Your data

Your account: your email address, so you can sign in; the name you display; an optional handle, unique across the app; and your date of birth, used once to check you are old enough and never shown to anyone else. The birthdays the app shows come from the family tree, added by whoever put you on it.

What you add: your posts, photos and albums, and the people on your family tree, with their names and birthdays.

Your photos, three times: the original at full quality, so you can download or print it later; a large copy for viewing; and a small one for browsing. A moving photo is kept twice instead: the file you uploaded, and one small still picture of it for grids.

A cover photo, if an admin sets one. Just one small copy, with no full-quality version: it is decoration, not a keepsake. Replacing or removing it deletes the old one straight away.

No passwords: signing in sends a one-time link to your email.

Only the people in your kubo. No public profiles, no way to search for you, nothing indexed by search engines.

Before you join.An invite link shows the kubo’s name, its size and its cover photo to anyone holding it, so send it only to people you mean to invite. Nothing else is visible until you join, and a link an admin has turned off shows nothing at all, not even the name.

Sharing that link shares the cover photo. Messaging apps fetch a link to build the preview card, so a copy of your cover reaches whoever made that app: Apple, Meta, Google. It is the only photo that ever leaves here, and turning the link off cannot take back a card already sent. To avoid it entirely, remove the cover first; with none set, the preview is plain text.

Family kubos show everyone by their account name, so the people on your tree are the people you know. Community kubos let each member choose a handle instead. That starts as your name, and your account page is where you change it: for one kubo, for every community you are already in, or for the ones you join from now on.

Everyone in your kubo sees everything in it. An admin of your kubo can also edit or remove anything in it, including posts and photos other people added. If you belong to more than one, they stay completely separate.

Your photos and your family tree are never sold, never shared with advertisers, never used to train anything, and never used to show you ads. There are no ads here at all.

When you add a photo, the app reads three things: the date it was taken, so photos sort and export by year; how many pixels across it is, so the page does not jump as it loads; and what camera took it and how it was set, which is kept with the photo. That is all it reads, and it never reads or records where a photo was taken.

Whether anyone else sees that camera is up to your kubo, and it is off unless an admin turns it on. You can switch it off for your own photos there at any time, on your account page, and it stops being sent to anybody straight away.

Your original is kept exactly as it came off your camera, so anything the camera saved stays inside it, including a location if it recorded one. Nothing in the app shows that location, and only people in your kubo can open the file. The browsing copies have all of it stripped, and your phone can usually remove a location when you share or upload.

A moving photo, like a GIF, works differently. There is no separate browsing copy of it, because re-saving it is exactly what would stop it moving, so your kubo is shown the file you uploaded and anything inside it stays inside it. The small still picture used in grids is made fresh and carries none of it.

iPhones are the exception: they shoot in a format the web cannot show, so the app converts yours to a full-quality JPEG. The conversion rebuilds the picture, so no camera information survives it, location included. That converted file is the one kept for you. The date and the camera above are read from your file before that happens, which is why they are known even though the kept file no longer carries them.

There is currently no analytics or tracking.

A family tree holds children’s names and birthdays, and family photos have children in them. That is the point of the app, and the most sensitive thing it holds.

You must be 13 or older to have an account. Everything about a child here was added by an adult in your kubo and is visible to everyone in it. Add a child's photos and details with the care you would use for any album you share with family.

You can delete your own posts and photos at any time. Deleting a photo destroys all three stored copies straight away. That cannot be undone.

Only the owner of a kubo can delete the whole thing, from its settings. That erases the photos, albums, posts and family tree inside it for everyone, including what other people added, and destroys the stored files with it. You type the kubo's name to confirm, because nothing is kept and nothing can be recovered. An owner can hand a kubo over instead, except a gallery: that is one person's own space, so it cannot be handed over.

You can delete your entire account yourself, from your account page. Your account, your posts and your photos go straight away, stored files included. What you added to a family tree stays, because it is your family’s record rather than yours alone, but your name comes off it.

If you own a kubo, you will be asked to hand it over or delete it before your account can go, so none is left with nobody looking after it. A gallery is the exception: only its owner adds photos, so it is already all yours, and deleting your account deletes the gallery too. You are shown each one by name first, and anyone you invited loses access.

Three services hold data, only so the app can work: Supabase for the database, the photos and sign-in; Resend for the sign-in emails; Vercel to run the app. Data is stored in the United States.

This is an early, invite-only version, so you will be told if anything here changes. For any question about your data, to get a copy of it, or to delete it, email CONTACT_EMAIL_TBD@example.com.