Privacy
Privacy Policy
Effective August 9, 2026
Root & Bower is built to preserve deeply personal family history. This policy explains what information we collect, why we use it, when it is shared, and the choices available to you.
The short version
We do not sell personal information. We do not use targeted advertising. We do not use private sanctuary content to train generative AI models. We use account and sanctuary information to provide, secure, operate, and improve Root & Bower. Content you intentionally make public can be viewed by the public.
1. Scope
This Privacy Policy applies to Root & Bower websites, accounts, sanctuaries, partner tools, and related services (collectively, the "Service").
It should be read together with our Terms of Service.
2. Information we collect
Account and authentication information
We collect information such as your email address, display name, account type, authentication identifiers, and account security information. Password authentication is handled through our authentication provider; Root & Bower does not store your password in readable form.
Sanctuary and family-history information
You may provide names, dates of birth and death, biographies, relationships, life events, family connections, and other information about yourself, living people, deceased people, and pets.
Stories and preserved media
We collect the stories, photographs, audio recordings, videos, documents, keepsakes, captions, descriptions, metadata, and other content you choose to preserve. We may also process technical information about uploaded files, such as file type, size, dimensions, duration, and storage location.
Stewardship and invitation information
We collect information necessary to provide shared stewardship, including invitation email addresses, relationship labels, assigned roles, permissions, invitation status, and sanctuary membership records.
Partner information
For funeral-home and organization accounts, we may collect organization name, business contact information, website, phone number, mailing address, and information about family contacts invited to receive stewardship.
Purchase and transaction information
When you purchase Memory Land or another paid product, our payment provider processes payment-card information. Root & Bower receives transaction information such as the product purchased, amount, currency, checkout status, payment identifiers, and the email associated with the transaction. We do not receive or store your complete payment-card number.
Device, session, and operational information
Our service providers and infrastructure may process IP addresses, browser and device information, timestamps, request logs, authentication cookies, security events, and similar technical data needed to deliver and protect the Service.
Preferences and communications
We may store preferences such as light or dark appearance and collect information you send when you contact us, respond to account notices, or communicate about a sanctuary or purchase.
3. How we use information
We use personal information to:
- create, authenticate, and maintain accounts;
- create, display, preserve, organize, and protect sanctuaries and User Content;
- enforce sanctuary visibility, stewardship roles, and access permissions;
- send authentication messages, sanctuary invitations, transaction notices, security notices, service announcements, and other operational communications;
- process purchases, provision Memory Land, and maintain transaction and entitlement records;
- prevent fraud, abuse, unauthorized access, and security incidents;
- troubleshoot, maintain, measure, and improve the Service;
- comply with law, valid legal process, and enforce our agreements; and
- protect the rights, safety, and integrity of Root & Bower, our users, and others.
4. How information is shared
With people you authorize
Information is shared with sanctuary members and stewards according to their roles and the visibility settings you or another authorized administrator choose.
Publicly, when you choose public visibility
Public sanctuaries and public content can be viewed by anyone. Public pages may be indexed or cached by search engines and may be copied or retained by third parties outside our control.
With service providers
We use service providers to operate Root & Bower. Current categories include authentication and database infrastructure, cloud object storage and delivery, payment processing, and transactional email. Current providers include Supabase, Cloudflare, Stripe, and Resend.
These providers process information on our behalf or as otherwise described in their own applicable terms and privacy notices.
For legal, safety, and security reasons
We may disclose information when we reasonably believe disclosure is required by law or valid legal process, or is necessary to prevent fraud, investigate abuse, protect security, enforce our agreements, or protect the rights or safety of a person.
Business transfers
If Root & Bower is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, information may be disclosed as part of due diligence and transferred as part of that transaction, subject to applicable law and appropriate confidentiality safeguards.
5. We do not sell personal information or run targeted ads
Root & Bower does not currently sell personal information for money or other consideration, and we do not currently use personal information for cross-context behavioral or targeted advertising.
We also do not currently place third-party advertising trackers on the Service. Because we do not currently engage in these activities, legacy browser "Do Not Track" settings do not change how the Service operates. Where an applicable law requires recognition of a universal opt-out signal for a processing activity we conduct in the future, we will implement that requirement before engaging in that activity.
6. Cookies and local storage
Root & Bower uses cookies and similar browser storage that are necessary or useful for account sessions, authentication, security, and site preferences. For example, authentication cookies keep you signed in, and local browser storage may remember your selected appearance theme.
We do not currently use advertising cookies for behavioral advertising.
7. Public and restricted sanctuary content
Privacy on Root & Bower depends in part on the visibility choices made by sanctuary owners and administrators.
Restricted content is protected through application access controls, but no internet service can promise absolute security. Public content should be treated as information you are comfortable making broadly available.
Root & Bower is not a "zero-knowledge" storage service and does not represent that sanctuary content is end-to-end encrypted. Our systems and service providers must be able to process content in order to provide functions such as storage, image optimization, playback, access control, backups, and display.
8. Data retention
We retain account information for as long as an account remains active and as reasonably necessary to provide the Service. Sanctuary content is generally retained until it is deleted by an authorized user, the associated account or sanctuary is closed, or we remove it under our Terms.
We may retain limited information for longer when reasonably necessary for security, fraud prevention, dispute resolution, legal compliance, tax or accounting obligations, transaction records, or enforcement of our agreements.
When data is deleted from active systems, residual copies may remain for a limited period in backups or logs until they are overwritten or no longer needed.
9. Service discontinuation and export
Root & Bower is designed for long-term preservation. If we permanently discontinue the Service or can no longer maintain stored sanctuaries, we intend to make reasonable efforts to notify affected users at their account email addresses, send repeated reminders when practicable, and provide a reasonable opportunity to export or download sanctuary information and individual preserved items before deletion.
Self-service full-sanctuary export may not be available at all times or for every data type. Until such tools are available, requests for access or copies may require manual assistance.
10. Your privacy choices and rights
Depending on where you live and which privacy laws apply, you may have rights to request access to, correction of, deletion of, or a portable copy of certain personal information, and to appeal a denial of certain requests.
You can directly change some account, sanctuary, content, and visibility information through the Service. For requests that are not available through self-service tools, contact privacy@rootandbower.com.
We may need to verify your identity and authority before acting on a request, particularly when a request affects shared sanctuary content or information concerning another person.
We will not discriminate against you for exercising a privacy right provided by applicable law.
11. Information about living people who are not account holders
Root & Bower permits users to preserve family-history content about people who may not have Root & Bower accounts.
If you are a living person and believe a sanctuary contains inaccurate, private, unauthorized, or harmful information about you, contact privacy@rootandbower.com. We may request information reasonably necessary to verify your identity and evaluate the request.
12. Children
Root & Bower accounts are intended for adults age 18 and older. We do not knowingly permit children to create accounts.
Adults may preserve family-history content that includes minors, but they are responsible for having appropriate authority and for choosing privacy settings suitable for that content. If you believe a child has created an account or that information about a child has been posted without appropriate authority, contact privacy@rootandbower.com.
13. Security
We use administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, and alteration. These measures may include access controls, encrypted network connections, authentication, permission checks, and security practices provided by our infrastructure vendors.
No storage system, transmission method, or internet service is completely secure. You should keep independent copies of irreplaceable originals and protect your account credentials.
14. Data processing locations
Root & Bower and our service providers may process and store information in the United States and other locations where our providers operate. Those locations may have privacy laws that differ from the laws where you live.
15. Changes to this Privacy Policy
We may update this Privacy Policy as Root & Bower evolves. If we make a material change, we will provide reasonable notice, which may include email or an in-product notice.
We will not rely on a quiet policy update to begin materially broader use of previously collected private sanctuary content when applicable law requires additional notice or consent.
16. Contact
Privacy questions and requests may be sent to privacy@rootandbower.com.