text service (section 6).
• Emails to [email protected]: for as long as needed to handle the matter.
• Feedback: up to two years, the IP address hash for one week. The copy forwarded to the administrator’s email is kept for as long as needed to handle the matter.
• The storyteller’s consent: for as long as the storyteller’s information is kept.
• Referrals: the referral code for as long as your account exists. A referral for as long as both the referred family and the referrer’s family exist. If the referred family has started a paid year, the record of the earned reward stays with the referrer’s family even if the referred family is later deleted; no information about the referred family is then kept.
• Accounting: once payment has opened, payment records for six years from the end of the year in which the financial year ended.
• Backups: up to 90 days. Deleted information can remain in backups for this time. If we restore information from a backup, we will delete again any information whose deletion was requested.

11. Deleting your account and information

There is also a short guide on the page Deleting your account and information.

Family member accounts

You can delete your account in the app: Family tab, Settings, Delete account. Your account, listening information, hearts, comments and voice messages are deleted immediately. Questions you added stay with the family without your name.

If you are the last family member in the family, the whole family is deleted: storytellers, all memories and questions, and the storytellers’ phone IDs. Ask for a copy of the memories before you delete (section 12).

Storytellers’ memories and information

Storytellers can delete their own memories in the app. This also deletes the memory’s continuations, listening information and the family’s replies. The app does not yet have a way to delete all of a storyteller’s information, so the storyteller or their family can ask us to do it at [email protected].

Photos

A family member can change or remove a storyteller’s photo in the app: the Family tab, Change photo next to the storyteller. Storytellers can ask their family or us at [email protected] to remove a photo.

Audio files and photos

When a memory, voice message or spoken question is deleted, or a photo is changed or removed, its records are removed from the database immediately. The file is removed from storage separately soon afterwards, within 30 days at the latest. It remains in backups for up to 90 days.

12. Your rights and how to use them

• Right of access: you can find out what information we handle about you and get a copy of it.
• Right to rectification: storytellers can correct the text of their memories in the app. We make other corrections, such as to your name or email address, on request.
• Right to erasure: see section 11.
• Right to restrict processing, for example while we check whether information is correct.
• Right to data portability: we provide memories as audio files and text in commonly used formats. The app does not yet have a download button, so please send your request by email.
• Right to object to processing based on legitimate interest, on grounds relating to your particular situation.
• Right to withdraw consent at any time (section 5).

How to use your rights

Send your request to [email protected]. Tell us who you are and which family you belong to. Before we hand over or delete information, we make sure the request comes from the right person, for example by replying to your account’s email address. We reply within one month. If a request is exceptionally extensive, this can be extended by up to two months, and we will let you know. Requests are free of charge.

Storytellers can ask their family for help. A family member can act on a storyteller’s behalf when the storyteller has given permission or when the family member is their legal representative.

If you are mentioned in a memory, you have the same rights. Because a memory is also the storyteller’s account of their own life, we weigh the rights case by case and, where needed, resolve the matter together with the storyteller and the family.

13. Complaints to the supervisory authority

If you think we are handling your information in breach of data protection law, you can complain to the supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman:

You can also complain in the EU country where you live or work. We hope you will contact us first so that we can put things right.

14. Cookies and information stored on your device

The app

The app stores on your phone, and the browser version in your browser’s storage, only the information it needs to work:

• your sign-in, so you do not have to sign in every time
• your language and theme choices
• whether the storyteller has seen the introduction, and when they last looked at the family’s replies
• the permission the storyteller gave at the end of the introduction, until it has been saved on the server, if the connection dropped at that moment
• memories that have not been sent yet: if the connection drops, the memory waits on the phone and goes to the family when the connection returns
• the code from a referral link until the account and family have been created, for at most 60 days (section 3.8), and whether you have closed the Tell a friend card on the memory page.

We do not use tracking or advertising cookies. The app asks for microphone permission when a storyteller records a memory or a family member records a message, for camera permission only when a family member takes a photo with the app, and for notification permission only when you choose to turn notifications on.

The website and the browser version

The code from a referral link is saved in your browser’s storage for at most 60 days so that it reaches sign-up (section 3.8). Your language and theme choices are saved in your browser (the theme in a cookie called muistola_theme). These are necessary for the site to work, so we do not ask for separate consent.

15. Notifications

Muistola can tell you about new memories, replies and the week’s questions with notifications.

• Push notifications are sent only if you allow them. The notification text, for example the storyteller’s name and the memory’s title, passes through Expo and Apple’s or Google’s notification service, or in a browser through the browser maker’s push service. You can turn notifications off in your device settings.
• Email notifications to family members are sent through the email sending service (section 8). You can stop them at any time.

16. Children and age limits

Muistola is set up by an adult. The family’s founder, meaning the person who creates the family’s account, must be at least 18 years old.

Other family members can create their own account from the age of 13. A grandchild under 13 can take part together with a parent or guardian on that adult’s account, for example by recording a question for a grandparent. The guardian then decides what is recorded about the child. If we find that a child under 13 has created an account, we will delete it.

Memories, voice messages and photos can contain information about children. We ask families to think about what they record about children.

17. Security

• Connections between the app, the website and the servers are encrypted (HTTPS).
• Database access is restricted so that everyone sees only their own family’s information.
• Audio files and photos are in private storage. Listening and viewing links are created on request and are valid for one hour.
• Passwords are stored only as hashes.
• Backups are encrypted, and they cannot be deleted or changed for 30 days, even if a key fell into the wrong hands.
• Guessing joining codes is limited.
• Administrative credentials and keys are limited to the permissions they need.

If a data breach puts your information at risk, we will report it to the Data Protection Ombudsman within 72 hours. If the breach is likely to result in a high risk to you, we will also tell you without undue delay.

18. Changes to this policy

We update this policy when the service or the law changes. We will tell you about significant changes in the app or by email before they take effect. The date at the top of the policy shows when this version took effect.

This policy is effective from 19 October 2026. Updated 20 October 2026: the site password was removed, joining code preview, the status of payments, the text was shortened and backups moved to section 10. See also the terms of use.