Privacy Policy

What Hope is

Hope is a private, living family archive: a family tree, person profiles, and a memory vault shared only with the family members you invite. It is not a social network. There are no public profiles, nothing you add is published anywhere, and your archive is never searchable on the open web.

What Hope stores

You decide what goes into your archive. Depending on what you use, Hope may store:

• Account details — your name and email address, used to sign you in and to show your family who you are. Passwords are handled by our authentication provider (Supabase); Hope never sees or stores your password itself.
• People in your family — names, dates, birthplaces, living or remembered status, and the stories you write. Most people in an archive are family records, not account holders: recording someone does not create an account for them and does not notify them.
• Relationships — the parent, child, and partner connections you explicitly create. Hope never guesses or infers relationships on its own.
• Memories and milestones — the titles, dates, descriptions, and captions you add to the memory vault.
• Photos and documents — if you upload them. Media, including profile portraits, is stored privately and shown to your family through expiring links. A few portraits saved early in the beta live as small images inside the database instead; they keep working and are stored just as privately. Portraits are not yet covered by Protected Memories — see below.
• Life Notes — family-written notes some profiles gained during beta. The writing surface is currently set aside while we rethink it; any notes your family already saved are kept unchanged and nothing was deleted.

Drafts before you sign in

The “First Branch” sketch on the public start page is a temporary draft that lives only in your browser, on your device. Hope’s servers never receive it: nothing you type there is uploaded, stored by Hope, or visible to anyone else — but it is also not backed up, and it can be lost if your browser clears its data. On a shared computer, anyone using the same browser can see the draft. You can clear it at any time from the start page. Your family archive itself only ever exists behind your sign-in.

Who can see your family archive

Only members of your family workspace — people who were explicitly invited — and each member’s role controls what they can see and change. This boundary is enforced in the database itself (row-level security), not just in the interface.

Honesty note: most of your archive is not end-to-end encrypted. It is encrypted on its way to and from Hope, but like almost every hosted service, the people who operate Hope’s infrastructure could technically access it. The one exception is Protected Memories once your family turns it on — see below. We do not browse family archives, and we will never make them public.

Protected Memories

Protected Memories keeps your family’s memories readable only to your family, using end-to-end encryption. An owner or admin turns it on and sets an Archive Passphrase (separate from their sign-in password) and saves a one-time Recovery Kit. Other family members simply protect their device and are approved by someone already unlocked, so they never handle keys themselves. The passphrase and Recovery Kit never reach Hope in a readable form.

• What is protected: after a family turns on Protected Memories, new memory titles, stories and descriptions, captions, and new photo, video, audio, and document uploadsare sealed on a family member’s device (end-to-end encrypted) before they are saved. Hope stores only the sealed form and cannot read them; reading them needs an unlocked device.
• What stays readable by design:your archive’s name, who its members are, member roles and email addresses, invitations, the shape of the tree, and, for each memory, its date, its type, which people it links, its file counts, types, sizes, and timestamps, and its ownership records. Photos and files saved before your family turned protection on, and profile portraits, are also still readable for now (protecting them is planned). These keep invitations, sign-in, the timeline, and the tree working.
• Families that have not turned it on, and everything outside the Memory Vault (people, relationships, profiles, portraits), are stored as before, readable by Hope’s operators. Protected Memories is a per-family choice made in Settings.
• Recovery is deliberately limited: Hope cannot see or reset an Archive Passphrase. If you forget it, your Recovery Kit or another approved family member can restore your access. There is no server-side recovery and no support code, on purpose. If a family protects its memories and then everyone loses their passphrase and there is no saved Recovery Kit, those memories cannot be read by anyone, including us. Keep the Recovery Kit safe, and download a copy of your archive before turning protection on.

Your archive is not used for AI

Hope does not send your family’s information to AI services. An earlier beta feature could generate an optional AI summary on a person’s profile on request; it has been removed. Any summary a family saved back then remains ordinary, family-owned note text, stored privately and shared with no one.

Cookies and tracking

Hope uses no advertising or analytics trackers. The only cookies are the ones that keep you signed in. That is the whole list.

What Hope never does

• Sell your family’s information, or share it with advertisers.
• Publish profiles or make archives publicly searchable.
• Infer sensitive facts about your family — biological relationships, health, ethnicity, religion.
• Contact the people you record in your tree.

Your choices

You can download your complete archive from Settings at any time, and edit or remove people and memories whenever you like — removals are real and apply for your whole family. Deleting your account entirely is not self-serve yet; Your data explains exactly where that stands today.

Where your data lives

Signed-in archives are stored with Supabase, a managed database and storage provider. Hope is a beta product and does not yet hold formal compliance certifications — we would rather say that plainly than imply otherwise.

Changes and contact

As Hope grows, this page will be updated and the date at the top will change. If something meaningful changes about how your data is handled, we will tell signed-in beta families directly.

Every address below reaches a person, not a ticket queue:

• Privacy, data, or deletion requests — privacy@hopefamilyarchive.com
• Help using Hope — support@hopefamilyarchive.com
• Legal notices — legal@hopefamilyarchive.com
• Press and media — press@hopefamilyarchive.com
• Anything else — hello@hopefamilyarchive.com