A personal story without unnecessary personal details.

What the story needs, and what can stay with you.

A parent account provides sign-in and journey management. The story uses a destination, date, local times and message text. You can choose a public place or approximate area instead of an exact home address. The app does not require the phone’s location.

Use a nickname, a family name or no name. Age and gender are optional. Leave out sensitive details that a cheerful letter does not need. Voice and AI images are not generated, and story content is not sent to a generative model.

An invitation opens a shared view.

Anyone with a valid link and PIN can read delivered messages and see that journey’s destination. Addressing a child does not limit visibility. Revoke an individual invitation in preparation. A second parent accepting a separate invitation with their own account has equal management rights.

Read the story as another invited relative would before sharing. The child’s view cannot change the plan; accompany a child who is reading on your signed-in parent device.

Which services are involved.

Clerk handles sign-in. The app runs on Railway with encrypted family records. Mapy.com processes place searches and coordinates needed for the route. Encrypted backups are stored in private Google Cloud storage in the EU.

Stripe receives the price, currency and opaque purchase ID and collects billing information. It does not receive the destination, children’s names or story. Resend sends purchase confirmations containing order information and the buyer’s email, without the family story. Purchase records are separate from journeys.

Keep the memory or choose deletion.

New journeys stay as memories by default. Choose deletion of the journey’s family details on January 30 after gift time; the app shows the exact date. Older journeys retain their previous choice until changed. Keeping a memory does not extend invitations.

Export or delete a journey under Memories and privacy. Deleting the journey removes it from both parents and all child invitations. Deleting one parent’s account instead leaves the shared journey with the other parent. Manage the account through My account.

Encrypted backup snapshots have a deletion rule after seven days. A separate deletion record prevents removed family content from being restored from an older backup. Deletion does not mean every backup copy is physically overwritten immediately.

Operational statistics have separate retention.

The app stores action types, preparation/playback progress, map usage and payment state under opaque account and journey identifiers. They contain no addresses, coordinates, names or message text. Detailed events last 90 days, runs and usage up to 730 days; story and payment summaries last until account deletion.

Deleting a story keeps its statistical record. Deleting an account removes its linked statistical records; daily aggregate counts and amounts remain. Read the current app notice for the full explanation and Radek Duha’s contact. This overview does not replace that notice or the public website’s cookie policy.