Everything families ask

Right now there is a list, unless you have a founding code. Anyone can make a login; opening an archive is invite-only during our founding period, so a code — from us or from a founding family — is what opens one today. Without a code you still fill in the whole form and go on the list, but only part of it is stored: your name and email, your missionary's name, the day they report, your phone. The mission, their email address and your mailing address are not kept, and we will ask again when we open. Waiting families get money off the setup fee. If a code will not go through, email support@missionarylegacy.com.

One form, about five minutes, with the call letter in front of you — plus one thing the letter can't give you. First a login: email and password. Then young missionary or senior couple, their first name, Elder or Sister, their @missionary.org address, the mission, the day they were set apart, and the preparation day if you know it. Then your name, phone and mailing address — for posting the book, not for a card. No payment details are taken at signup. Afterwards a short setup wizard asks for a personal email for your missionary, because the church address closes within months of homecoming. You may have to ask them for it.

Wait for the call before you create the archive — but do set up the call opening now. The form asks first whether the letter has arrived, and if you say not yet it stops there: the mission, their address and the report date are all printed on that letter, so there is nothing useful to fill in before it. The opening is different. It happens once, and you can host it on our call page with no account — invite everyone, open the letter together, and we keep the recording until you start an archive. Come back the day the letter comes; your login is saved.

You land on a short setup wizard, and a welcome email goes out to you. The wizard asks for anything signup couldn't — chiefly a personal email for your missionary — then offers their photo album and family invites. Finish later is on every screen; whatever you skip waits on the dashboard, which shows your private capture address. Your missionary gets their own email with three addresses: the weekly one, one for voice memos, one for letters from home. In the background we build your permanent call link and family chat room and invite them in, retrying if Google is slow. Day-three and day-seven emails follow only if something is still undone.

No. They never create an account and never log in. The whole ask is that they add your archive's address to the weekly email they already write home — To, CC or BCC, it makes no difference — and their welcome email from us contains that address, so they never have to ask you for it. From then on each letter files itself into the right mission week with its photos. The one thing they do tap is a Google Chat invite for the family thread, which arrives at the same address.

Then that week's letter does not arrive, and it is worth saying plainly: we only ever see mail actually sent or forwarded to your archive's address. We do not read anyone's inbox. There are two fixes. Forward the letter yourself whenever you notice — it still files under its original date. Or set a rule in Gmail: add the capture address under Forwarding, then a filter from your missionary's address. Google sends a confirmation code to us and we email it on to the account owner, so check with them if the account is not yours. You can also paste a letter in by hand.

Yes — and it is the same job whether you are a year in or the mission is already over. In Gmail, label your missionary's letters, export just that label from Google Takeout, and upload the .mbox on the Archive Rescue page. Each letter keeps its own date and drops into its real mission week, attached photos file alongside it, and duplicates are recognised by their content — so several exports merge into one archive instead of four copies. One catch: only the account owner and parents can upload. Siblings and grandparents can export their own mailbox, but they will need to send the file to a parent, or be made a parent first.

Five things, and two of them bite. The "only keep letters from" box is prefilled with your missionary's address — clear it and every email in the file is imported as a letter, bank alerts and school newsletters included. And there is no bulk undo: a wrong import comes out one letter at a time, by hand. Files over 300MB are refused, so export one label rather than the whole inbox. Letters with no readable date are filed under today, and the result tells you how many. The mailbox file itself is deleted when the rescue finishes — or within a day, if you close the tab partway.

Whoever will handle the money and can be reached — usually a parent. That person becomes the account owner, and there is exactly one per archive: only the owner can change billing. It matters for privacy too. Call recordings and their transcripts are visible only to the owner and to parents; everyone else sees the moments those two choose to keep. Parents can do almost everything an owner can — add people, edit the archive. Ordering the book and changing the plan stay with the owner. If you pick wrong, ownership can be handed to another member later without starting over.

One login, two archives. An archive follows one mission — its own letters, calls, chat and book — so a second missionary means a second archive, and you switch between them from the menu at the top. Nothing about the first one changes. During the founding period a founding place covers one missionary, so a second archive is something we have to open for you: tell us about them and we will be in touch. A senior couple serving together is one archive, not two, with a separate before-the-mission story for each of them.

No card at signup — the form takes your mailing address for the book and nothing else. Payment happens later, on the Billing page. If you came in on a founding code there is nothing to pay: a founding place is free for this missionary's whole mission and stays free, and only a printed book is charged. Otherwise there is a 14-day trial, and if your missionary has not reported yet, billing waits until the mission start date instead, up to a year out — before they leave there are no letters to file and no calls to keep. A gift code is redeemed on that same page.

No, as long as you create the archive using the same email you hosted the opening with. When you do, we link it to you, remove its expiry date, and put the video into the archive dated to the day you actually opened the call — so it sorts to the front of the story rather than to your signup day. An opening nobody ever claims is kept about 90 days, with reminders before anything is removed. If the two emails do not match, write to us and we will attach it by hand.

No. There is no account for them and nothing to install. Everything reaches them by ordinary email, plus a Google Chat room the archive opens for them automatically once their email is on the profile. Their archive is opened by a private capture address, not a password — mail sent to that address is what gets archived. The only web pages they ever see are no-login links we email them: one to choose their journal passcode, and the approve-or-discard page for a voice memo. Even the welcome email's button points at our public site, not at an archive.

A little more than nothing, and you should know what. If you put their email on the profile, they get a welcome email listing their addresses, an invite to a Google Chat room, one biographer question on preparation day, and a note on their birthday. If you leave that field blank, nothing is ever sent to them and letters still arrive through your forwarding. None of it requires a reply.

Someone has to send mail to the capture address. Either they add it to their weekly family email list, or you forward their letters, or you set Gmail to auto-forward. Capture is address-scoped: only what reaches that address is archived — we never read their mailbox and have no access to their account. If Google sends a forwarding confirmation code, it is not filed as a letter; we relay it to you so you can finish the setup.

One question, on their preparation day, in a chat room of their own. It comes from "Mission Biographer," which opens by saying it is not a person and to ignore anything they'd rather not answer. If chat isn't reaching them, the questions go by email instead — the day before P-day, several in one message, marked "only answer the ones you want." Both channels need a preparation day on the profile. With none recorded, nothing is asked at all, by chat or by email. Add their P-day so the biographer can speak.

Everyone signed in to your archive. The chat room holds only them and the biographer, but the questions and their answers appear on the archive's conversation page, which every role can open, and the answers feed the book. The biographer's intro says their words go "into your story, and nowhere else" — true, but your story is a family archive, not a private notebook. The sealed journal is the private place.

The words are private; the seal is not. Only your missionary can set the first passcode through the app — a parent pressing that button is refused. But an owner or parent controls the recovery address the setup and reset links are sent to, and once a passcode exists they can also set a new one from the locked screen and read everything. Nothing notifies your missionary when that happens. While locked you see counts and dates only, never a title or a word. Treat it as private from the family, not sealed against them.

Then nobody can read that journal in the app — including you. Entries they email still arrive and are stored; the page shows a setup card instead of any content until a passcode exists. Save their email under Passcode & recovery and send them the setup link. One thing to know: their large-plates entries still print in the book whether or not a passcode was ever set.

They record on their phone, email the memo to one of their two plates addresses, and it comes back transcribed for approval. Any reply seals it; replying "discard" throws it away. Small plates seal privately; large plates are the record you can read, and those recordings are kept and stay playable. Two limits worth knowing. A memo over 20 MB is neither transcribed nor kept — it survives only in their Sent folder, and lossless recordings are usually that big. And the older "voice journal" address in their welcome email transcribes the words but does not keep the recording. The plates addresses are the ones that do.

The large plates, yes; the small plates, no — not unless the seal is broken. Owners and parents read large-plates entries without the passcode, and those entries print in the book. A large-plates recording can also become a printed listen code — once it might be in a book, we won't let it be deleted. A small-plates entry prints only when it is stamped from behind the passcode. That is meant to be your missionary's own choice, and here is the catch: a parent who resets the passcode can unlock the journal and stamp it themselves.

No — there is no view for them. They see what we email them and their own chat rooms, and that is all. If you want them inside, invite their personal address the way you'd invite anyone else in the family, with a parent or member role, and they sign in with their own login. The account owner can also transfer ownership to them. Nothing does any of this automatically.

By hand, today. The profile has a field for their personal address — it refuses a church address on purpose, because that account closes within months of release — and we push you to fill it in as release approaches. But that field is only stored. Nothing automatically sends them the archive at homecoming. The real handover is inviting them as a family member and transferring the account, or writing to us. We'd rather say that than let you assume.

Clear their email from the missionary profile and everything we send them stops — the weekly question, the birthday note, new chat invitations. The archive keeps working on whatever you forward. Three honest catches. A Google Chat room already created keeps delivering whatever the family writes in it; your missionary has to leave that room themselves. The weekly question email carries no unsubscribe link and does not check our suppression list, so it stops only when that address is removed. And a reply asking us to stop is filed in the archive as an answer, not read by a person. Write to support instead.

Your archive has its own private email address, and anything sent to it is filed. Your missionary puts it in the To, CC or BCC line of the weekly email they already write, or you forward that email from your own inbox. Either way it arrives, is dated, and lands in the right mission week. Photos attached to it are pulled out and filed beside it — the first thirty in any one email. A thirty-first is not saved and nothing warns you, so a photo-heavy week is better sent as two emails. Video, PDFs, documents and audio are not kept on this route.

No. We never connect to your mailbox and never ask for a password. Capture runs one direction only: mail that is sent or forwarded to your archive's address arrives here, and nothing else does. That means nothing in your inbox is swept up by accident. It also means a letter nobody sends to the address is a letter we never see. And there is no sender check on the way in — anything that reaches that address is filed as your missionary's letter, whoever sent it. Keep the address private, and use it only for their letters.

Yes, and plenty of families do both. In Gmail, add your capture address under Forwarding, then create a filter for your missionary's address. Google sends the confirmation code to the address you are forwarding to — which is us — and we pass it straight on to the owner or parent on the account, because only a person inside Gmail can finish that step. If two of you have parent access, check with each other: it goes to one inbox, not both. The Gmail phone app has no Forwarding setting; open gmail.com in a browser and switch to Desktop site. Letters you forward by hand file correctly meanwhile.

It is stored once. Each incoming letter is reduced to a hash of its real text, with quoted replies and signatures stripped, and a copy already in the archive is collapsed instead of added. The same protection makes re-running an import safe. One caveat worth knowing: when a duplicate arrives by email it is dropped whole, so if the second copy carried photos the first did not, those photos do not come in. The .mbox import is smarter about that — it merges photos from a duplicate into the letter already there.

No — it keeps its original date whenever the forwarded message carries one. We read the Date: or Sent: line inside the forward, accept it if it parses and is genuinely in the past, and file the letter into the mission week it belongs to. If there is no readable date in the forward, the letter is filed on the day it arrived. That is the honest fallback rather than a guess, and you can correct the date yourself on the letter afterward.

Yes — that is Archive Rescue. Export the letters from Gmail with Google Takeout and upload the .mbox file, up to 300 MB. Each letter keeps its own date, photos come with it, and copies already in the archive are recognised rather than repeated, so exports from several relatives merge instead of doubling. Two things to check. The upload runs from an owner's or parent's login, so a sibling's export has to come through one of them. And the sender box is prefilled only if your missionary's address is on their profile — leave it empty and every email in the file imports as a letter. The upload is deleted when the rescue finishes.

Nobody can tell you your date, and anyone who states one confidently is guessing. The Church publishes no schedule. Families widely report losing access around 90 days after release and deletion around 180, and the timing changed in 2024. Here is the calming part: every letter they sent home already sits in your own inbox, and closing their account does not reach into yours. What is on a clock is anything living only in that account — their Google Photos, Drive, contacts, sent mail. Have them sign in at mail.missionary.org, then read our guide on saving it.

Everyone on the family list, in one of two ways. Someone with the app on their phone gets the letter as a notification; everyone else gets an email with the opening lines and a link to the whole letter. People who follow by email, with no account, get the letter in full with up to six of its photos. Two things to know. A member who turns letter notifications off on their phone still counts as told once anyone's phone buzzes, so their email stops too. And a letter already more than a week old when it lands notifies nobody — rescuing two years of history will not mail anyone ninety times.

Anyone holding your follow link can add any email address, with no approval from you. That is the trade for it needing no account, so share the link deliberately rather than posting it. On the Family page, owners and parents see the full follower list and can remove someone or add a grandparent directly, and every letter carries a one-click unsubscribe. Keep in mind what a follower receives: the letter itself, in full, including the names of people your missionary writes about.

They are delivered and kept — provided your missionary's email address is on their profile, because that is where the letter is relayed. Writing from the app sends it and saves a copy filed under your name, photos included. Every family member also has their own private write-in address; owners and parents see them on the missionary's profile and pass each one on. Email yours and the letter reaches your missionary and lands in the archive attributed to you. These stay out of the biography, since the book is meant to be their words, and print in a Letters from Home appendix at the end — all of them by default, or excerpts, a digest, or none.

No, and this one is worth knowing before you rely on it. On that email route only the words are handled: your text is relayed to your missionary and archived under your name, and any attachment is dropped — not forwarded, not saved, no warning. To send photos, write from the Family Letters page in the app, which sends them with the letter and files them beside it in the archive. That page only accepts letters from owners and parents, so a sibling either needs parent access or has to hand the photos to one.

Forward it whenever you get to it — it files by its own date, not the day you sent it. If someone mistypes the capture address, our reply tells them it matched no archive, so nobody is left believing a letter landed safely; their copy is also still in their Sent folder. The archive does watch for silence — ten days with nothing, and a Gmail forwarding setup started but never confirmed — but that watch does not email you today. Do not wait to be told: if a couple of weeks go quiet, check the letters page or write to us.

On Premium it just happens — there is no record button. Your archive gets one permanent call room, and whenever anyone is in that room our recorder is sent in automatically, usually within a minute of the room opening, unless a family admin has switched the room to unrecorded on the Calls page. Capture starts when it arrives, so open the room a minute early if you want the first hello kept. The room is what records, not the person: a call held there is captured whether or not your missionary is on it. On Standard the room is the same room and the transcripts, summaries and moments are the same — but nobody is sent in for you, so you start the recording yourself on the Calls page.

They can see it, but you still have to tell them. The recorder shows up in the participant list as "Missionary Legacy" — a visible participant, never a hidden one. That is not the same thing as consent. Recording law differs by state and country, and your missionary is usually in another one, so the owner or parent using the room is responsible for telling everyone, including the missionary, before the first recorded call and again whenever someone new joins. One sentence at the start covers it.

No — family calls keep audio only. The recorder asks for a mixed audio file and nothing else, so no video of your weekly call reaches your archive. That is a storage decision: a weekly video call across a whole mission runs to roughly 104 GB. The one recording kept as video is the mission-call opening. When Google Meet also records the call natively, that copy is a video sitting in our service account's Drive, and we import only its audio into your archive.

Only the account owner and parents. The call list, the full transcript, the audio player and the moment review all sit behind that one capability; a sibling or grandparent who opens a call page is sent straight back, and the call is fetched with a key their account does not hold. Everyone else sees only the moments you keep, in the Story and the book. One rough edge: the "your call is in the archive" notification goes to the whole family, so someone may be told about a call they cannot open.

Yes. On the Calls page a family admin can switch the room to unrecorded: our recorder is not sent in, Google's own recording of the room is switched off, a recorder already inside leaves within a minute, and nothing from the room is imported while the switch is on. Switch it back whenever you like. Or simply hold the call somewhere else — FaceTime, WhatsApp, an ordinary phone call — and nothing records. On Standard the question does not arise: nothing records until you start it.

Yes — the room is created with open access, so anyone holding the link joins without knocking and there is no waiting room. That is on purpose: your missionary and grandma should never be stuck outside while someone hunts for the admit button. It does mean the link is worth treating like a house key. And on Premium, because the recorder follows the room rather than the people, any conversation held there is recorded, including one your missionary never joins.

Voices are separated acoustically, then named only where there is evidence. Ticking who is joining before you start narrows the candidates. Deepgram tells the voices apart, and a name is applied only above a confidence floor and only when someone is addressed by name or says who they are. Every other voice stays "Home" rather than a guess — a wrong name printed in a hardbound book is a false record of who said something. You can put the right name on any voice from the call page, and it rewrites the transcript the book prints from.

The call's short summary, plus the moments you keep. Every call with a summary prints inside its chapter unless you switch that call out of the book; the transcript itself never prints. Moments start undecided — green keeps one for the Story and the book, red leaves it in the archive only, and yellow is the biographer suggesting privacy, which is a suggestion and not a lock. Kept moments on a call that has audio also print a QR code, which anyone holding the book can scan to hear that piece of the call.

An owner or parent can delete any call with no kept moments, and the transcript, the undecided moments and the stored audio go together. A call with kept moments is refused until you un-keep them, because a kept moment may already be printed in the book as a code that must never go dead. The honest limit: deleting clears your archive, not our providers. The recording service keeps its own copy, and a natively recorded call also sits in our service account's Drive. Write to us if you need those gone too.

No — call audio is not mirrored off-site today. Photos and videos are copied to a second storage bucket as they arrive; call recordings and voice-journal audio live only in our primary storage. That leaves the most irreplaceable thing in the archive on a single copy, which we treat as a gap rather than a design, and we would rather say so than let you assume otherwise. If a particular call matters enormously to you, keeping your own copy is not a silly thing to do.

Yes — record it on speakerphone with the recorder on the Calls page. It uses your device's microphone, so it works with any calling app: WhatsApp, Messenger, FaceTime, a plain phone call. It records in roughly twenty-minute segments that upload while you keep talking, up to two hours, then travels the same path as a room call: transcript, summary, moments. Two limits worth knowing — only owners and parents can use it, and since it is your own device doing the recording, telling everyone is even more plainly on you.

Not in the app — they never log in and have no account, so they cannot open a call, read a transcript or delete anything. Everything captured from a call is held by your family. Nothing is sent to them for review, and we do not send them a recording notice of any kind, which is exactly why telling them yourself matters. If they ask for something to come out, an owner or parent can un-keep the moment, switch the call out of the book, or delete the call.

They answer from Google Chat, and they never sign in to Missionary Legacy. There is nothing to sign up for, but the address on their profile has to be a Google account — a mission email already is one. When a conversation opens we build a Google Chat space and invite that address; they accept and reply from the app they already carry. Each conversation is its own space, so expect an invitation per conversation, not one at the start. Your words arrive there with your first name in front of them, because an app cannot post as a person.

Both. There is a family room everyone reads, a private one-to-one thread for each person who has it switched on, and the biographer's thread. Each conversation is its own Google Chat space on your missionary's side, so they accept a separate invitation for each one, not just one at the start. You open your own from the chat page with "Just you and [their name]". Parents and siblings have private threads on by default; aunts, cousins and grandparents need a parent to switch it on.

No. A private thread belongs to the two people in it. A parent sees that it exists and how many there are, but cannot open one or read a word of it. Notifications follow the same rule, so a reply there taps that one person's phone and nobody else's. One honest limit on the parent's control: the "Private thread" switch in Family stops a new private thread from being opened, but it does not close one already running. To stop one that has started, write to us and we will do it. Oversight without surveillance, and we would rather say so now than have you find out later.

No, and this is the one to know. Words in a private thread stay private. Photos and videos do not. Anything with an image or a clip attached is filed into the family archive, where everyone with an account sees it on the Photos or Videos page, and a photo from your missionary can even be marked for the book. That is true in both directions: what they send you, and what you send them. If a picture is not for the whole family, do not send it in chat.

Only what someone chooses to keep. No chat message is printed by default. On a computer, hover a message and choose "Keep for the book" and it joins the archive beside the letters — the control is easiest to find on a laptop, and short one-liners are not offered it. "Keep a story" does the same for a run of messages you pick: the week the fever climbed, the day of the transfer call, kept as one titled, dated exchange with every speaker named. You are asked who actually wrote a kept message, because a forwarded letter's sender is not its writer.

Yes, both ways, and both are optional. Under a message from your missionary that still has untranslated text there is a Translate link; for English readers the result is saved, so it costs once. For your side there is a toggle above the message box that sends your message in their mission language; it is off unless you turn it on, then remembered for that thread on that device. Your own words are kept in the archive alongside what went over the wire. If the monthly AI budget is spent the Translate link says so, and an outgoing message simply goes as you wrote it.

No. There are no read receipts, and we will not invent one. Your thread says "sent" when a message reaches their Google Chat, which is all we can honestly claim; Google refuses to report another person's read position at all. The one real signal is a reaction. When your missionary taps a heart on something you sent, their name appears on it in your thread. That is the only proof of reading this product can give you, and it is why the reaction chips are there.

The archive keeps it either way. If your missionary deletes something on their phone, it stays in your thread and in the archive; their deletions are not mirrored back. If you unsend, the message leaves their Google Chat and the text stops showing in the thread, but the words remain archived. Edits keep the first version too, on both sides. One limit we owe you plainly: a thread shows its first 500 messages and there is no paging past that yet, so a very long conversation will need us to lift it. Tell us if you reach it.

From your missionary: photos, videos, voice notes and files. Photos become part of the archive with everything else; videos do too on Premium, and on Standard a clip is recorded by name so you can see it arrived without it being pulled into the archive. Voice notes and documents play or download inside the thread. Files shared from Google Drive can only be listed by name — those have to be opened in Google Chat. An image over 50 MB or a video over 200 MB is recorded by name only. From your side the chat box takes text and photos, nothing else — there is no way to send them a video or a voice note from here.

It is the archive's own correspondent, and its first message says so: "I'm not a person," then what it does and permission to ignore anything they'd rather not answer. It asks one short question at a time, only on their preparation day, and then waits. If nothing comes back it stays quiet for one more preparation day, then moves to a different question. The questions are small — how a name is spelled, who someone was, what happened with something they mentioned once. The first reply is filed against its question and goes into the book. Only the account owner and parents can open that thread.

Not with that switch today, and you should know it before you rely on it. The member page shows an "In the family chat" toggle, but the chat page does not yet enforce it: anyone with an account on your archive can write in the shared thread. The "Private thread" switch beside it is only half enforced — it stops a new private thread from being opened, but does not close one already running. Until both are fixed, the way to keep someone out is to remove their account, or write to us and we will do it for you.

The banner at the top tells you which. "is in this conversation" means they joined the room; "hasn't accepted the invitation yet" means nothing you have written has reached them; a third line says they are not in the room at all. Under the message box is "Send the invite again", safe to press repeatedly — re-inviting someone already in the room does nothing. We pull for replies on our own schedule all day, so you never have to refresh to make one arrive. If the banner says they are in and it is quiet, they are busy.

Yes. Paste the album's share link once on the Photos page and everything they add from then on comes in on its own. The first import starts immediately; after that a check runs every hour and brings in up to 40 new items a run, so a large back catalog fills over several hours rather than all at once. You get one notification when something genuinely new arrives — photos and videos announced separately. Videos are kept on Premium; on Standard the album's photographs come across and the clips stay in the album, where they remain yours. A shared Google Drive folder set to "Anyone with the link" works too, with one limit worth knowing: from Drive we read photos only. Videos have to come through the Google Photos album, or be dragged in from your computer.

You will see it, and so will we. Google closed third-party access to photo libraries in March 2025, so the album import reads the shared album's own web page — the same bytes the link shows any browser. That is an unofficial surface, and a change on Google's side can break it. Three failed checks in a row flip that source to a red error state on your Photos page with the reason written out, and alert us. The manual fallback stays open: download the album as a zip and drag it in.

You can add them, but only the account owner and parents can. Drag in loose photos, loose videos, or a whole .zip of photos. A Google Takeout zip is the best kind: its sidecar files carry the captions your missionary typed in Google Photos and each photo's taken-date, and both come across with the picture. One catch — a zip is unpacked for photos only, so a video inside it is skipped without a word. Drop clips in loose. Photos go up to 50MB each. Batches over 20 skip the per-photo AI pass so a big album uploads fast. Siblings and members can see everything but cannot upload, caption, file, or delete.

No, not for photos. Every incoming photo is fingerprinted twice: an exact byte hash, which folds a match in anywhere in your archive, and a perceptual hash that still recognizes the picture after Google re-encodes it, matched within two weeks of that photo's date. Either way it joins the photo you already have instead of becoming a second one. Video is weaker: a clip gets no perceptual fingerprint, and one you upload from your computer gets none at all, so the same clip added twice can land twice — delete the extra. And when a video first arrived as the still Google served for it, that still is marked a duplicate and hidden once the real clip lands — marked, never deleted.

When they were taken, whenever the file says so. We read the EXIF capture date out of the original bytes first, fall back to the album's or message's own timestamp, and only then to arrival time — and we record which of the three it was. Videos are the exception: no EXIF is read from them, so a clip is dated by the album's timestamp or by when it landed. The gallery sorts by taken-date, so a shot from April that arrives in September files back under April.

By date. Each area has a start and end date, and a photo files into whichever area was open on its own capture date. Because transfer news lags the transfer itself, photos from the first days in a new area often land on the old one — so whenever area dates change, every auto-filed photo re-checks its window and moves. Anything you file by hand is stamped as your decision and never moved again. An area with no dates receives nothing automatically; you place those yourself.

It writes a description, and on most photos it stays out of your way. A vision model suggests one sentence at intake — a generic read of who is in frame, "two missionaries," never a guessed name — plus a location guess, themes, and whether the shot looks book-worthy. Open a photo and you see the place, the people and the themes; the sentence itself is stored but not shown. The exception, and it matters: photos you upload from your own computer in batches of 20 or fewer take that sentence as their caption unless you typed one, and the book prints captions. The form only accepts a typed caption when you upload a single photo.

Yes, and that surprises people, so it is worth saying plainly. The words in a one-to-one thread stay in that thread. Photos do not. Any photo that moves through a chat, in either direction, is archived to the family photo library, where everyone in the archive can see it. Photos sent from home are filed under "From home" and kept out of the mission areas and the book; photos your missionary sends file into an area like any other. If a picture is meant to stay private, do not send it through chat.

Short ones. The app is written for clips up to 200MB, but the storage bucket it saves into is set to 50MB, and whichever is smaller is what gets enforced — so 50MB is the real limit today, about thirty seconds of 1080p phone video. Anything larger is refused from its size header before it is downloaded, and recorded with a reason instead of retried forever. Album photos cap at 30MB, direct uploads at 50MB. Family clips are kept; the video of your weekly call is not.

The ones flagged for the book and filed into an area — that is the default setting. The AI flags shots it judges book-worthy at intake; in an area where nobody has flagged or chosen anything, the earliest six are kept in automatically and the first becomes that chapter's lead image. Once anyone toggles a photo in that area, your choices stand. On the Book page you can switch the whole book to every photo in the archive, to curated (50 an area), or to no photos. Two exceptions to the area rule: a baptism photo set prints on its own, flagged or not, filed or not. "From home" photos print nowhere.

It prints as a QR code, not a picture. Choose a clip and it appears in a "Moving pictures" panel beside that area's chapter — scan the page with any phone and the clip plays. Two things to know. Those codes are bearer links: anyone holding the book can scan and watch, with no login. And a video you have chosen for the book cannot be deleted from the archive until you remove it from the book first, because the printed code has to keep working.

Mostly — and here is the part people do not expect. Deleting removes the database entry plus the original file and its thumbnails from live storage, so it leaves the app and the book. It does not remove the copy in our off-site backup mirror; that has to be done by hand, so write to us if a photo needs to be gone everywhere. There is also no self-serve export of your gallery yet — ask and we will produce one. Only owners and parents can delete.

The whole mission, area by area. It opens with a title page, the themes of the mission, and a full-page Journey plate. Then come the Parts: the years before, the country, the cities, the mission president, one chapter per area, and the people. Each area chapter carries their letters from that area, the weekly call summaries, their own journal, and the photos you chose. The final volume ends with letters from home and a directory of everyone — names, roles, baptism dates, and any address you entered. Video never prints; a QR code stands in for it. Sealed journal entries appear only where one was shared from behind the passcode.

One volume is about 400 pages, and the book splits when it outgrows that. The split happens at chapter boundaries, so a Part is never cut in half, and each volume gets its own front matter. Letters from home and the directory bind into the final volume only. Most missions run two or three volumes. You can name each one, or let it default to a name built from the areas that volume spans. The page count you see is an estimate from measured layout — words, photos, letters, and per-chapter overhead — not a guess.

$99 Standard, $199 Photo, $299 Heirloom — per volume, shipping included. A three-volume Standard set is $297; the same set in Heirloom is $897. Every edition holds identical pages; the difference is ink and binding. Your receipt itemises one line per volume, so you can see where the total came from. The number of volumes is computed from your actual book at checkout, never typed in by anyone. Only the account owner can place the order. Book printing opens at launch, after the founders testing period, so the buttons may still be waiting.

Yes, and the planner shows the page cost of every choice before you order. Photos are the biggest lever: every archive photo filed to an area, only the ones you flagged, the best 50 per area, or none. Letters from home can print in full, as short excerpts, as a condensed summary, or not at all. Weekly call summaries and their day-to-day journal each switch on or off. Nothing you leave out of the book is deleted — it stays in the archive. Save, and the estimate redraws.

No, and we would rather say so plainly. There is an Approve toggle on each chapter and the app asks you to use it, but nothing in checkout checks it. The book prints the chapters exactly as they stand the moment you order, approved or not. One thing does gate it: only chapters the biographer has actually written are in the file at all, so an undrafted Part is simply absent rather than blank. Read the proof before you order. That toggle is your own checklist, not a lock on the press.

Yes. Owners and parents can edit any chapter directly, word by word, and the edit is stamped so later automatic regeneration leaves your words alone. You can also tell the biographer how to revise it, rather than redrafting blind. There is a budget: four AI writes per chapter — a first draft and three rewrites — counted whether or not a run succeeds. After that the chapter is yours to shape by hand, or reply to any email from us and ask. Siblings and members read the book; they do not edit it.

A chapter unlocks when its story closes. The pre-mission Parts, the country, the cities, and the mission president open once the mission begins. An area chapter opens when they move on from that area, so it can hold the whole thing — every companion, the last week included. The chapters that look across the whole mission, and the people chapter, open at homecoming. Written earlier they would miss the parts that had not happened yet, and you would spend one of your four rewrites fixing it. Release opens everything at once.

Lulu prints it: A4 (8.27 by 11.69 inches), hardbound, colour throughout on 80# coated paper, with the Heirloom linen-wrapped under a dust jacket. We ship within the United States, and that is the only address checkout will accept. An overseas copy is arranged by hand, with the real postage quoted first — write to us and we will sort it. Today a person places each order with the printer by hand, working from your paid order, which carries the exact manufacturing spec recorded at the moment you bought it. That is slower than an automatic hand-off, and it is how orders are filled right now.

Yes, with one catch worth knowing. You can read every chapter in the app and download the press-ready PDF of each volume whenever you like. Every page of that copy carries a PROOF watermark and a footer line saying the printed keepsake ships without it. The clean, unmarked file is produced only for a paid order, so the free download is for reading and proofing, not for taking to another printer. Use it anyway — it is the same layout, the same pages, the same photographs the printer receives.

They are not his words, and the book says so. The country, cities, and place-context sections are written from public reference sources — Wikipedia article text — and each is printed as labelled context with its attribution underneath. The photographs in those chapters come from Wikimedia, public domain or Creative Commons only, credited by name and licence on the page, and copied into our own storage so a renamed file cannot blank a page years later. The closing colophon repeats the line: his letters made the story, public sources made the background.

Yes — anyone holding the book can scan them and hear the recording. That is the trade for a code that still works in twenty years: each one is a signed link to a single moment, with no login and no account check behind it. The codes print beside kept call moments, opening at the second it happened, beside voice-journal entries, and in place of video clips, which cannot print on paper. The player starts at that story, but a listener can keep playing into the rest of the call. Print with that in mind.

A printing or binding fault is replaced free — pages missing or out of order, a misprinted cover, a split spine. Send us photographs and we will reprint it. A typo in a chapter, a photo you wish you had swapped, or a moment you would rather not have shared are not defects: the book printed what your archive held the day you ordered, and a corrected reprint is a new order at the normal price. Extra copies for grandparents are new orders too. No edition includes a bundled second copy.

Every account reads the same shared archive — letters, photos, the family chat, the book — so an aunt reads what a mother reads. What changes by role is who can change things: owners and parents edit the archive, add and remove people and change settings; only the owner touches billing. Siblings and members read and write to their missionary but cannot edit. Four things are narrower. Call recordings and transcripts open only to the owner and parents. A personal one-to-one chat opens only to the two people in it. The biographer's thread is owner and parents only. And your missionary's journal: everyone sees that entries exist, owners and parents read the day-to-day ones, and sealed ones stay behind their passcode.

No. Call recordings and transcripts open only for the account owner and parents. A sibling or member can still open the Calls page — it is in everyone's sidebar, and once calls are set up the family's call link sits at the top of it — but the list of captured calls is not there, and opening a specific call redirects them away. What the rest of the family gets is what the two of you pass along: the moments you press Keep, and the call's summary, which goes into the book unless you switch that call off paper.

Yes, if you reset the passcode — so treat it as private by trust, not by lock. Only your missionary sets the first one; we email them a link and the family cannot set it for them. But once a passcode exists, an owner or parent can set a new one from settings, and an owner or parent also controls which address reset links go to. Whoever resets it can then read every sealed entry, and your missionary is not notified. Note too that only the small-plates journal, president letters and private entries are sealed — the day-to-day large-plates journal opens to owners and parents with no passcode at all.

No. A personal thread opens only for the two people in it — not for parents, not for the account owner, not for us in the operator console. What you hold is the door, not the contents: you can see that a personal thread exists and how many there are, and the personal-chat switch on a member's profile decides whether someone gets one at all. Words in a personal thread stay out of the book by default, and the two people in it can choose to keep something from it. An owner or parent can do that too, though nothing in the app shows them the words to choose from.

No, and this is the part families are surprised by. Words in a personal thread are private; photos are not. Any image or video sent in any chat is filed straight into the family photo archive, where everyone with an account can see it — the filing is scoped to the family, not to the thread it arrived in. So a photo sent privately to one sibling shows up in the gallery grandparents browse. Tell whoever uses personal chats, so nobody learns it from the gallery.

Not today, even though switches suggest otherwise. Every account can read and write the family thread whatever the "In the family chat" toggle on their profile says — nothing enforces it. "Joins calls" only decides who is offered in the who's-joining picker; your archive has one permanent Meet link, and anyone holding it can join. Personal chat is the switch with real force, and only going forward: turn it off before a thread exists and that member never gets one, but a thread already open stays open. If someone should not be in the room, the working answer is not to give them an account.

Account-level information — names, email addresses, roles, order and billing status, counts, last sign-in. The console shows no letter, journal, chat or transcript, and an export we send goes to the person it is about, never to our screen. One honest exception: when you order a book, one of us downloads the finished press-ready PDF to hand to the printer, so your missionary's chapters, letters and photos pass through our hands and Lulu's. Engineers who maintain the database and storage could also reach content if they went looking. We do that only to fix a problem you reported, or when the law requires it.

Anything behind a printed code, and then the rest of that call if they choose to. Each QR is a signed link that needs no login, so whoever holds the book can scan it, and we cannot tell who did. The player cues to the story and stops where it ends, but a "Keep listening to the call" button sits right underneath. Only moments you pressed Keep ever get a code — including any the biographer flagged as private, if you kept it anyway. Set-aside moments never print. Lend the book knowing that.

No archive is ever published, and nothing in one is indexed by search engines. Mission-call opening pages are the exception to "private": anyone with the link can open one, but they are marked no-index and show only a first name and last initial. Listen pages are no-index too. Two things behave like keys rather than doors — printed QR codes, and the photo links inside letters emailed to followers, which keep working for anyone the email is forwarded to. Followers receive letters by email and never see the archive itself.

No. The demo is entirely simulated: an invented missionary, invented letters, invented photos, an invented book. No real family's archive is shown publicly, on our site or anywhere else. The demo logins are read-only — you cannot edit, send or order anything, and nothing you do in there touches a real family's archive. If a name, a place or a story catches you in there, nobody wrote it home; it was generated for the example.

Four AI providers, and a fifth company that records. Anthropic and OpenAI draft and review book text, caption photos and translate; Deepgram turns call and voice-journal audio into words, with OpenAI's Whisper as the fallback; Google transcribes calls held in Meet and writes the notes we import. Recall.ai is the recorder that joins your Meet room, and it keeps its own copy of the recording. We use each under its business API terms, which say customer content is not used to train the provider's public models. Passwords, payment details and sign-in tokens never reach any of them, and sealed journal entries stay out of the book unless one is shared from behind the passcode.

They appear in your archive the way they appear in the letters, and your family is responsible for what you gathered. We never publish an archive. The printed book goes to the people you order it for — and, to be printed at all, the file passes through Lulu and the print and shipping firms it uses. On calls there is a guard: the biographer marks a proposed moment "private" when it carries someone else's circumstances — family, health, money — or a candid opinion about a named person, keeps it out of the call summary, and shows you the reason before you decide. Letters get no such screen.

$49 once, then either $19 a month for Standard or $24 for Premium while they serve. Nothing is charged until they leave — the setup fee goes on your first invoice, not on checkout. The first 14 days are free, and if your missionary has not left yet, billing waits for their mission start date, so the months before departure cost nothing. The printed book is separate: $99, $199 or $299 per volume, shipping included, and most missions fill two or three volumes. You cannot order one yet — printing opens at launch. Nothing else is on sale; there is no storage plan and no per-feature upgrade beyond the two tiers.

When they leave, not when you sign up. At checkout we set the trial to end on the mission start date you entered, up to a year out, so the months before departure are free — there are no letters or calls to capture yet. The standard 14-day trial still applies if they are leaving sooner; the mission date never shortens it. If you cancel before billing begins you owe nothing at all — the $49 setup rides that first invoice too, so if the invoice never comes, neither does the charge.

Once per archive, ever — and never at signup when a trial is running. The $49 is placed on your first real invoice, the one raised when the trial ends, so nothing is taken at checkout; if you cancel during the trial no invoice is ever raised and you are charged nothing at all, so there is nothing to refund. Only a subscription that starts with no trial pays it at checkout, because there the first invoice is today. Charged once, never again if you change plans, halved if another family referred you, and already included in a pass or a gift.

Two things, and only two. On Premium our recorder joins your weekly family call on its own and keeps the audio, so nobody has to remember to press anything; on Standard you record the call yourself in the call room and we transcribe what you captured. And Premium keeps videos alongside the photos, where Standard archives the photographs. Everything else is identical on both — every letter, every chat, the biographer's weekly question, the search, the timeline, the composed book, the codes that play his voice. No chapter, no feature of the book and no part of the archive is held back from Standard.

There are four: Sister Pass $299 and Elder Pass $399 on Standard, Sister Pass · Premium $399 and Elder Pass · Premium $499. One payment, setup included, nothing renews, nothing to cancel, and no card left on file to expire in month nineteen. A sister's pass buys 21 months and an elder's 27 — the mission plus three months after homecoming — counted from the day you pay rather than from their return, so a pass suits a mission with a year or more still to run. You buy one on the billing page inside the app, next to the monthly plans. Passes open at launch, after the founders testing period; until then the buttons are there and disabled.

No. A monthly subscription renews every month until you cancel it. Nothing in the product ends it at homecoming, and no code stops the charges at homecoming plus ninety days, whatever a page may have told you. Cancel it yourself on the billing page when you no longer want new material captured; the archive stays readable afterward. A Mission Pass is the exception — it is a purchase, so there is nothing to cancel and no card left on file to charge again.

Yes — $190 a year, which is ten months' price for twelve. It is not on the public pricing page; you will find it on the billing page inside the app, beside the monthly plans. Two cautions before you pick it. Annual is Standard only: there is no annual Premium price, so choosing annual means choosing the plan where you record the call yourself. And an annual plan renews and can lapse mid-mission if a card expires, while a pass is paid once with nothing left to fail.

Your archive goes read-only, and nothing is deleted — that rule we do not bend. You keep reading every letter, transcript, photo and chapter you already have; editing and the AI work pause until payment succeeds. Letters sent to your capture address still land, because capture is never switched off. After a cancellation the app shows a 60-day grace window, but editing and the AI pause when the subscription ends rather than at the end of it — treat the 60 days as room to come back, not extra service.

Yes — unused full prepaid months come back to you, as a credit toward a book or a refund, and the choice is yours. Write to support: a person calculates it, because nothing in the product does it automatically and there is no button. That covers a Mission Pass or any other prepaid period. If you were paying monthly, cancel and the charges stop; there is no policy yet on refunding a partial month. No family is charged extra because a mission ended early.

Honestly, we do not have one written yet. Books with a printing defect or shipping damage are replaced free, and early return is covered above. The setup fee is not a refund question: it only lands on your first invoice, so cancelling during the trial means it is never charged. Everything else is undecided: a partial month after you cancel, a pass bought before plans changed, an unredeemed gift, a book order cancelled before it prints. Nothing refunds automatically. Write to support before you assume the answer, and we will tell you what we can do rather than point at a policy that does not exist.

The family you refer pays half the setup fee — $24.50 instead of $49 — and you earn $20 once they have been paying for three months. One credit per family you refer, and it does not stack with a promo code; you get whichever is better for you. The awkward part: that $20 cannot be redeemed at checkout. Nothing reads your credit balance when you order a book, so email us before you order and we will take it off by hand.

Yes — 3, 6 or 12 months, at $106, $163 or $277, setup included. The giver needs no account and receives a bearer code: whoever enters it first redeems it, once, so keep it private until you hand it over. Codes do not expire today, and gifted months are added after any time the family already has. Two catches: gifting is not open yet — it arrives with printing at launch — and a family with a live subscription cannot redeem a code themselves, so support applies it instead.

No. Hosting a call opening is free — no account and no card, for you or for your guests. You give the missionary's name, your email, and, if you have them, the day you'll open it and your meeting link. Your own name is optional, but add it: it goes on the emails your guests get. You tick one box promising to tell everyone on the call if you record it. You get two links back — a guest link for everybody and a host link that is your console — both emailed to you. Your address also joins our own list; ask us and we take it off.

Never on the page. The event page shows a first name and last initial only — "Cooper W." — and that shortened form is what we store on the opening itself. The web address is a random slug, never built from a name, and every event page is set to noindex, so it stays out of search results. We do keep the full name you typed in our own records, where only we see it. Guests give a name and a guess; an email is optional. Names and guesses show to anyone holding the link, never a guest's email — those you see on your console.

Treat it like a key, because it is one. The signed link in the URL is the whole credential — anyone holding it can set the date, start the recording, see every guest's email address, and open the call. There is no password and no account, which is exactly what lets you text it to your spouse. Keep it to the family, bookmark it, and don't paste it into the ward group chat; that is the guest link's job. We email it to you at creation so you can find it again.

No — you bring your own room. Paste your own Meet or Zoom link into the console. Family who cannot be there join through that same link, which shows on the guest page as "Join the opening" until you open the call. We do not provision a meeting: at that point you are not a customer, and our recorder can join whatever link you already use. Adding the link does not start a recording. Nothing is recorded unless someone presses the record button, so you can gather everyone in your own room and never press it.

No, you press a button. Once everyone is in the room, press "Record the opening" and a recorder joins as a visible guest named "Missionary Legacy (recording)", so nobody is recorded without watching it arrive. Your meeting link has to be saved first. If it lands in an empty room it gives up after five minutes, and it leaves about a minute after everyone hangs up. The file appears on your console a few minutes after you finish, and it is yours to download.

Not directly — the recorder can only join a meeting link. Two ways round it. Start a Meet or Zoom room on a laptop in the same room, paste that link into your console, and let the recorder in. Or record it on a phone and add the file to your archive afterwards. That upload is the awkward one: it opens for an owner or parent only after your first paid month begins, which for most families is the mission start date — so a recording made now may sit on your phone for a few months. Nothing is lost by waiting. Either route prints in the book the same way.

No. Your own recording — a phone video, a Zoom download — can be added on the Call Opening page. It goes straight from your browser to storage, joins your videos, and prints in Part I under the caption "The day the call was opened," with a scan-to-watch code beside it. Tell us the day you opened it and the book prints that date. One catch worth knowing: that upload does not appear until your first paid month starts — the mission start date — unless a prepaid pass or a gift covered you. If you would rather it not print, the video gallery removes the code.

Eventually, yes — and here is exactly how. An unclaimed recording is kept 90 days from the day the file lands. We email you three times before that, at roughly 30 days, 7 days and 1 day out, each with a one-click download that is never behind a payment. Nothing is removed unless at least two of those reminders actually went out; if we could not reach you, the deadline extends 30 days instead. Removal deletes the video file. Your event page and guest list stay.

Yes — if you sign up with the same email you hosted with. When you create the archive we look for openings hosted by your account's email address, link them, clear the 90-day deadline for good, and put the recording into your videos so the book can print a code beside it. That match is on email alone. Host under one address and sign up under another and nothing attaches. It is not lost, but you will have to write to us to connect the two.

Not automatically — this is the roughest edge in the flow. Your console shows who asked and their email addresses, and that list is yours. But nothing today imports it into your letter list. You add them on the Family page one at a time, or hand out the follow cards from the farewell kit and let them subscribe themselves by scanning the code. We would rather say that plainly than let you assume forty people are covered when they are not.

The reveal cannot be undone. It takes two taps on purpose: pressing it emails everyone who guessed, closes guessing, and posts the mission on the guest page. Those emails go out under your name beside ours — "Sarah · Missionary Legacy" — or just ours if you left your name blank, so add your name when you set it up. There is no un-send. Deleting the opening and its guest list is not self-serve either; write to us and we will do it by hand. You can change the date and the meeting link freely, but a recording, once made, cannot be redone here — ask us and we will clear it.

No — nothing at all is charged until they leave. Both the $19 a month and the one-time $49 setup wait for the mission start date you enter: the trial is set to end there, and the setup fee is put on that first invoice rather than taken at checkout. Cancel before then and you are charged nothing, setup included, because no invoice was ever raised. The standard fourteen days are a floor, so a missionary leaving next week does not shorten your trial. Meanwhile you get the Before the Mission chapter (the call, the farewell, who they were), the printable farewell kit with announcement and follow cards, and a guestbook where the ward can leave a word before departure. All of it opens Part I of the book.

No. Nothing about the billing or the capture stops itself at homecoming. A monthly or annual subscription renews until you cancel it from the billing page, the capture address keeps accepting mail, and we send no end-of-mission email telling you to decide. Two things do read the mission end date: the book's last chapters unlock at release, and we stop selling a Mission Pass once a mission has under a year left to run. A pass is a purchase, not a subscription — it covers 21 or 27 months counted from the day you buy it, not from homecoming, and when those months run out nothing renews and nothing is charged.

Everything already saved. Letters, chats, call transcripts and summaries, journal entries, mission facts and the book you read on screen stay readable, free, with no lock-out — non-payment never removes an archive and never blocks the door, and that is written into the billing code, not only the Terms. What stops is the AI biographer and editing. One thing does not stop: mail sent to the capture address is still received and filed, because capture is not tied to billing. If you want that address shut off, ask us. Photos, recordings and video are the next answer.

Today, nothing — they stay live for every archive at no charge, and no archive has ever been sealed. There is no storage plan on sale and no sealing job running. What the Terms reserve is this: an archive with nothing live on it — no subscription, pass, gift or vault — may have its photos, audio and video moved into sealed storage six months after the mission end date. While you are paying anything at all, nothing seals. Sealed is not deleted, and restoring may carry a fee. Before any of it, we would write first, name the date, and name the price of keeping everything live.

Nobody can give you your date, and anyone who states one as fact is guessing. The Church does not publish a schedule, the policy changed in 2024, and the Church's own technology forum carries flatly contradictory answers. What families widely report: access ends around 90 days after release, deletion around 180, and the contents are sometimes already out of reach while sign-in still appears to work. Treat all of that as reported, not published. The one reliable test is to have him sign in at mail.missionary.org and tell you whether it opens.

Not on its own, no — and this is the gap that costs families the most. We archive what reaches your private capture address, plus one thing more: if he shares a Google Photos album link or a Drive folder link, we watch it and pull in what lands there. Everything else inside his account — his full photo library, his contacts, his sent mail — is out of our reach and yours. That needs a Google Takeout export, done while he can still sign in. Our guide walks through it, it costs nothing, and you can upload the mail file and the photo zip straight into the archive afterwards, captions included.

After homecoming, because several chapters cannot be written until then. A chapter unlocks when its story closes: the pre-mission and reference chapters once he is set apart, an area's chapter when he transfers out, and the retrospectives and the chapter gathering everyone he met at release. Once printing opens you can order before that, but you would be printing a book with those chapters empty. There is no deadline on the other side — the archive stays readable, and you can order the book years later.

No. Checkout never looks at approvals — we print the book exactly as it stands in your archive the moment you place the order, approved or not. So read it first. The AI biographer makes mistakes, and the fact-check pass that cuts unsupported claims can fail and hand a chapter through unchanged without telling anyone, so your eyes are the only reliable gate. A correction found after printing is a new order at full price. The Book page shows which chapters you have marked approved — treat that as your own checklist, not something the software will enforce.

You can download it, but the copy the app gives you is watermarked on every page. The clean, press-ready file is produced only for a paid order and goes to the printer, not to you. The watermarked PDF is meant for reading and proofing, and it is genuinely good for that. A clean book means the printed edition: $99 Standard, $199 Photo, $299 Heirloom, per volume, hardbound, shipping included. Volumes run about 400 pages, most missions come to two or three, and the count is computed from your actual book at checkout.

Yes. He needs his own login first — invite him from the Family page like any other member — and then the account owner can hand him the owner role from that same page. Know what moves and what does not. He gets billing control; you become a Parent, which is everything except billing. The card that set the subscription up keeps being charged, and you can no longer reach the billing page to stop it — he can, or you can ask us. Nothing is copied or exported: it is the same archive with a different name on it.

Yes, and it is enforced in the software rather than only promised. The playback route never consults the archive's storage tier, and the rows a printed code points at cannot be deleted while they are still what the book prints — a kept moment, a video still marked for the book, a journal entry with its recording. Undo one of those, or ask us to delete the whole archive, and that code goes quiet. Know what a printed code is, though — a bearer link. Anyone holding the book can scan it and hear his voice, and the player starts at the story but they can keep listening into the rest of that call.

Not yet — both go through support, and we will do them for you. Today's export works per person: your profile, the letters you wrote, the photos you added, and your orders, emailed to you. A single complete copy of a whole archive — every photo, recording and transcript together — is not something we can produce yet, and we would rather say that than dress an email address up as a feature. Deletion works the same way: write to us and we confirm before doing it. One caveat — deleting an archive removes its records; the underlying photo, video and audio files and the off-site backup copies are removed separately, by hand.

The Terms promise notice and a reasonable opportunity to take a complete copy before anything becomes unavailable — and the honest caveat is that the whole-archive export that promise depends on is not built yet, and the notice period is not set. So keep your own copies of anything you could not bear to lose. On our side, photos and videos are mirrored to an off-site backup. Call recordings and voice-journal audio are not, which means those files have one copy in the world.

No. Missionary Legacy is an independent service, not affiliated with, sponsored by, or endorsed by The Church of Jesus Christ of Latter-day Saints. We have no access to Church systems, and the Church has no access to your archive through us. Nothing here changes any rule your missionary is under. It also means we cannot do anything about the Church account itself: when it is closed after release, our copy of whatever was forwarded to us is separate and stays in your archive.

It can, so the book is built to keep it on a leash. The chapters that tell their story are drafted only from your archive — letters, transcripts, chat, journal entries they chose to share, and facts your family confirmed. Figures of speech are flagged first, so a metaphor is not narrated as an event. A separate pass then checks the draft against those sources and cuts anything they do not support, including any quotation not in the sources word for word. Two Parts are different, and the book says so on the page: the country and cities background is written from a public encyclopedia entry, not from your missionary.

You can't tell from the page, and that is a real gap. If the fact-check pass errors out, the code returns the draft unchanged — no mark on the chapter, no alert to us, only a line in a server log. So a chapter you are reading may not have been checked. What does hold: we print the book as it stands when you order, approved chapters or not, so the reading is yours to do before you pay. We cannot proofread your family's story for you, and a correction after printing is a new order. Your own reading is still the real backstop, and we have not built the failure flag yet.

No. We do not train models on your content, and our providers work under business API terms that do not let them train public models on it either. Who receives what: Anthropic and OpenAI get text from the archive for drafting and checking; OpenAI also captions photos; Deepgram transcribes call and voice-memo audio, with OpenAI's Whisper as the fallback; Google produces the Meet transcript and notes we import. One thing to know: a sealed journal memo is still transcribed by that same speech provider, so the audio does leave us — it simply never goes into the book. Passwords and payment details never go to any of them.

Not from our operator console. It shows names, email addresses, roles, counts, order status and last sign-in — never the text of a letter, chat, journal entry or transcript. When we send a data export, it goes to the person it is about, not to our screen. The honest limit: engineers who maintain the database and storage could technically reach content. We do that only to fix a problem you reported, with your permission, or when the law requires it. There is no written internal-access policy yet, and that access is not logged. We would rather say so than imply a control we have not built.

Everything runs in the United States: the database and files with Supabase, the app on Vercel, inbound letters through Amazon SES and S3. Some of our providers process data elsewhere. A second, off-site copy is built, but it covers photos and videos only and is not switched on yet — so today most files exist in one place. Call recordings and voice-journal audio have no second copy either way, and the voice is the most irreplaceable thing in the archive. We are fixing both. Until then, keep your own copy of any recording you could not bear to lose.

Connections are encrypted, passwords are stored hashed by Supabase, the database uses row-level security so one family's rows cannot be read from another's account, and photos, audio and video are served through links signed for one hour rather than public URLs. The missionary's journal passcode is a one-way hash we cannot read. What we do not have yet is two-factor login. And two things are bearer keys by design: a QR code printed in the book, and the missionary's capture address, which files anything mailed to it. Keep both inside the family.

Not yet — you ask us, and we do it by hand. There is no export button. Write from the address on your account and we will email you what we hold about you as a person: your profile, the letters you wrote, a record of the photos you added, and your orders. A single complete copy of a whole archive — every photo, recording and transcript together — is not something we can produce today; the tool we have exports one person at a time. When the whole-archive export exists, we will say so here.

Not completely, and you should know exactly what happens. Deleting an archive removes its database records — letters, chats, transcripts, moments, the book, the sealed journal — for every member at once. The photo, video and audio files themselves, and the off-site backup copy, are not removed by that action; they are cleared separately by hand. Printed books cannot be recalled and their QR codes stop playing. Copies outside our reach stay put: your missionary's Church email, your Google Photos, your own inbox. Only the account owner can request it, and we confirm before we act.

Our Terms promise notice and a reasonable opportunity to take a complete copy before the service becomes unavailable. Two honest caveats: no notice period is written down yet, and the whole-archive export that promise depends on is not built. So treat this as the convenient copy, not the only one. Keep the missionary's weekly emails in your own inbox, keep the shared Google Photos album you connected, and download anything you would grieve. We would rather you hold your own copy than trust a paragraph in a document.

Yes, by email. support@missionarylegacy.com reaches us, a person reads every message, and we reply personally. There is no phone number, no live chat, and no published response time — we are a small team and would rather not promise an hour we cannot keep. Use that address for the things with no button yet: an export, a deletion, an early-return refund, a defective book. A stray letter you can handle yourself: an owner or parent can remove it from the archive on the letter's own page. Security problems go to security@missionarylegacy.com.

Missionary Legacy LLC, a Tennessee limited liability company at 2104 Carroll Creek Rd, Johnson City, TN 37615 — a small independent team in the United States, not the Church and not a large company. Tennessee law governs the Terms and any dispute goes to a court in Washington County, Tennessee. There is no arbitration clause, no class-action waiver and no jury waiver: we considered all three and dropped them, so nothing in the Terms limits how a dispute between us is heard. Both documents record which version you agreed to and when, and when we change them the app asks you to read and accept the new version before you can carry on. support@missionarylegacy.com reaches us for anything, including legal questions.