Privacy

Famlistry holds the things your family would least like to lose. This page says what it keeps, where it keeps it, who else ever sees any of it, and how to take a copy or destroy the lot.

In force from 11 August 2026. Famlistry is run by Rogue Oak, which is responsible for the data described here. Write to support@famlistry.com about anything on this page.

What Famlistry holds

• Your account. Your name, your email address, a hash of your password (never the password), your date of birth if you gave one, your profile picture if you set one, whether the address has been confirmed, and which notification emails you want.
• Anything staff wrote about your account. If Famlistry ever suspends an account, the reason is recorded on it in the words of the person who did it, along with when. Nothing of the kind exists unless that has happened.
• What you put in. Stories and their dates, comments, the photographs, video and recordings you upload, and the families you belong to with the role you hold in each.
• Where you are signed in. One record per device, holding the browser it reported and the network address it connected from, so the security screen can show you what is signed in and you can end any of it.
• Messages sent to you. Which message went to which address and whether it arrived. Not what it said.

Files uploaded from a phone often carry the place and time the photograph was taken. Famlistry keeps the original exactly as you gave it, which means it keeps that too. Anybody you share the file with can read it, the same as if you had sent them the file directly.

Where it is kept

In Canada, and it stays there. One server in Toronto, rented from DigitalOcean, holding everything except the files themselves; those live in DigitalOcean object storage in the same account and the same city. The database is dumped every night and the last seven dumps are kept, so a mistake is recoverable for about a week - which also means something you deleted yesterday is still in a backup today.

Who else sees it

• DigitalOcean - The droplet Famlistry runs on and the object storage the files live in. Everything is there, because that is where the service is.
• Resend - Sends the transactional messages: confirm your address, reset your password, you were invited. It sees the recipient address and the words of that message, and nothing else.
• PostHog - Counts the events listed below, with no content and no page addresses in them. It sees nothing you wrote.
• Constant Contact - Holds the mailing list: the addresses of people who asked to hear about Famlistry, and nothing else. Nothing about an account reaches it, having an account does not put you on it, and every message it sends carries its own unsubscribe.

Nothing is sold, and nothing is handed to an advertiser. There is no advertising on Famlistry, so there is nobody to hand it to.

Who can see what you post

One rule decides it, everywhere: a story or a file belongs either to you or to a family. Yours is yours alone. A family’s is visible to everybody in that family, and stays with the family if you leave. There is no other setting, and nothing on Famlistry is public.

Cookies, and what your browser keeps

• Two cookies while you are signed in, which are what being signed in means. They cannot be read by JavaScript and are locked to Famlistry.
• One cookie for the analytics switch below, holding nothing but the word off. It is set only if you turn it off, or if you visit and your browser has already said no.
• Text you are part way through writing is kept in your own browser so that closing the tab does not lose it. It never leaves the machine until you post it.
• The counting below sets no cookie at all. It keeps a random id for this browser in your own storage instead, which clearing your site data removes.

What Famlistry counts

Famlistry counts a short list of things, so it is possible to tell whether any of it works. The list is below, in full, and it is generated from the same file the code sends from - so it cannot quietly fall out of date.

What is never sent

• a story title, or anything you wrote in one
• a comment
• a photograph, a video, a recording, or the name of a file
• a family name, or anybody in it
• your name, your email address, or your birthday
• the address of the page you are on, which on a family archive is an identifier by itself

There is no automatic capture of clicks, typing, or page content, and no session recording. Those are switched off, and a check in the code drops anything that is not on the list below before it can leave the browser.

Your network address is the one thing a browser cannot hide from a service it talks to. Every event is sent with a blanked address and a request not to derive a location from it, which is the most the browser can do; discarding it on arrival is a setting on the analytics project rather than something this code can enforce.

Who you are

Once you are signed in, events carry your account id: a random identifier that means nothing outside Famlistry’s own database. No name, no address, no family. Signing out forgets it. Before you sign in, no profile is created and nothing says who you are - only the random id for this browser described above, which says that two visits came from the same place and nothing else about you.

On every event

Whatever else it says, every event below also carries this:

• surface - Which of the three apps sent it. The spec asks for one project, told apart by this.

And what any site your browser talks to can see about the browser itself. Famlistry keeps this much and drops the rest:

• which library sent it, and its version
• a random id for this one event, so a retry is not counted twice
• when it happened
• a random id for this browser, minted here and meaning nothing anywhere else
• a random id for this visit
• a random id for this tab
• which browser, and which version
• which operating system, and which version
• whether it is a phone, a tablet or a computer
• the size of the screen
• the size of the window
• the site you followed a link from, if you did - the site, never the page
• a blanked network address, and a request not to derive a location from it

Every event

• lander_viewed

  Somebody opened the Famlistry home page.

  Nothing beyond the event itself.

• waitlist_submitted

  Somebody joined the waitlist. Not the address, and not the name.

  • with_name - Whether the optional name field was filled in. Never what was typed in it.

• sign_up_started

  The sign-up form was shown to somebody who is not signed in.

  Nothing beyond the event itself.

• sign_up_completed

  An account was created.

  Nothing beyond the event itself.

• verification_completed

  An email address was confirmed by following the link.

  • signed_in - Whether confirming also signed the browser in, which tells the two 0009 outcomes apart.

• onboarding_step_started

  An onboarding step was shown.

  • step - Which of the three steps.

• onboarding_step_completed

  An onboarding step was finished.

  • step - Which of the three steps.

• onboarding_step_skipped

  An onboarding step was skipped, which is a different thing from finishing it.

  • step - Which of the three steps.

• family_created

  A family was created. Not its name.

  • during_onboarding - Whether it happened inside onboarding or from family management later.

• invitation_sent

  An invitation was sent. Not the address it went to.

  • role - The role the invitation offers.

• invitation_accepted

  An invitation was accepted.

  • had_account - Whether the invitee already had an account or registered to accept.

• story_created

  A story was saved. Not its title, its body, or anything in it.

  • kind - Written, recorded, or media only.
  • with_body - Whether it has written text at all. Never the text.
  • asset_count - How many photographs, clips or recordings are attached.
  • asset_kinds - Which kinds are attached. Never an asset id, which resolves to media.
  • is_private - Whether it is private or shared with the family.

• asset_uploaded

  A file finished uploading. Not its name, and not its id.

  • kind - Image, video, or audio.
  • size_bytes - How big it was, for knowing whether the limits are right.

• recording_made

  A voice recording was made in the browser.

  • duration_seconds - How long it runs.

• export_requested

  Somebody asked for a copy of their archive.

  Nothing beyond the event itself.

• account_deleted

  An account was deleted by the person who owned it.

  Nothing beyond the event itself.

• export_completed

  An export finished in the worker, where no browser could see it.

  • asset_count - How many files went into the archive.
  • duration_seconds - How long the worker took.

• derivation_failed

  A thumbnail or poster could not be derived, which is invisible by definition.

  • kind - The kind of source file that failed.

Some of these belong to parts of Famlistry that are not built yet. They are listed anyway, because the point of the list is that it is complete.

Turning it off

If your browser sends Do Not Track or Global Privacy Control, none of this happens and the switch below is already off. Otherwise you can turn it off here, and it holds across all of Famlistry until you clear your cookies.

There is no consent banner, and that is a decision rather than an oversight. Counting is off for anyone whose browser says no, the switch above is on every surface, and nothing that counts carries anything you wrote - so a banner would ask for permission to do less than it implies. If the list above ever grows into something a banner would be the honest answer to, the banner comes first.

How long it is kept

• What you put in stays until you or your family delete it.
• An archive you asked for is downloadable for seven days, then it is destroyed.
• The nightly database dumps go back about a week.
• A signed-in device expires after sixty days of not being used, and ending it removes it at once.
• If a message to your address bounces hard, that address is recorded as undeliverable until somebody clears it, so Famlistry stops writing to a dead inbox.

Getting a copy

Settings has an export. It builds a zip of everything you put in - your stories with their text and dates, your comments, and every file at its original size, in dated folders with a readable index - and emails you when it is ready. A family archive can be exported the same way by an admin of that family; it contains what belongs to the family, and never another member’s private files.

Leaving

There are two ways out, and they are not the same. Deactivating destroys nothing: you cannot sign in, every device is signed out, and coming back is signing in again. Deleting is permanent and immediate.

Deleting your account destroys:

• your account, your password, and every device it was signed in on;
• your private stories, and the files only you could see;
• any archive you had exported;
• the record of which messages Famlistry sent to your address and whether they arrived, which goes at the same moment the account does;
• any family you are the last admin of, if you choose that instead of handing it to somebody - and that takes the whole family archive with it, other members included.

And it deliberately leaves behind:

• the words of your comments, on other people’s stories, with your name taken off them. "That is Aunt Mary on the left" belongs to the family’s record of the photograph more than it belongs to whoever typed it, and losing it when somebody leaves would be the wrong default. Nobody can edit it afterwards. If you would rather a comment went, delete it yourself before you close the account - you can always do that, wherever it ended up.
• stories you posted to a family, and files you added to one, with the byline removed for the same reason;
• your email address, but only if a message to it ever bounced permanently or you ever reported one as spam. That address stays on a short list of addresses Famlistry will not write to. It has to: the list is keyed on the mailbox rather than on an account, so closing an account cannot be a way to start unwanted mail again, and a domain that keeps writing to dead addresses stops reaching anybody’s inbox. Nothing else about you is on it, and support@famlistry.com will clear it if you ask.
• whatever is in a nightly backup, until that backup ages out about a week later, and whatever is on the mailing list, which is separate and has its own unsubscribe.

Asking for something

Write to support@famlistry.com and a person will answer. A copy of your data and deletion are both self-service in settings and do not need to be asked for; anything else - a correction, a question about this page, an objection to something here - goes to the same address.

When this page changes

The date at the top says which version this is. A change that alters what is collected or who sees it will be sent to the address on your account before it takes effect, rather than appearing here quietly.