The short version
- Your recordings, transcripts, photographs, stories, and archive details belong to you.
- We use them to provide the features you request. We do not sell them or use them for advertising.
- OpenAI processes selected content to run live interviews, create transcripts, refine transcripts, and draft stories. OpenAI states that API data is not used to train its models unless the customer opts in.
- Your archive is private unless you create an active sharing link. Anyone with an active link can access the material it exposes.
- Optional analytics are off until you consent, and you can change that choice using the Privacy button on any page.
1. Who is responsible
Golden Record is operated by Unicorn Road. In this notice, “Golden Record,” “we,” “us,” and “our” refer to the operator of the Golden Record service at goldenrecord.app.
We are the controller for account administration, security, support, service operations, and optional website analytics. When an account holder uploads information about relatives, interviewees, or other contributors, that account holder decides what to collect and share. They may have their own legal responsibilities to those people, while we process the content to provide the requested service.
Privacy questions and rights requests can be sent to privacy@goldenrecord.app or through our support page.
2. Information we collect
Account and contact information
Your email address, authentication identifiers, account activity, and any support correspondence. If you create a sharing link, you may optionally store a recipient name and email for your own reference.
Archive content
Record titles and descriptions; names and preferred story names; audio recordings; live interview audio and captions; transcripts; story drafts; prompts; photographs or documents when those features are available; dates, places, people, tags, and other context you choose to add.
Information about other people
Family stories can contain personal data about interviewees, relatives, and other people who do not have an account. Some stories may reveal sensitive information such as health, heritage, religious beliefs, political views, sexuality, or family circumstances. Only collect or share material when you have a lawful and respectful reason to do so.
Technical information
IP address, device and browser information, request logs, security events, cookie or local storage identifiers, and diagnostic information needed to operate and protect the service. If you consent to analytics, we also receive aggregated information about visits and a deliberately small set of product milestones, such as opening a record workspace, beginning a recording, requesting a transcript, or encountering a save failure. These events do not include story titles, recording content, transcripts, email addresses, IP addresses, or arbitrary text.
3. Why we use information and our legal bases
| Purpose | Information | Legal basis |
|---|---|---|
| Provide accounts, recording, storage, transcription, writing, playback, export, and private sharing | Account data and archive content | Performance of our contract with the account holder |
| Protect accounts, prevent abuse, diagnose failures, and maintain service integrity | Account, device, security, and limited content data where necessary | Legitimate interests in operating a safe and reliable service; legal obligations where applicable |
| Respond to support and privacy requests | Contact information, correspondence, and relevant account information | Contract, legal obligations, and legitimate interests |
| Measure website and product use | Cookie identifiers, device data, pages and interactions | Your consent |
| Comply with law and enforce our Terms | Information relevant to the request, dispute, or suspected misuse | Legal obligations and legitimate interests |
Where content includes special category data, the account holder must ensure an appropriate Article 9 condition applies. Where we rely on consent, including explicit consent where required, it can be withdrawn. Withdrawal does not make earlier lawful processing unlawful.
4. Recording people and respecting their choices
Tell people when a conversation is being recorded, how it will be transcribed or shaped with AI, who may hear or read it, and whether you intend to share or publish it. Recording and privacy laws vary by location. The account holder is responsible for obtaining any permission required by law and for respecting a person who asks to pause, edit, limit, or remove their contribution.
Do not use Golden Record for covert surveillance, voice identification, employment screening, medical diagnosis, or decisions that significantly affect a person. We do not use voice recordings to identify people biometrically.
5. AI-assisted features
When you use a live interview, transcription, transcript refinement, or story drafting feature, relevant audio, transcript text, prompts, archive titles, names, and limited context are sent to OpenAI to produce the requested result. Golden Record uses OpenAI’s API, not a public consumer chat account.
Our writing requests are configured not to store generated responses for later retrieval by Golden Record through the OpenAI Responses API. OpenAI states that API inputs and outputs are not used to train its models unless the API customer opts in. Its current endpoint policies provide no application-state retention for audio transcription, and may retain live or other API data for abuse monitoring for up to 30 days. These provider controls can change, so review OpenAI’s current data controls.
AI can mishear, omit, or phrase things incorrectly. Review transcripts and story drafts before relying on or sharing them. Golden Record does not make solely automated decisions with legal or similarly significant effects.
6. Who receives information
We use a limited set of service providers acting under contract:
- Supabase: authentication, database, and private file storage.
- Vercel: website hosting, application delivery, security, and operational logs.
- OpenAI: live interviewing, audio transcription, transcript refinement, and story drafting when you request those features.
- Google Analytics: optional measurement of public website pages, only after consent. Analytics is disabled in the signed-in workspace, sign-in flow, and private shared records.
We may also disclose information when required by law, to protect people or the service, in connection with a business reorganisation subject to appropriate safeguards, or when you deliberately share content. We do not sell personal data.
7. Private links and collaborators
Records are private by default. When you create a sharing link, anyone who obtains an active link may be able to access the shared record without creating an account. You can turn a link off or replace it. Treat links like private invitations and ask recipients not to forward them.
We do not send the optional recipient email stored beside a sharing link unless an email delivery feature clearly says it will do so. It is currently a reference field for the account holder.
8. International processing
Our providers operate internationally, including in the United States. Information may therefore be processed outside the UK or European Economic Area. Where required, we rely on adequacy regulations or contractual safeguards such as the UK International Data Transfer Addendum and the European Commission’s Standard Contractual Clauses. You may request more information about applicable safeguards.
9. How long we keep information
- Account and archive content: while your account remains active and until you delete it or ask us to delete it, subject to legal requirements and limited backup cycles.
- Deleted recordings: removed from active storage when deletion succeeds. Residual encrypted backups may remain temporarily until provider backup cycles expire.
- Sharing links: until you disable or replace them, delete the record, or close the account.
- Product analytics events: for up to 180 days when you have consented, after which they are deleted.
- Support messages: for as long as needed to resolve the request and maintain an appropriate record of the response.
- Security and application logs: for the shortest period reasonably needed for security, reliability, fraud prevention, and legal compliance, based on risk and provider configuration.
- Consent preference: in your browser for up to 180 days, unless you change it or clear browser storage first.
We are building portable export because preservation should not depend on indefinite platform retention. Until a complete export is available, keep independent copies of irreplaceable material.
10. Security
We use access controls, private storage, encrypted network connections, short-lived playback links, row-level database security, and account-scoped queries. No internet service can promise absolute security. Use an email account you control, protect private links, and keep separate copies of irreplaceable recordings.
If you believe an account or shared link has been compromised, turn off the link where possible and contact us promptly.
11. Your rights
Depending on where you live and the legal basis involved, you may have rights to access, correct, erase, restrict, or receive a portable copy of personal data; object to certain processing; and withdraw consent.
Your right to object
You may object to processing based on our legitimate interests. You have an absolute right to object to direct marketing. Golden Record does not currently use archive content for direct marketing.
Send a request to privacy@goldenrecord.app. We may need to verify your identity and clarify the information involved. Rights concerning content controlled by another account holder may need to be addressed with that account holder, but we will help route a valid request where appropriate.
UK users may complain to the Information Commissioner’s Office. EU users may complain to the supervisory authority where they live, work, or believe an infringement occurred.
13. Children
Golden Record is not directed to children under 16. An account must be created by an adult or by a person old enough to enter the agreement where they live. Adults creating family archives should take particular care with children’s names, images, voices, locations, and sensitive stories.
14. Changes to this notice
We will update this notice when the service, providers, or law changes. Material changes will be brought to account holders’ attention where appropriate. The effective date at the top shows the current version.