Published October 26, 2026
WholeFamily is a private, invite-only family photo journal: there is no public feed, no discovery, and no way for someone outside your family to browse your photos. Every photo and video is encrypted by the app before it is stored, under its own key and a key that belongs to its album. Photos have no permanent public address, only links that expire. Location and device details are removed when you upload. There is no password to steal. Photos are never sent to an AI model, never used for advertising, and never sold. Below are the main protections, what each one stops, and where to read more.
| Question | Answer |
|---|---|
| Are photos encrypted before they are stored? | Yes, by the app, with AES-256-GCM and a key for every file and every album |
| Do photo links expire? | Yes: within a day in the app, after seven days in email |
| Can I share one post with people outside the family? | Yes. An admin can create a link for that one post, and it expires |
| Is location removed? | Yes, from photos and videos |
| Is there a password? | No. Sign in with an email link or code, or a passkey |
| Are photos sent to AI or used to train it? | No |
| Is traffic encrypted? | Yes, with TLS, and our database provider encrypts it at rest |
The simplest way to judge a family photo service is to ask what a thief would walk away with. Here is what each kind of breach gets at WholeFamily.
| If someone... | They get | Because |
|---|---|---|
| Copies our photo storage | Encrypted files, unreadable on their own | The app encrypts every file before storing it |
| Copies our database | Account details, posts and comments, but no photos, and photo keys that are locked | Photos are stored separately, and their keys can only be unlocked through a separate key service |
| Finds an old photo link | Nothing, once it has expired | In-app links expire within a day, email links after seven days |
| Guesses or reuses your password | Nothing to guess | There is no WholeFamily password |
| Gets a photo you shared | The picture, without where it was taken | Location and device details are removed on upload |
Every storage provider encrypts its own disks, which protects against a stolen hard drive and little else. WholeFamily goes further: the app encrypts each photo and video, and each smaller copy it makes for the feed, with AES-256-GCM before it is stored. The files in our storage are unreadable to anyone who reaches them without going through the app, including the storage provider itself. Profile photos, family photos and album covers are encrypted the same way.
Each file gets its own randomly generated key. That key is locked with a key that belongs to the file's album, and the album keys are protected by a master key held in Amazon Web Services Key Management Service, inside hardware security modules it never leaves. One album's key opens only that album, which limits how much any one key can expose.
Our servers reach the key service with short-lived credentials issued for each deployment. There are no long-lived cloud access keys sitting in our code or configuration for anyone to find. The full write-up of the encryption walks through each step.
A photo on WholeFamily has no permanent public address. When you open one, the app first checks that you belong to its family, then issues a link signed with a key unique to that album. In the app, links expire within a day. Links in the daily email expire after seven days. A link forwarded, copied from a browser bar or found in an old chat stops working on its own.
When someone leaves the family, they stop getting new links, and the ones they already had run out on schedule.
Not everyone who should see the first-day-of-school photo belongs in your family album: a godparent, the playgroup, a group chat of old friends. For those moments, a family admin can create a share link for a single post. Anyone with the link can see that one post without an account or an app. Links created in the app last seven days, and an admin can revoke one sooner.
A share link is built to give away as little as possible:
Anyone who has a share link can forward it, which is exactly why it is limited to one post and runs out on its own.
Phones write the place a photo was taken, and the phone that took it, into the file. Photos are re-encoded when they are uploaded to WholeFamily, which discards that data. Videos keep their picture and sound exactly as recorded, but the location, device and camera details are removed before the video is stored. Here is what we found inside one iPhone video before we built it.
You sign in with a one-time link or code sent to your email, or with a passkey. There is no WholeFamily password to steal, phish or reuse from another site's breach. Sign-in attempts are rate limited, and on your phone your session is kept in the device's secure storage (on iPhone, the Keychain).
Two features send text to an AI model, and nothing else does: translation when you ask for one, and the daily email digest. Photos and videos are never sent. The text is processed only to produce the translation or summary, under terms that prohibit using it to train models.
We do not sell or rent your data, share it for marketing, or use it for advertising, and we do not read your posts out of curiosity or for product research. The providers that run the app for us, such as hosting, storage and email delivery, process your data only on our instructions and under contractual confidentiality obligations.
When you ask for an export, you get a single download of your family's media that is available only to you, and it expires. When an account is deleted, the few records we are required to keep (such as a ban, or a legal hold) identify the person by a keyed fingerprint and an encrypted copy of their email address, never the address in plain text.
A service built for children's photos has to keep abusive material off it. We scan and review content to detect child sexual abuse material and report it where the law requires, as our privacy policy describes. Holding the encryption keys is what makes that review possible, alongside the email digest, viewing in any browser and recovery from a lost phone. The encryption write-up explains exactly what holding the keys does and does not allow.
Read how the encryption works or the privacy policy.