This Privacy Policy explains how Tale of Life collects, uses, discloses, retains, and protects your personal data. It works together with our Terms of Service to explain your relationship with us.
Last updated: 05.09.2026
Important note: This is a business draft for Tale of Life. It is not legal advice and does not confirm compliance with every law that may apply in Estonia, the European Union, the United States, or another country. Before relying on it as final, a qualified privacy attorney should verify the controller details, lawful bases, cookie setup, international transfers, age rules, US state-law disclosures, retention periods, and AI-processing arrangements.
1. Who we are
Tale of Life is operated by White Swan OÜ, an Estonian company based in Tallinn, Estonia (“Tale of Life,” “we,” “us,” or “our”).
For personal data covered by this Policy, White Swan OÜ is generally the data controller unless we clearly state otherwise.
Privacy contact: privacy@talesof.life
General contact: contact@talesof.life
2. What this privacy policy covers
This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you visit talesof.life, create or use an account, write, save, or share a life story, receive or send an invitation to view shared content, contact us, or use features such as translation, speech recognition, social sign-in, or AI-assisted writing.
This Policy does not apply to third-party websites or services that have their own privacy policies.
3. Personal data we collect
The data we collect depends on how you use the Service.
Account and identity data. This may include your name, username, email address, password credentials or authentication identifiers, profile information, language preference, and account status.
Story and profile content. This may include life-story chapters, memories, photographs, recordings, comments, profile details, family information, dates, locations, and other material you choose to submit. Your stories may contain sensitive information, including information about health, family circumstances, beliefs, relationships, trauma, or other private matters.
Sharing and relationship data. Here we mean the people you invite, access permissions, friendship or contributor relationships, visibility settings, shared links, and records of when access is granted or removed.
Technical and security data. Examples are your IP address, browser and device information, operating system, approximate location derived from IP address, log-in records, timestamps, error reports, security events, and information about how you use the Service.
Communications data. When you contact us, we may collect your message, attachments, contact details, and records of our communications.
Payment data. Tale of Life is currently free to use, and we do not currently process payments. If paid features are introduced, payment details will normally be processed by a payment provider; we would receive information such as payment status and transaction identifiers, but we would not store full payment-card numbers on our own systems.
Information from third parties. We may receive limited information from authentication, hosting, email, translation, or speech-recognition providers when you use those features.
4. How we collect data
- Directly from you when you register or use the Service
- When you create, edit, save, or share content
- When another user invites you to access content
- Automatically through cookies and similar technologies
- From service providers that help us operate the Service
- From third parties when you choose to use a third-party sign-in or integration, such as Google
5. Why we use personal data and our legal bases
The legal basis depends on the processing activity and the law that applies to you.
| Purpose | Examples of data used | Likely legal basis for EU/EEA users |
|---|---|---|
| Provide accounts and core features | Account data, profile data, stories, permissions | Performance of a contract |
| Save, display, and share stories as directed by you | Story content, visibility settings, invitations | Performance of a contract |
| Authenticate users and protect accounts | Login data, device data, security logs | Contract and legitimate interests |
| Maintain backups and restore service | Account and content data | Contract and legitimate interests |
| Prevent abuse, fraud, and security incidents | IP address, logs, account activity | Legitimate interests and legal obligations |
| Respond to support requests | Contact and communications data | Contract, legitimate interests, or consent |
| Send essential service messages | Email address, account data | Contract or legitimate interests |
| Send optional marketing | Contact details, consent records | Consent where required |
| Measure and improve the Service | Analytics and technical data | Consent where required; otherwise legitimate interests where legally permitted |
| Provide optional translation or speech features | Text, audio, language preferences | Consent or contract, depending on the feature |
| Provide optional AI writing assistance | Prompts, selected story text, outputs | Consent or contract, depending on the feature |
| Comply with law and defend legal claims | Relevant records | Legal obligation and legitimate interests |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before withdrawal.
6. Life stories and sensitive information
Tale of Life is designed for personal memories, so the content you submit may be highly private. You decide what to write and what visibility setting to use.
Please do not include passwords, payment information, identity-document numbers, or unnecessary sensitive information about another person.
If you include information about another person, you are responsible for having a lawful basis to do so. You should consider whether that person would reasonably expect the information to be stored or shared.
Where applicable law treats information in a story as special-category or sensitive personal data, we will process it only when an appropriate legal condition applies. This may include your explicit consent where required. We may ask you to remove content or restrict a feature if processing creates an unacceptable legal, safety, or security risk.
7. Story visibility and privacy controls
Depending on the feature, you may be able to mark content as private, visible only to selected people, visible to friends or contributors, or public.
You are responsible for checking the visibility setting before sharing content. Public content may be copied, indexed, saved, or redistributed by other people. Removing public content from the Service may not remove copies made by others or stored by search engines.
If you invite another person to view content, we may process their email address or account identifier to deliver and manage the invitation. You may revoke access through the available controls or by contacting us.
8. Cookies and similar technologies
We use a cookie consent tool so you can choose which types of cookies you are comfortable with. Necessary cookies, such as those that keep you signed in, stay active at all times, since the site needs them to function. Other categories — Functional, Analytics, Performance, and Advertisement — activate only if you opt in, and you can change your preferences at any time via the cookie settings.
| Technology | Provider | Purpose | Category | Duration | Consent required? |
|---|---|---|---|---|---|
| Login cookie | Tale of Life (self-hosted) | Keep you signed in and remember your preferences | Necessary | 2 days, or 2 weeks with “Remember Me” | No |
| Test cookie | Tale of Life (self-hosted) | Check whether your browser accepts cookies | Necessary | Session — discarded when you close your browser | No |
| Cookie preferences | Cookie consent tool | Remember your cookie choices | Necessary | Set by the consent tool | No |
If we add non-essential analytics, advertising, or personalisation technologies, we will ask for consent first where required, and update this table with the specific tool, purpose, and duration before activating it. Non-essential cookies must not be activated before valid consent where applicable law requires consent, and withdrawing consent should be as easy as giving it.
9. Service providers and recipients
We disclose personal data to a small number of carefully selected providers that help us run the Service. We require them to use personal data only for the purposes below, protect it appropriately, and comply with applicable contractual obligations.
| Provider | Service | Data processed | Processing location |
|---|---|---|---|
| Hostinger | Hosting and storage | Account data, profile content, technical and log data | Company headquartered in the EU (Vilnius, Lithuania); the specific server is physically located in the United States (Massachusetts) |
| Hostinger | Service email delivery (notifications, invitations) | Email address, message content | Same as above |
| Sign-in with Google (optional) | Name, email address, profile picture | Google’s global infrastructure, per Google’s own privacy policy | |
| Google Translate for optional page translation | Visible page text you choose to translate | Google’s global infrastructure | |
| Google (via your browser) | Optional voice-to-text dictation (Chrome’s built-in speech recognition) | Audio you actively choose to dictate; we only receive the resulting text | Google’s global infrastructure |
We will keep this table current as our provider list changes, and will publish transfer safeguards where legally required (see Section 11).
10. AI-assisted writing
AI writing assistance on Tale of Life is optional. Today, this works by opening ChatGPT in a separate browser tab and pasting in what you have already written — we do not currently send your story content to an AI provider automatically from within the Service.
If we introduce an in-app AI feature that sends your content to an AI system on your behalf, before activating it for private stories we will explain what content is sent, which provider processes it, whether prompts or outputs are retained, whether the provider may use the content for model training, where processing takes place, and how you can disable the feature.
We will not use private stories to train general-purpose AI models unless we first obtain separate permission or another lawful basis and provide any disclosures required by law.
AI-generated text may be inaccurate or may unintentionally change the meaning of a memory. You are responsible for reviewing any AI-assisted suggestions before saving or sharing them.
11. International transfers
Some providers process personal data outside the country where you live, including outside the European Economic Area. Because this involves transferring personal data outside the EU/EEA, such as to Hostinger’s US-based server, Standard Contractual Clauses (SCCs) approved by the European Commission govern this transfer, as set out in our data processing agreement with Hostinger.
The full list of countries, providers, and safeguards will be kept up to date in Section 9 as our provider list evolves.
12. How long we retain your data
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required by law or needed to establish, exercise, or defend legal claims.
| Data type | Retention period |
|---|---|
| Active account data | While your account remains active |
| Private and shared stories | Until you delete them or close your account, except for copies temporarily kept in secure backups |
| Public stories | Until removed by you or Tale of Life, except for copies temporarily kept in secure backups |
| Deleted content in backups | Removed from backups within a reasonable period as part of our normal backup rotation |
| Security and access logs | Retained for a limited period for security and abuse-prevention purposes |
| Support communications | Retained for as long as needed to resolve your request, and for a reasonable period afterward |
| Consent records | Retained for as long as necessary to demonstrate compliance |
| Billing and legal records | Not currently applicable — the Service is free. If this changes, the period required by applicable law |
Overall, when data is no longer needed, we delete it, anonymise it, or securely restrict it. If you delete your account, your personal data and profile content will be permanently removed, except where the law requires us to retain certain information for legal or administrative purposes.
13. Your privacy rights in the EU/EEA and United Kingdom
Depending on the law that applies, you may have the right to request access to your personal data, correct inaccurate or incomplete data, request deletion, request restriction of processing, object to processing based on legitimate interests, withdraw consent, receive certain data in a portable format, and object to direct marketing.
You may submit a request to privacy@talesof.life. We may need to verify your identity before completing a request. We normally respond within the period required by applicable law, generally one month under the GDPR, subject to permitted extensions for complex requests.
You also have the right to complain to the data-protection supervisory authority in the country where you live, work, or believe an infringement occurred. For the controller established in Estonia, the relevant authority is the Estonian Data Protection Inspectorate.
14. United States privacy notice
Depending on where you live and whether legal thresholds apply, US privacy laws may give you rights to know or access categories and specific pieces of personal information, correct inaccurate personal information, delete personal information (subject to exceptions), obtain information in a portable format, opt out of sale or sharing for targeted advertising where applicable, limit certain uses of sensitive personal information where applicable, and appeal a decision about a privacy request where required.
We do not sell personal information for money. We do not share personal information for cross-context behavioural advertising unless we clearly disclose the activity and provide the opt-out rights required by applicable law.
We may disclose personal information to service providers and contractors that help us operate the Service (see Section 9). Categories may include account data, internet or device activity, user-generated content, communications, and identifiers, depending on the service used.
To submit a US privacy request, contact privacy@talesof.life with the subject “US Privacy Request.” We may verify your identity and will not discriminate against you for exercising a legal privacy right. If applicable law provides an appeal process, we will explain how to appeal our response.
15. Children and young users
The Service is not directed to children below 16 years old, in line with the GDPR’s default age of digital consent. We do not knowingly collect personal data from children below the applicable legal age without legally required consent.
If you believe a child has provided personal data unlawfully, contact privacy@talesof.life. We will investigate and take appropriate action, which may include deleting the account or data where required.
Because life stories may contain information about children, users must not publish a child’s personal information unlawfully or in a way that creates an avoidable safety risk.
16. Keeping the Service secure
We use reasonable technical and organisational measures designed to protect personal data, including access controls, authentication safeguards, secure transmission, monitoring, backups, and automated security tools that watch sign-in attempts and network traffic for abuse, such as brute-force login attempts, based on IP address and known attack patterns.
That said, no online service can guarantee absolute security. You should use a unique password, enable available security features, and contact us promptly if you suspect unauthorised access.
If a personal-data breach occurs, we will assess it and notify regulators and affected people when required by applicable law.
17. Account deletion and content deletion
You may request account or content deletion through the available account controls or by contacting privacy@talesof.life.
Deletion from active systems may not be immediate where content is stored in secure backups, required for legal compliance, needed to investigate abuse, or necessary to establish or defend legal claims. We will delete or anonymise retained data when the applicable retention reason ends.
Deleting your account may not delete content that another user lawfully copied, publicly viewed, or stored outside the Service.
18. After you’re gone
Tale of Life aims to outlive the moment you write it. We do not currently offer an automated way to name a legacy contact for your account. If a family member or representative contacts us after a member’s death, we will ask for a copy of the death certificate and proof of your relationship to the deceased. Only after that will we make any changes to the account, such as memorialising it, providing a copy of their content, or closing it at the family’s request.
19. Changes to this privacy policy
We may update this Policy to reflect changes in the Service, law, providers, processing activities, or security practices — for example, when we add a new feature or start working with a new service provider. For material changes, we will let you know by email or with a notice on the site before the change takes effect. Where consent is required for a new use of data, we will request that consent rather than relying only on a policy update. This privacy policy remains in effect until we publish a new version, and the “last updated” date at the top of this page always reflects the current version.
20. Contact us
For privacy questions, requests, or complaints, contact:
White Swan OÜ
Based in Tallinn, Estonia
Privacy contact: privacy@talesof.life
General contact: contact@talesof.life
Data-protection contact or DPO: not appointed — not currently required at our size