GraveStory

1. Information We Collect

Photos. When you scan a gravestone or share a remembrance, the primary gravestone photo and any supporting photos you choose are uploaded to Cloudflare R2. Photos are never used for advertising or sold to third parties. Public photos are displayed only when the associated story is approved and public.

Location data. With your permission, we may read GPS embedded in a photo or your device’s current precise location. You may instead search for a cemetery, drop a pin, or provide no location. Coordinates are stored with the story only when supplied. GPS-less public stories appear in Community Stories with “Location not provided” and never receive a map pin. To suggest nearby cemeteries, the app sends your coordinates to our server (Cloudflare), which checks a public list of cemeteries and, when that list has no answer, asks OpenStreetMap's Nominatim service using a rounded location.

Account information. If you create an account, we store your email address and an optional display name via Supabase (our database provider). You may also sign in with Google, in which case Google shares your email address with us.

Story and moderation data. We store generated biographies, user-written remembrances, gravestone inscriptions, names, dates, cemetery locations, publication and moderation status, Terms acceptance time, content reports, contributor reports, and account-level blocks. Reports are retained as a tamper-resistant moderation record; reporter identifiers are removed if the reporter deletes their account.

Research details. Before research starts, you can correct the names and years we read from the stone and choose or type a cemetery. We use these details, together with the gravestone text, to search for records.

Scan and purchase records. We record how many gravestones you have scanned (to enforce free-tier limits) and how many scan credits you have purchased. Purchase records are written by our payment webhook and are never modifiable by clients.

Device identifier. On sign-up we generate an anonymous hardware fingerprint (a hash of device brand, model, and OS version) to deter abuse. This hash cannot be reversed to identify you personally.

2. How We Use Your Information

• To generate biographical stories with Google Gemini AI or OpenAI. Your photo and the gravestone text are sent to Google to read the stone. The names, dates and cemetery from the stone, and passages from the records we find, may be sent to Google or OpenAI to write the story. Your photo is never sent to OpenAI.
• To search the web for public records about the person on the stone (Tavily finds pages and Firecrawl reads them), and public genealogy and historical records (WikiTree, Wikidata, Wikipedia, Library of Congress Chronicling America, OpenStreetMap), to enrich the biography.
• To display your stories on your personal map and, if you opt in, on the community global map.
• To display approved public stories, including GPS-less stories, in Community Stories.
• To screen public photos and user-written text for gravestone relevance and prohibited content, route ambiguous submissions to human review, investigate reports, enforce blocks, and process takedowns.
• To enforce free-tier scan limits and credit balances.
• To sync your stories across devices when you are signed in.

3. Third-Party Services

GraveStory relies on the following services, each governed by its own privacy policy:

• Google Gemini AI — photo and text processing (Google Privacy Policy)
• OpenAI — writing biographies from the gravestone text and the records found (OpenAI Privacy Policy)
• Supabase — database and authentication (Supabase Privacy Policy)
• Cloudflare R2 — photo storage (Cloudflare Privacy Policy)
• Tavily — web search for genealogy results
• Firecrawl — reading public web pages found during research
• WikiTree, Wikidata, Wikipedia — public genealogy and encyclopedia data
• Library of Congress (Chronicling America) — historic newspaper archive
• OpenStreetMap / Nominatim — cemetery geocoding and maps
• RevenueCat — in-app purchase management (RevenueCat Privacy Policy)
• Google (OAuth sign-in) — optional Google account sign-in

4. Public Stories and Community Map

If you request public sharing and the story is approved, its text, approved photos, name, dates, contributor display name, and any location you provide become visible in Community Stories. A story with coordinates may also appear on the Community Map. A story without coordinates shows “Location not provided” and remains off the map. You can make your own story private or delete it at any time; it is removed from public queries immediately. Other users may report public stories or contributors and may block a contributor so that contributor’s stories no longer appear in their feed or map.

5. Accuracy and How We Guard Against Fabrication

GraveStory uses generative AI to write biographies, and we take the risk of AI “hallucination” — confidently invented facts — seriously. A fabricated life story about a real person who is buried somewhere is not acceptable to us. We have built multiple safeguards into the app specifically to keep the biographies grounded in evidence rather than in the AI’s imagination:

• Grounded only in real sources. The AI is instructed to write only from the gravestone itself and from numbered, externally retrieved sources — never from its own training memory. Its guiding rule is that “memory is not a source.” A short, honest biography is treated as a success; an invented one as a failure.
• No sources, no AI. When our research finds no supporting records at all, we do not ask the AI to write a biography. Instead the app returns a short summary drawn strictly from the words on the stone. This removes the most common path to fabrication entirely.
• Cross-source corroboration. Before writing, we cross-check names, dates, and burial places across independent sources (WikiTree, Wikidata, Find A Grave, BillionGraves, historic obituaries, the Library of Congress newspaper archive, and the Internet Archive). Agreement raises confidence; conflicts are flagged to the AI explicitly, and the date carved on the stone is preferred over conflicting records.
• Citations on every claim. Each factual statement in a biography must carry a numbered citation pointing back to the source that supports it. Our software validates these citations after generation, removes any orphaned or invented citation markers, and surfaces the underlying sources to you so you can check them yourself.
• Evidence-scaled length. The depth of a biography is capped by how much evidence actually exists. A single weak source yields only a paragraph or two; a fuller life history is permitted only when multiple independent sources agree. The AI is told not to pad a story with generic filler.
• “Same name” protection. When matching a person to historical records, we reject candidates whose dates differ significantly from the dates on the stone, so a stranger who merely shares a name is not mistaken for the person you photographed.
• Famous-figure guardrail. A biography is only allowed to draw on the wider public record of a well-known historical figure when the dates on the stone match that figure within a few years and an encyclopedia article confirming the same person is present in the cited sources. This prevents an ordinary person from being mistakenly given a famous namesake’s life story.
• Photo verification. Before any biography is attempted, the app first checks that the photo actually shows a gravestone, reducing nonsensical output from unrelated images.

No automated system is perfect, and we cannot guarantee that every detail is correct — historical records themselves contain errors, and weathered stones can be misread. We encourage you to treat the biographies as a respectful, source-cited starting point and to verify important details against the cited sources.

6. Data Retention

Your stories and story-linked photos are retained until you delete them or delete your account. Deleting a remembrance removes its story-photo objects from Cloudflare R2 and immediately soft-deletes its story, photo, and gallery references so they are no longer publicly accessible. Other saved-story deletions likewise remove public access immediately and may retain a tombstoned sync record until account deletion or a verified erasure request. Account deletion removes associated story photos, story records, and account identifiers. Content reports may be retained for moderation, legal compliance, and abuse prevention, but reporter and reported-user identifiers are anonymized when the related account is deleted. Scan event records used for usage limits are retained for 12 months.

7. Your Rights

• Access & export — contact us to request a copy of your stored data.
• Deletion — delete individual stories from within the app. To delete your entire account and all associated data, open Settings → Delete Account in the app, or follow the instructions on our account & data deletion page (which also covers requesting deletion by email if you no longer have the app installed).
• Correction — update your display name in the app’s Settings screen at any time.
• Opt out of public sharing — set your default visibility to Private in Settings, or toggle individual stories to private.

8. Children

GraveStory is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. Security

All data is transmitted over HTTPS. Supabase Row Level Security policies restrict private stories and photos to their owners and expose public photos only when their owning story is approved and public. Authenticated photo uploads are stored under unguessable, per-user story keys. Purchased credit balances are write-protected at the database level — only our server-side webhook can add credits.

10. Changes to This Policy

We may update this policy from time to time. The effective date at the top of this page will reflect the most recent revision. Continued use of GraveStory after a change constitutes acceptance of the updated policy.

11. Contact

Questions, data requests, or account deletion: edmondsj46@gmail.com