This policy reflects our actual practices as of 19 July 2026.
Original Lore turns a birth year and where you grew up into a short, personal nostalgia reel of your teenage years. This policy explains — in plain language — exactly what we collect, why, who we share it with, and the choices you have. We've written it to match what our software actually does. If we ever change a practice, we'll update this policy first.
At launch, Original Lore is free, has no accounts, and is offered only in the United States and Canada. There are no payments, no photo uploads, and no marketing emails.
Original Lore is operated by Diogo Dias Grilo (an individual), trading as "Original Lore" ("Original Lore," "we," "us," "our"). A company is being established, but at the date of this policy it does not yet exist, so the operator and data controller is the individual named above.
We operate from the United Arab Emirates. Our contact address is:
Diogo Dias Grilo (Original Lore) Mag 214 Tower, Apartment 2304, Cluster R Jumeirah Lake Towers, Dubai, United Arab Emirates
At launch the Service is offered only in the United States and Canada. As a controller based in the UAE, our processing is subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"). (The PDPL's executive regulations are still developing; we will align our practices with them as they are finalized.) In addition, and as a matter of good practice for the users we actually serve, we voluntarily honor the privacy principles of California's CCPA/CPRA and the rights recognized under Canada's PIPEDA and Quebec's Law 25 — see §8. We are the controller of the personal data described in this policy.
No EU/EEA/UK offering. The Service is not offered to, and does not monitor, individuals in the EU/EEA or the United Kingdom. We are not established in the EU/EEA or the UK and do not target those markets, so no EU or UK representative applies. We serve the US and Canada only.
We collect only what we need to build your reel and to run and protect the service. There is no account, no login, no name, and no password, and at launch we collect no email address and no payment or card data of any kind.
Providing your birth year and where you grew up is voluntary. There is no statutory or contractual obligation to provide it; the only consequence of not providing it is that we cannot generate a reel for you.
We collect no special-category / sensitive personal data, and no precise geolocation (as defined under the California CPRA). We use only a coarse country signal and a coarsened network-prefix token described below.
ol_sid). An 8-character random string generated in your browser. It is not derived from any device fingerprint. Its purpose is to correlate our own proof-of-consent, abuse-prevention, and feedback records for the same visit — it lets us group events from a single visit without identifying you. It is first-party only and is never used for cross-site tracking.What we do NOT collect at launch: no email address, no name, no account credentials, no payment or card data, no uploaded photos, no advertising IDs, and no analytics-SDK tracking. We use no third-party analytics or tracking cookies.
For California residents, the personal information above falls into these statutory categories:
ol_sid) and the salted network-prefix token.We collect no CPRA "sensitive personal information."
We identify a single most-appropriate basis for each purpose. As a free service with no accounts, our processing rests on either your consent or our legitimate interests in delivering, securing, and improving the experience you asked for.
| What we do | Why | Basis |
|---|---|---|
| Take your birth year, location and choices and generate your reel | To provide the free experience you asked for | Legitimate interests in delivering the requested experience (the Service is free, so no contract is formed) |
| Load third-party media (YouTube videos, Apple preview audio, TMDB/Wikimedia/RAWG images) only after you accept "all" | To show real music and imagery from your era | Consent, given via the consent banner. Storing/reading this media and its cookies on your device is done on the basis of your consent |
| Record your consent choice (scope, version, timestamp, session ID, User-Agent, salted prefix token) | To demonstrate that you were asked and what you chose | Accountability — keeping proof of consent so we can show you were asked and what you chose |
| Keep the salted network-prefix token; rate-limit requests; run our admin tools | To keep the service secure and prevent abuse | Legitimate interests in security and integrity |
| Handle and respond to a free-text note you send | To act on your feedback | Legitimate interests in reviewing and acting on feedback |
| Keep basic feedback and interaction signals | To understand and improve the reels | Legitimate interests |
Where we rely on consent, you can withdraw it at any time (see §6 and §8). Where we rely on legitimate interests, we've weighed our interest against your rights and freedoms; you can object at any time (see §8).
We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising in the sense those terms are used under the California CCPA/CPRA. We have no advertising trackers.
We use the following categories of recipients:
For these, the lookups happen on our server, so your IP address is not exposed to them:
image.tmdb.org, Apple's mzstatic.com) so the shareable keepsake can be drawn on-screen.If (and only if) you accept all media in the consent banner, your browser connects directly to these services, which means they can see your IP address and, for YouTube, may set cookies. None of this loads on page load or before consent:
mzstatic.com) — 30-second preview audio and cover-art images. Provided by Apple; Apple's handling of data is governed by Apple's privacy policy.image.tmdb.org) — posters, backdrops, cast and provider-logo images.upload.wikimedia.org) — thumbnail image bytes.api.rawg.io / media.rawg.io) — game-cover images, and only if an optional game-data key is configured.Before you consent, we show only first-party, bundled images; the hero and year-picker run entirely without third-party media.
We may also disclose data where required by law, to enforce our terms, or to protect our rights, users, or the public.
We operate from the United Arab Emirates and use processors and content providers located in the United States and elsewhere. Because the Service is offered to users in the United States and Canada, personal data is processed in those countries and in the countries where our providers operate. When personal data crosses borders, we rely on our providers' standard cross-border transfer terms and appropriate contractual safeguards, and we minimize what is transferred — for most third-party lookups, only our server (not you) contacts the provider, so your IP address is not exposed (see §4).
You can ask us for more information about these safeguards using the contact details in §11.
We set no HTTP cookies of our own, and we use no analytics or tracking cookies.
We use five first-party localStorage keys, stored in your browser:
| Key | Purpose | Lifetime | Basis / class |
|---|---|---|---|
ol_sid | Random pseudonymous ID used to correlate our own consent-proof, abuse-prevention and feedback events for a visit; first-party, never cross-site | Persists until cleared | Necessary for security and consent-proof (see §2, §3); its minimal, first-party feedback-correlation use is not cross-site tracking |
ol_consent | Your consent choice (scope, version, timestamp) | ~182 days, versioned | Strictly necessary |
ol_age | Your age-gate result | 365 days if "yes"; a "no" persists | Strictly necessary |
ol_year | The last year you committed, to reseed the dial | 365 days | Preference |
ol_responses | A copy of your own feedback records, kept on your device | Persists until cleared | Preference |
Consent-gated third-party storage: only after you choose "accept all" do third-party services store anything on your device — chiefly the YouTube player's Google cookies, plus the media described in §4. If you withdraw consent, we tear down those media surfaces. You can reopen the banner at any time via "Cookie settings." You can also clear localStorage in your browser settings.
We keep personal data only as long as we need it for the purposes above.
Image and lookup caches (AI backdrops, poster images, iTunes and video-ID lookups) are size-limited working caches that evict automatically and are not user records.
Please note that in our launch hosting setup on Cloud Run, the container filesystem is temporary and per-instance, so these records may in practice be short-lived unless migrated to durable storage. The periods above reflect our intended retention once records are held durably.
Whoever you are and wherever you live, you can contact us to access the personal data we hold about you, ask us to correct it, ask us to delete it, object to or ask us to restrict a particular use, and — where we rely on your consent — withdraw that consent at any time (withdrawal doesn't affect processing already carried out). The region-specific sections below add the local statutory rights and complaint routes for California, Canada, and the UAE.
Because we hold no account and no email, we identify your records largely through your on-device session ID — so to exercise most rights, please contact us from the browser/device you used, or include your ol_sid value, so we can find the right records. We will respond within the timeframes required by law and won't discriminate against you for exercising any right.
You have the right to: know/access the personal information we've collected and how we use and disclose it; delete it; correct inaccurate information; and opt out of the sale or sharing of personal information. We do not sell or share your personal information, so there is nothing to opt out of. Because we do not sell or share, a Global Privacy Control (GPC) or other opt-out-preference signal has no sale or share for us to stop — we do not sell or share regardless of any such signal. We will not discriminate against you for exercising your rights. You may use an authorized agent to submit requests.
(Given our size and the fact that the Service is free, we are almost certainly below the thresholds that make a business subject to the CCPA/CPRA. We nonetheless honor these principles voluntarily.)
If you have an unresolved concern, you may contact the California Attorney General (oag.ca.gov).
You have the right to access and correct your personal information and to withdraw your consent (subject to legal and technical limits). Under Quebec Law 25, you also have rights regarding the de-indexing and portability of your information and to be informed about automated decisions. Our person responsible for personal information is identified in §1. If you have concerns, you may contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca, or, in Quebec, the Commission d'accès à l'information (CAI) at cai.gouv.qc.ca.
As a controller established in the United Arab Emirates, we process personal data in line with UAE Federal Decree-Law No. 45 of 2021 (PDPL) and its executive regulations as they develop. You can exercise the access, correction, deletion, objection and consent-withdrawal rights described above by contacting us. If a concern remains unresolved, the relevant supervisory authority is the UAE Data Office (the federal authority responsible for the PDPL).
To exercise any of these rights, contact us at privacy@originallore.com.
Original Lore is not directed to children. We apply a 16+ age gate before you can use the service; a "no" answer blocks the app. We do not knowingly collect personal data from anyone under 16. In particular, consistent with the US Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal data, contact us at privacy@originallore.com and we will delete it.
For any 16–17 year-olds who use the Service, we keep all third-party media and any correlation identifiers off by default until consent, minimize what we collect, and set high-privacy defaults.
No system is perfectly secure, but we work to protect your information using measures appropriate to its sensitivity.
We may update this policy as the product evolves. When we make material changes, we'll update the effective date below and, where appropriate, provide additional notice.
This policy and any dispute relating to it are governed by the laws of the United Arab Emirates, and the courts of the Emirate of Dubai have jurisdiction. Nothing here removes the mandatory consumer- and privacy-protection rights you have under the laws of your own home jurisdiction — if you are in the United States or Canada, you keep those local protections, and this governing-law clause does not override them.
To ask a question, exercise a right, or raise a concern:
Diogo Dias Grilo (Original Lore) Mag 214 Tower, Apartment 2304, Cluster R Jumeirah Lake Towers, Dubai, United Arab Emirates Privacy/data requests: privacy@originallore.com General/legal: hello@originallore.com
Limitation of liability. Original Lore is a free service. To the fullest extent permitted by law, our total liability to you for any claim arising out of or relating to the Service or this policy is limited to USD 100, or the minimum the applicable law allows, whichever protects you more.
This policy reflects our actual practices as of 19 July 2026.