Your archive belongs to you

Our promise

A family archive is a family’s inheritance, not a platform’s asset. You should always be able to take a complete, readable copy of your archive with you, and Hope should never make leaving hard. Portability is a feature we build on purpose, not a legal checkbox.

Export works today

From Settings › Archive & Restore, your archive’s owner and admins can download the complete archive — every person, relationship, and memory — as one readable JSON file, as often as they like. Your family’s copy is never held back: the owner always has this button.

Honest limits: downloading the entire archive is kept with the people who look after it (the owner and admins) — guests and members can ask them for a copy. Photo and document files you uploaded (protected or not) are not bundled inside the archive file yet — keep your originals. Including media in exports is planned.

If your family has turned on Protected Memories, the download unseals your memory titles, stories, and captions on your device so your copy stays readable, and the file records that it holds readable content. Because that needs your passphrase, exporting a protected archive requires it to be unlocked first; Hope never puts unreadable, sealed content in your download. Protecting memories is one-way in practice, so download a copy before you turn it on.

Portability

The archive is plain, readable JSON — your family’s information is never locked in a format only Hope can open. Restoring an archive back into your family workspace isn’t available yet, and Settings says so in the same words; your downloads always work, so your copy is never locked in.

Pre-sign-in drafts are yours, on your device

The First Branch sketch on the public start page never reaches Hope’s servers — it lives only in your browser’s local storage. That means Hope cannot see it, back it up, or recover it for you: clearing it from the start page, clearing your browser data, or switching devices removes it entirely. Your real archive — the one Hope stores, protects, and exports — begins when you create your account.

Deleting things inside your archive

Removing a person, memory, or photo from your archive works today and is real: it is removed for your whole family, not hidden. Removing a person comes with a few seconds to undo, in case of a slip. Removing a memory or a photo has no undo yet — Hope asks before deleting a memory, and once something is removed, it is gone.

Encryption keys and recovery — deliberately limited

Families can set up end-to-end encryption in Settings (an Archive Passphrase, separate from the sign-in password, and a one-time Recovery Kit) and turn on Protected Memories. Once it is on, your new memory titles, stories and descriptions, captions, and new photo, video, audio, and document uploadsare sealed on a family member’s device before they reach Hope, so Hope stores only the sealed form and cannot read them.

Honest scope: new memory writing, captions, and new photo, video, audio, and document uploads are sealed this way. Photos and other files saved before your family turned protection on are notsealed yet, and profile portraits are not included yet. They are kept private the same way the rest of your archive is, and protecting them is planned. Some details always stay readable so the app can work: your archive’s name, who its members are, and, for each memory, its date, its type, which people it involves, and each file’s type, size, and timestamps. We will update these pages as more of your archive becomes protected.

Recovery works differently from a normal password, on purpose. Hope cannot see or reset an Archive Passphrase — there is no server copy and no support code, and the passphrase and Recovery Kit never reach Hope. If you forget the passphrase, your saved Recovery Kit unlocks your keys, or another family member with access can confirm you again after you set a new one. A sole member who loses both the passphrase and the Recovery Kit cannot recover their protected memories — not even by emailing us. Your archive download above remains a readable copy you control, so download one before you turn protection on.

Account and workspace deletion — not self-serve yet

There is no “delete my account” button yet, and we won’t pretend otherwise. Full account and workspace erasure will be built before Hope takes payment from anyone. Until then:

• You can stop using Hope at any time, and download your archive first so you leave with everything.
• If you want your account or family workspace erased now, email privacy@hopefamilyarchive.com and we will handle it with you directly.

Related pages

The Privacy Policy explains what Hope stores and who can see it; the Terms of Service cover the agreement for using Hope during beta. And if anything on this page is unclear, just ask: support@hopefamilyarchive.com.