Security
We can't read it.
Neither can anyone else.
This page says exactly what is protected, exactly how, and — because trust is built on the exceptions, not the headline — exactly what is not end-to-end encrypted, and why.
The core claim
Family content — photos, videos, voice captions, notes, calendar entries, lists, folders, children's names and details, health records, artwork, keepsake letters — is encrypted on your family's own device with AES-256-GCM before it is uploaded. The key is generated on-device and never reaches our servers.
What we store is ciphertext: we cannot read it, search it, hand it to anyone, or recover it without your family's devices. There is no master key and no back door, and we will not build one.
The three honest exceptions
Three things are deliberately not end-to-end encrypted, because they cannot be — someone outside the family is at the other end. We'd rather say so than let you assume otherwise.
- Email sent to your family address — a school notice you forward in arrives as ordinary email. It waits on our relay in readable form until one of your devices collects it, and is deleted after 30 days at the latest.
- Newsletters sent out — ordinary email to the grandparents. Contents and recipient addresses pass through our email provider in readable form so they can be delivered. Recipient addresses are not retained as any list.
- Pages you choose to publish — a shared recipe becomes a single page at a long random link, stored unencrypted because a web page has to be, and deleted automatically after about a year. Nothing is published unless you tap share.
Everything else — timeline, folders, calendar, health records, lists, letters — is end-to-end encrypted.
The small readable remainder
Running the service requires a little data we can read — listed in full in the privacy policy, and it is short:
- a random account identifier — no name and no email at signup
- hashed device tokens, device roles, last-seen timestamps and app version
- subscription status
- waitlist and support emails, if you write to us
- edge connection logs
Nothing else.
No analytics, no tracking, no ads
No analytics SDK, no crash reporter that phones home, no advertising identifier, no tracking pixels. We do not know which screens you open, and we have chosen not to find out. This website sets no tracking cookies and loads nothing from third parties either.
No cloud AI — and no training, ever
There is no cloud AI and no language model anywhere in Famileze. The clever features — reading dates out of a school email, recognising text in a photograph, suggesting a folder — run on-device as small, purpose-built tools. Nothing is sent away to be "processed", and nothing is filed or sent without your approval.
Family content is never used to train any machine-learning model, ours or anyone else's — and we could not do so even if we changed our minds, because we cannot read it.
The one dictation exception
The iPhone's 🎙 uses Apple's speech recognition, and Apple may send that audio to its servers to turn it into text. Apple's service, Apple's privacy policy; we never receive the audio. Type instead if you'd rather nothing left the phone. Desktop dictation runs entirely on your family's own computer.
Children
Famileze is a product for parents, about children — which is not the same thing as being used by them. Children hold no accounts and are not invited to. There is no social feed, no messaging with strangers, no public profiles, no advertising, and no location tracking.
Health
Records, not advice: doses already given, growth, immunisations, appointments, sickness notes. Famileze never tells anyone what or how much to give, and says so in-app.
Deletion, portability, and if you stop paying
Account deletion is available inside the app, and it removes the account and every encrypted object from the cloud. The archive exports as ordinary photo and text files at any time — data portability without asking anyone's permission. Deleting the account never deletes the copies on your family's own devices; those are yours.
If a subscription lapses, nothing is deleted for a long notice window: a phone-only family's originals are kept for a further ~104 days — long enough to notice, install the free desktop app and bring the archive home.
Famileze is the family archive that doesn't read your family.
The binding versions of every claim on this page live in the privacy policy and terms. Questions the policy doesn't answer: the FAQ, or [email protected].