Security

Access control

• Accounts require sign-in. Passwords are stored using a strong one-way hash, not in plain text.
• Trees are private by default. Others see your content only when you grant membership or sharing.
• Roles limit what invited people can change.
• Administrative actions are limited to operators responsible for running the service.

Encryption and hosting

• Connections to the site use HTTPS so data is encrypted in transit between your browser and the service.
• Application data is stored on secured infrastructure with encrypted storage volumes where the service is hosted.
• Service credentials and secrets are kept out of the public website and managed separately from client code.

Operational protection

• We monitor for abuse of authentication and review new registrations before access is granted.
• Activity relevant to account and tree administration is recorded to help investigate misuse.
• Backups and recovery practices exist so family data can be restored if infrastructure fails.

What you can do

• Choose a strong, unique password and keep it private.
• Invite only people you trust, and remove access when it is no longer needed.
• Sign out on shared devices.
• Tell the site operators promptly if you suspect unauthorised access to your account.

Honest limits

No online service can promise perfect security. We take practical steps to protect your data and to reduce risk, and we improve controls as the service evolves. The terms of use describe limits of liability for site providers.