Privacy Policy

Account Information: When you create an account, we collect your email address and display name to identify you within your family spaces.

Photos, Videos & Posts: Content you share within your family spaces is stored securely so your family members can view it. We do not sell your content, use it for advertising, or show it to anyone outside your family. It is processed by the service providers who run the app for us, and it is subject to the safety review described below.

Push Notification Tokens: If you enable push notifications, we store your device token to deliver notifications when family members share new content.

Seen by: If you turn on “Count me in Seen by” for a family, we record which of that family's posts you have seen, so the person who posted can see how many people have seen it. They see a number, not your name or photo. It is off unless you turn it on, and turning it off deletes those records for that family.

We do not read your family's posts out of curiosity, for advertising, or for product research. We do reserve the right, and in some cases carry a legal obligation, to scan and review content in order to detect unlawful or prohibited material. That means the sexual exploitation of children above all, and it also covers pornography and sexually explicit media, which are not permitted on WholeFamily at all.

That review may be automated, such as hash matching against databases of known child sexual abuse material or classifiers that detect sexually explicit content, or it may be performed by a person on our team when content is flagged, reported, or subject to a valid legal request. Access is limited to the people who need it for that purpose.

Where the law requires it, or where we believe in good faith that it is necessary to prevent harm, we may preserve and disclose content and account records to the National Center for Missing and Exploited Children, to law enforcement, or to other authorities. The Terms of Use set out the full detail, including what happens to an account afterward.

We do not sell or rent your personal data, and we do not share it with third parties for marketing purposes. Your family content is only visible to members of the family spaces you belong to.

Service providers. We rely on a small number of providers to run the app, including hosting, media storage, our database, and email delivery. They process your data only on our instructions and under contractual confidentiality obligations.

Site measurement. Our website and the app use Vercel Web Analytics and Speed Insights to count page views, see which pages and links bring people to us, and measure how fast pages load. They set no cookies and keep no personal identifiers; what we see is aggregated. A link from our website into the app carries the name of the page it came from, nothing about you. The app keeps that page name for the rest of your visit and, if you request access or start a trial, counts that against the page. Those counts are aggregated and hold nothing that identifies you.

Error reports. When something breaks in the app, a report goes to Sentry, an error-monitoring service, so we can fix it. A report holds the error, the page or request it happened on, the app version, and the browser or device type. Before it is sent we remove addresses, names, cookies, request contents and the signed links that open photos, so a report cannot identify you or show your family's content.

AI processing. Two features send text to AI models, and nothing else does. Photos and videos are never sent.

• Translation, only when you ask for one: for a post, its title, its text and its photo captions; for a comment, the comment's text. Plus the language to translate into.
• Email digests, if you receive them: for each post in the digest, the author's name, the kind of post (and a milestone's name), how many photos it has, the first 300 characters of its text and a link to it, plus the album's name, whether the posts are memories from past years, and the language of your email.

That text goes through Vercel's AI Gateway to Anthropic (Claude), or to Google (Gemini) or Amazon (Nova) when Anthropic is unavailable. Each processes it on our behalf only to produce the translation or summary, under terms that prohibit using it to train their models.

Legal disclosure. We may disclose data where we are legally required to, or as described under Content Safety above.

Your family's photos are the most sensitive thing we hold, and we protect them with more than the defaults. This section describes what we actually do, including where it stops.

We encrypt your photos and videos ourselves. Every storage provider encrypts its own disks. We go further: the app encrypts each photo and video, and each smaller copy we make of it, before it is stored, using AES-256-GCM. This is application-level encryption, so the files in our storage are unreadable to anyone who reaches them without going through the app, including the storage provider itself. Profile photos, family photos and album covers are encrypted the same way.

One key per file, one key per album. Each file is encrypted with its own randomly generated key. That key is locked with a key that belongs to the file's album (or, for a profile picture, to its owner), and those keys are in turn protected by a master key held in Amazon Web Services Key Management Service, inside hardware security modules it never leaves. Our servers reach that service with short-lived credentials issued for each deployment; there are no long-lived cloud access keys stored in our code or configuration.

Links that expire. Photos and videos have no permanent public address. When you open one, the app first checks that you belong to its family, then issues a link signed with a key unique to the album. In the app those links expire within a day; links in email digests expire after seven days.

Location data is removed. Photos are re-encoded when they are uploaded, which discards their embedded metadata, including GPS location and device details. Videos keep their picture and sound exactly as recorded, but the location, device and camera details your phone writes into a video are removed before it is stored.

No passwords. You sign in with a one-time link or code sent to your email, or with a passkey, so there is no WholeFamily password to steal or reuse. Sign-in attempts are rate limited. On your phone, your session is kept in the device's secure storage (on iPhone, the Keychain).

Everything else. All traffic between your device and WholeFamily is encrypted in transit with TLS. Account details, posts and comments are stored in our database, which our provider encrypts at rest. When an account is deleted, the few records we must keep (such as a ban, or a legal hold) identify the person by a keyed fingerprint and an encrypted copy of their email address, never the address in plain text.

Where this stops. WholeFamily is not end-to-end encrypted. We hold the keys, which is what lets us show your photos on any device, recover them if you lose your phone, build an export when you ask for one, and carry out the safety review described above. An export contains decrypted copies of your family's media, is available only to the person who requested it, and expires.

You can request deletion of your account and all associated data at any time. You can disable push notifications through your device settings. You can remove content you have shared at any time.

Deletion has one limit. Where the law requires us to preserve material or records, or where we are cooperating with a law enforcement or child safety investigation, we retain what we are obligated to retain, and only for as long as that obligation lasts.