Privacy Policy

Famvaults is the data controller for account information and for the operation of the service. You can reach us at hello@famvaults.com.

For the content inside a vault, the vault owner is the one who decides what is collected, about whom, and who sees it. In data protection terms they are the controller of that content and we process it on their behalf, on their instructions. We did not choose what is in your family’s vault and we have no way to review it. See section 5, which matters more than it might first appear.

Most people reading this will be keeping a record of their own family, privately, for no business purpose. Under most data protection laws that is a purely personal or household activity, which those laws do not cover at all — which is also why publishing a vault to the open web is switched off for the whole beta. If your use goes beyond that, the paragraph below sets out the terms on which we handle the content for you.

Our undertakings as processor. Where we process vault content for you, and for as long as we do, we: act only on your instructions and not for our own purposes; keep it confidential and allow access only to the few people who maintain the service; apply the security measures in section 11; use only the sub-processors listed in section 8 and tell you here before adding another; help you answer a request from someone whose data is in your vault, and notify you without undue delay if we become aware of a breach affecting it; give you the information you reasonably need to show you are meeting your own obligations; and delete it when you delete your vault or close your account, as section 9 describes. Because wiki articles under a vault passphrase reach us already sealed, on those we can do less for you than this list implies — we cannot search, correct or read them, only delete them. These undertakings apply for as long as you use Famvaults, and this section is the record of them.

Famvaults is not intended for, offered to, or marketed to people in the European Union, the European Economic Area or the United Kingdom. We do not advertise there, and the service is not designed for those markets. If someone there is invited to a vault and uses it anyway, nothing in these documents takes any right away from them: everything we promise here applies to them exactly as it does to everyone else.

• Account information — your email address, a display name if you give one, and an encrypted password hash. We never see your actual password. The one-time codes we email you to confirm your address, sign in or reset a password are stored only as a hash by our authentication provider, and stop working after an hour or once used.
• Your date of birth, once — we ask for it when you open an account, to check you are old enough to hold one (see section 12). It is compared and then discarded: we keep only the fact that the check was passed, and when.
• The Sunday email — if you belong to a vault, we email you one question from it on Sunday mornings. It carries the vault’s name, the question, and the names of anyone in the vault’s family tree who has a birthday that week (with the day, and the age they turn when the tree gives a year of birth). It carries nothing from the wiki. Every one has a link to stop them, and so does the vault’s front page; we record who has turned it off, and which week each email went out so nobody gets two.
• New-page emails — when someone adds a page to a vault you belong to, we email you to say so. It carries the vault’s name and the name of the person who added the page, and nothing written inside it — not even its title, which is sealed and which we cannot read. Every one has a link to stop them; we record who has turned them off, and how many went out for each new page so nobody is told twice.
• Reminders — at most one email for each step where someone is stuck: if you joined a vault three or more days ago and have not opened it yet, we remind you once; and if a member of a vault you own has been waiting a day to be let in, we tell you once, with that member’s email address. They carry the vault’s name and nothing from inside it. Every one has a link to stop them; we record who has turned them off and which reminders were sent, so nobody is reminded twice.
• Vault content — the articles, photographs, family tree entries and files you and your members create. Where a vault passphrase is set, wiki articles reach us already encrypted and we hold only ciphertext.
• Answers to a question link — a member can send a relative who has no account a link to answer one of the vault’s questions. The member sends it themselves, by message or however they like, so we never receive the relative’s phone number or email address. The answer, and the name the relative chooses to give, are locked on their own device before they are sent, so we hold only ciphertext, the question, and when it was answered. A member turns the answer into a page or discards it, which deletes it; a link stops working after thirty days.
• Membership records — who belongs to which vault, at what access level, and the status of invitations.
• Feedback — if you use the feedback form, your message (and your email address, if you give it or are signed in) is emailed to us so we can read and answer it. It is not stored anywhere else.
• Technical logs — our host records requests (IP address, timestamp, page) for a short period, to keep the service running and to investigate abuse.

We do not collect payment details, because nothing is sold. We do not buy data about you, and there is no advertising of any kind inside Famvaults. We do advertise Famvaults elsewhere — that is how you may have found us — and nothing about you travels in the other direction: we never upload your email address, or any other personal data, to an advertising platform, and we do not build audiences or lookalike lists from our account holders.

Why we are allowed to use it. Account information, vault content and membership records are used to provide the service you signed up for, which is the legal basis of performing our contract with you. Technical logs are used to keep the service secure and working and to investigate abuse, on the basis of our legitimate interest in doing so, which does not override your rights because the logs are short-lived and used for nothing else. The Sunday email, new-page emails and reminders are part of the service too; you can turn any of them off at any time and nothing else changes. Where the law requires us to keep or disclose something, the basis is that legal obligation. We do not rely on your consent for any of this, and we make no decisions about you by automated means.

An email address, a password and a date of birth are needed to open an account; without them we cannot provide the service. Everything else you give us is up to you.

Famvaults sets cookies for two purposes: keeping you signed in, and remembering which of your vaults you last opened. Both are strictly necessary for the service you asked for to work, which is why you are not asked to consent to them, and neither is read by anyone but Famvaults. A third is set only if a date of birth entered at signup is below the minimum age: it holds no detail of the person, stops a second attempt from the same browser, and expires after a day.

Your browser also remembers two small preferences for you, in its own storage rather than in a cookie: whether you chose a light or dark appearance, and which of the rotating headlines the front page showed you last, so that a reload does not repeat it. Each is a single value, it identifies nobody, it never leaves your device, and clearing your site data removes it.

Once you unlock a vault, your browser keeps the keys that open it, so you are not asked for your passphrase on every page: the vault’s key and your own private key, stored so that they cannot be copied out of the browser, until you sign out. If you arrive on an invite link that carries a vault, your browser holds that link’s secret for up to eight days, until it has let you in. If you joined someone else’s vault, you have no passphrase at all: your browser makes your private key itself and keeps it, with a note of the matching public key so it can tell when it needs a new one. None of these is ever sent to us — keeping them on your device is what lets us say we cannot read your vault. Signing out, or clearing your site data, removes a key made this way, and the family’s next visit lets you in again with a new one. Signing out removes the keys; anyone else who can use your browser while you are signed in can read your vault, as they could read anything else you have open.

There are no analytics, advertising, or social-media tracking cookies, no advertising or conversion pixels, and no third-party scripts run on these pages. Our display typeface is served from our own domain rather than from Google Fonts, so loading a page does not disclose your visit to a third party.

Famvaults is unfinished software offered free of charge, and a privacy policy that did not say so would be describing a different product. Specifically, while the beta runs:

• Older accounts were not email-verified. Since 29 September 2026 we confirm the email address of every new account by sending a code to it. Accounts opened before then were not asked to, so on those the address is a label rather than something we have confirmed. Joining an existing vault still requires a signed invitation from its owner, so this does not expose anyone’s vault.
• End-to-end encryption covers wiki articles. Once a vault is locked, article titles and text are sealed in your browser and we cannot read them, and so are answers sent through a question link (though not the question itself). Family tree entries, chat messages, the daily questions a family writes for itself (including the one we email on Sundays), and photographs arenot yet end-to-end encrypted: they are encrypted in transit and at rest by our providers, which means we could in principle access them. We will update this page when that changes, rather than claim it early.
• Members are let in automatically, from a list we keep. When anyone in a vault has it open, their browser passes the vault’s key to every member on that vault’s member list who does not have it yet. The list is stored by us. So the encryption keeps your articles from us only as long as nobody — us, or someone who broke into our systems — adds a stranger to your vault’s member list. Everyone in a vault is shown under Members, so the family can see who is in, and an owner can remove anyone.
• Our practices are still developing. We hold no security certification (no SOC 2, ISO 27001, HIPAA business associate agreement, or PCI scope) and cannot enter compliance commitments of that kind. See section 6.
• We may end the beta. If we do, account holders will normally get at least 30 days’ notice, with the export tools working throughout, after which vaults may be deleted. If something outside our control forces an earlier end, we will give as much notice as we reasonably can.

This is the part most family archives overlook. A vault is, by its nature, full of personal information about people who are not you — relatives, children, and people who have died. Some of it may be sensitive: health, religion, ethnicity.

If you create or upload that information, you are responsible for having a proper legal basis to do so, and for meeting the obligations that come with it. In practice that means: tell living relatives what you are recording about them, do not publish anything they have asked you not to, take particular care with information about children, and remove anything a person reasonably objects to. Where data protection law treats you as the controller of that content, those duties are yours and we cannot discharge them for you.

If you believe a Famvaults vault holds information about you and you want it removed, contact us. We will pass the request to the vault owner and help resolve it — but because vaults are private, and in the case of wiki articles encrypted with a key we do not hold, we usually cannot find, read, correct or delete the specific content ourselves. The owner has to act, and we will press them to.

Famvaults is built for a family’s own records. It is not a certified, audited or regulated system, and we can offer no compliance assurance for one. Please do not store:

• payment card numbers, bank credentials, or passwords to other services;
• national identity, passport or tax numbers you have no family reason to keep;
• medical, legal or financial records that a law, a contract or an employer requires to be held in a certified, audited or regulated system;
• anything you are under a professional duty of confidence to protect — a client's, a patient's, or an employer's records;

If you store such records anyway, you do so on your own assessment and at your own risk, and the responsibility for any consequence is yours. The Acceptable Use Policy says the same thing from the other direction.

Only you and the members you invite. Isolation is enforced in the database itself, per row, so a request for another family’s content returns nothing rather than relying on the application to remember to check.

Photographs and images live in private storage. They are never served from a public address; each view is granted a link that expires after four hours, so a copied link stops working.

Publishing a vault to the open web is switched off for the entire beta. No vault is reachable by a stranger or indexed by a search engine.

Our staff do not read vault content. Access is limited to the small number of people who maintain the service, and only where necessary to fix a fault you have reported or to meet a legal obligation. For wiki articles under a vault passphrase this is not merely a promise: we hold no key and could not read them if we were asked to.

Encryption cannot, however, protect against a device someone else can use, a passphrase that is easy to guess, or a member you invited who turns out to be the wrong person to trust. Who holds access to your vault is your decision.

Your data is held by the providers below. Each is bound to process it only on our instructions. This means your data may be transferred outside the country where you live. Those transfers rely on the safeguards each provider offers — standard contractual clauses, or an adequacy decision where one covers the destination. You can ask us for a copy of the relevant safeguard. We use these providers’ free or standard tiers, and their availability is outside our control.

If we add a processor, this list changes in the same release. We may also disclose information where the law requires it — a valid court order, for instance — and will tell you unless we are prohibited from doing so.

Vault content is kept until you delete it. Deleting your vault removes its content and files from our live systems immediately, and from our providers’ backups within 30 days. Deletion is permanent: we cannot restore a vault for you afterwards, and for encrypted articles we could not read them back even if the rows survived.

Technical logs are kept for a short period, typically under 30 days. Where the law requires us to retain something longer, we keep only that and nothing more.

Wherever you live, you may ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete your data;
• restrict or object to how we use it;
• receive the data you gave us in a structured, commonly used, machine-readable form — ask us and we will send it;
• withdraw consent, where we relied on it.

Three of these you can act on immediately, without asking us: Export & backups in Settings turns your whole wiki into a printable volume; Export GEDCOM on the family tree downloads the tree as a GEDCOM file, the standard machine-readable format genealogy programs exchange; and delete in Settings removes the vault for good. Those tools do not depend on us answering an email, and the printed volume is the copy the Terms ask you to keep.

Two honest limits on that. Between them the tools cover the wiki and the family tree, not yet the chat, the original photograph files, or the photographs and wiki links attached to people in the tree — write to us and we will send those as data files. And a printable volume is not the machine-readable format the portability right above describes, so if that is what you want, ask, and do not rely on the print dialog to have given it to you. For wiki articles sealed under a vault passphrase, the only copy we are able to hand over is the encrypted one: we do not hold the key, and the readable copy is the one your own browser makes.

For anything else, email hello@famvaults.com. We respond within one month, or sooner where the law where you live requires it. That may be extended by up to two further months for complex or numerous requests; if we need longer we will tell you why within the first month. Requests about content inside someone else’s vault take the time needed to reach its owner. We may ask you to confirm your identity before acting, so that we do not disclose a family’s records to the wrong person. You may complain to the data protection authority of the country where you live or work at any time, without asking us first.

Requests about content inside a vault are usually the vault owner’s to answer, for the reasons in section 5. We will forward them and help.

Data is encrypted in transit and at rest. Wiki articles under a vault passphrase are additionally encrypted in your browser, under a key we never receive. Access between vaults is blocked at the database row level. File storage is private and served only through short-lived signed links. Passwords are hashed by our authentication provider and are never visible to us.

No service can promise perfect security, and Famvaults is a beta run by a very small team. We do not warrant that the service is secure or error-free, and you should weigh that before entrusting it with something irreplaceable. If we discover a breach affecting your personal data, we will notify you and the relevant authority as the law requires. Please tell us at once if you find a vulnerability — we will not pursue anyone who reports one in good faith.

Famvaults is for adults: accounts are for people aged 18 and over, or the age of majority where they live if that is higher. We ask for a date of birth when an account is opened and refuse one below 18; we do not keep the date. Famvaults is not directed at children or teenagers, and we do not knowingly collect account information from anyone under 18. Family records naturally describe children, and often should — that is the vault owner’s responsibility under section 5, and it deserves more care than any other kind of entry.

If you believe a child has opened an account, or that a vault holds information about a child that should not be there, write to hello@famvaults.com and we will act. If we learn that an account belongs to someone below the minimum age, we close it and delete its account information without waiting to be asked. A child can still appear in a family’s records, and be shown them by a parent; what they cannot do is hold an account of their own, or be invited to one.

If we change this policy in a way that materially affects you, we will notify account holders before it takes effect. The date at the top of this page always reflects the current version. See also our Terms of Service, which set out what the beta does and does not promise, and the limits of our liability.