Privacy Policy

Harma is a family memory platform that helps families capture voice notes, photos, written thoughts, and messages so that children can one day discover who their family truly was.

This service is operated by James Bell (“Harma”, “we”, “us”, “our”), based in Sydney NSW 2096, Australia. This policy covers the Harma website at harma.app and the Harma iPhone app.

You can contact us at: hello@harma.app

When you create an account, we collect:

• Your first name
• Your email address
• Your password, if you choose one (stored only in scrambled, hashed form)
• The date and time you created your account

When you use Harma, we store the memories you and your family add:

• Written notes, photos, videos and voice notes
• The details you add to them, such as dates, feelings, who is in them and the story behind them
• Your children's names and birthdays, which you give us so we can build their timeline
• Who is in your family on Harma, and the invitations you send

Photos are kept exactly as you add them. Phones often save extra details inside a photo file, such as the date it was taken and sometimes the place. We read the date to put the memory in the right spot on the timeline. We do not read or use the location, but it stays inside the original file, so anyone in your family who downloads that photo could see it. If you'd rather not share where a photo was taken, turn off location for your camera in your phone's settings.

If you choose to add memories by WhatsApp, we also receive your phone number and the messages, photos and voice notes you send us.

In the iPhone app, Harma asks for your permission before using your camera, microphone or photo library, and only uses them when you choose to add a memory. If you turn on a weekly reminder, it is scheduled on your phone itself. We don't use advertising identifiers and we don't track you across other apps.

Automatically: when you use Harma we collect your IP address, device and browser type, the pages you visit, the actions you take (such as adding a memory) and how you found us. See Section 3 and Section 4 for how we use this.

We use your information to:

• Run your account and keep your family's memories safe
• Show your memories to the family members you invite, and no one else
• Sign you in, including emailing you sign-in codes when you ask for one
• Send you a welcome email, occasional product updates and launch announcements
• Keep track of founding families, so we can honour the founding family rate
• Understand how people find and use Harma so we can improve it
• Keep Harma secure, and prevent misuse
• Comply with our legal obligations

We will never sell your personal information, and we never use your memories to train AI. We will never use your information for purposes beyond those above without asking you first. We don't make automated decisions about you that have legal or similarly significant effects.

We don't look through your family's memories. We only open them if you ask us to help with something, to keep Harma secure or fix a fault, or if the law requires it.

We use PostHog and Vercel Analytics to understand how people use Harma, such as which pages are visited and where people get stuck. PostHog may also record how people move through pages (clicks, scrolling and page changes) so we can find and fix problems. In these recordings, photos, videos and voice notes are hidden, and so is what you type. We don't use analytics to advertise to you.

Harma keeps small amounts of information in your browser or app so that it works: to keep you signed in, to remember choices like which child you were looking at, and to show prices in your local currency. Some analytics tools may also store an identifier in your browser. You can clear these at any time in your browser settings, though you'll need to sign in again.

We process your account details and memories because we need them to provide the service you signed up for.

We send product updates on the basis of your consent, given when you create your account. You may withdraw consent at any time by unsubscribing or contacting us.

We rely on legitimate interests for analytics, keeping accounts secure and preventing misuse, where we have assessed that these interests do not override your rights.

We share your data only with service providers who process it on our behalf, to run Harma:

• Supabase: database, file storage and sign-in (United States)
• Vercel: website hosting and analytics (United States)
• PostHog: product analytics (United States)
• Resend: sending sign-in codes, welcome emails and product updates (United States)
• ImprovMX: receiving emails you send to hello@harma.app
• Twilio: receiving memories sent by WhatsApp, only if you use it (United States)

These providers may only use your data to provide their service to us, under their data protection terms. We do not share your data with advertisers or data brokers.

Memories in your family's vault are visible to the family members you invite. Only invite people you trust with them.

We may also disclose information if the law requires it, to protect someone's safety, or if Harma is ever transferred to a new owner, who would have to keep your information under this policy.

Your personal information is stored and processed in the United States. Where we transfer data outside the UK or EEA, we rely on the safeguards our providers offer for this, such as the Standard Contractual Clauses and the UK International Data Transfer Addendum. Where we transfer data outside Australia or New Zealand, we take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles and New Zealand's privacy principles.

• Account details and memories: for as long as your account is open, or until you ask us to delete them
• Founding family record (name and email): for as long as the founding family rate applies to you, or until you ask us to delete it
• Consent records: 3 years from the date of consent
• Analytics data: up to 26 months
• Backups: we keep encrypted backup copies of Harma so memories can be recovered if something goes wrong. Something removed from Harma can stay in a backup for a while after. We only use backups to restore Harma after a fault, and we remove your data from them when you ask us to.

You can remove your account at any time in Settings, under “Your account”. We ask you to confirm with an emailed code or your password first.

• Your name, email and sign-in are removed.
• If other family members are in your child's vault, the memories you added stay in the vault for your child, shown as from “Family”. If you'd like any of them removed too, remove them before you leave, or email us and we'll help.
• If you're the only person in the family, every memory in the vault is removed for good.

You can download everything first, in Settings, under “Take everything with you”.

Wherever you live, you can unsubscribe from our emails at any time using the link in any email, or by contacting us at hello@harma.app. You can also ask for a copy of your data, ask us to correct it, or ask us to delete it.

Additional rights by region:

To exercise any right, email hello@harma.app. We may need to confirm it's really you first. We will respond within 30 days.

When you create an account, you will receive a welcome email and occasional product updates. Every email clearly identifies Harma as the sender and includes a one-click unsubscribe link. Our address is included in every email as required by the US CAN-SPAM Act: James Bell, Sydney NSW 2096, Australia.

Sign-in codes are only sent when you ask for one. They are not marketing and are not affected by unsubscribing.

We use encrypted data storage, HTTPS for all data in transit, and access controls so each family can only see its own vault. Removing an account needs a fresh emailed code or your password. No system is perfectly secure, so please use a password you don't use anywhere else and keep your email account safe. If we become aware of a breach likely to affect you, we will notify you and the relevant authority as required by law.

Harma is for adults. Children cannot create accounts, and Harma is not directed at children under 13 (or under 16 in the UK). Our platform is designed for adults capturing memories for children.

Memories you add may include photos and stories about your children, and about other people. They stay private to your family's vault and are only visible to the family members you invite. Please only add things the people in them would be comfortable with your family seeing.

When we update this policy, we will update the date above and increment the version number. For material changes, we will notify you by email before the change takes effect.

Questions, concerns, or requests about this policy:

• Email: hello@harma.app
• Address: James Bell, Sydney NSW 2096, Australia

We will acknowledge within 5 business days and resolve within 30 days. If you are not satisfied with our response, you have the right to escalate to your local data protection authority (see Section 10).

See also our Terms of Service.