Last updated 1 October 2026

Privacy notice

This notice explains what Heirloom collects when you use readheirloom.com, why, who else handles it, how long it is kept and what you can do about it. Heirloom is operated by Randy Ventures, based in Texas, USA. Questions or requests: [email protected].

What Heirloom collects

Your account: your email address. If you sign in with Google, the name and email address Google shares. There are no passwords.
Your letters: the photos and PDFs you upload, the page images prepared from them, the readings (transcription, modern wording and any translation), titles and your corrections.
Credits and payments: your credit balance, the packs you bought and their payment status. Card details are entered on Stripe’s checkout page and are never sent to or stored by Heirloom.
Technical data: your IP address and request information, used to keep sign-in secure and to limit abuse (for example, how many sign-in codes can be requested).

How it is used

To sign you in, keep your library private to your account and run the readings you ask for.
To sell and track page credits, including holding credits while a reading runs and releasing them if it fails.
To send the sign-in codes you request. Heirloom does not send marketing email.
To prevent abuse and keep the service secure.

Heirloom does not sell your personal information or share it for advertising.

AI processing of your letters

When you start a reading, the page images you selected are sent to Google’s Gemini API, which returns the transcription, modern wording and translation. Heirloom uses Google’s paid Gemini API service, under whose terms Google processes them to return the reading and does not use them to improve its products. Heirloom does not use your letters to train AI models.

Services that handle your data

Cloudflare: hosts the website, routes traffic to the API and stores encrypted uploads and page images (R2). It also collects anonymous, cookie-free page-view statistics (Cloudflare Web Analytics).
Render: runs the Heirloom API and its database.
Google: reads letter images (Gemini API) and provides “Continue with Google” sign-in when offered.
Resend: delivers sign-in code emails.
Stripe: processes payments for credit packs.

Heirloom is based in the United States, and these providers may process data in the United States and other countries. If you use Heirloom from outside the United States, your information will be processed there.

Cookies and browser storage

Heirloom uses one sign-in cookie and a security token to keep you signed in and protect against forged requests. Your browser also stores your text-size preference and, temporarily in the current tab, unsaved edits. There are no advertising or analytics cookies; the anonymous page-view statistics mentioned above don’t use cookies.

How long data is kept

Uploads you don’t go on to read are deleted after about 24 hours.
Saved letters, page images and readings are kept until you delete them or your account.
Signed-in sessions end after 7 days without use, and after 30 days at most.
Records of credit purchases are kept after account deletion for up to 7 years, for tax, accounting and fraud prevention.
Backups may contain deleted data for up to 7 days before they are overwritten. A one-way fingerprint of a deleted account’s sign-in identity is kept for 30 days to prevent abuse.

Security

Letters, page images and account data are stored encrypted, and only your signed-in account can open them. No system is perfectly secure; if a breach affects you, Heirloom will tell you as the law requires.

Your choices and rights

Correct or delete any letter from your library at any time.
Download any reading as text.
Delete your account from the Account page. This removes your letters, uploads and sign-in identities. Payment records are kept as described above.
To ask for a copy of your data, a correction or deletion, or to make another privacy request, email [email protected]. Heirloom will respond as required by the law that applies to you.

Children

Heirloom is for people aged 18 and over. It is not directed at children, and Heirloom does not knowingly collect their information. If you believe a child has created an account, email us and it will be deleted.

Changes

If this notice changes, the date at the top changes too.