Security
A family archive is worth protecting properly. Here is exactly how we do it, including the parts that are not perfect yet.
Where your data lives
Everything is stored on Supabase — a managed Postgres database and file storage — in the Asia-Pacific (Tokyo) region. Connections to the app are encrypted in transit with TLS.
Encryption
Stories, chat messages and media files are encrypted on your phone before upload, using XSalsa20-Poly1305 (NaCl secretbox) with a 256-bit key that is unique to your family. What reaches our storage is ciphertext.
What that does and does not mean. The family key is derived from a random seed that Kinfolktree stores for your family, so our systems could in principle derive it. This is encryption at rest, not end-to-end or zero-knowledge encryption. It protects you against a leaked database or a stolen storage bucket; it does not protect you from Kinfolktree itself. We are working toward a design where the seed never leaves your family's devices, and we will update this page when that ships.
Media buckets are private. A photo or recording can only be fetched with a short-lived signed link that is issued to a signed-in member of the right family and expires within an hour.
Who can see what
- Every database table is protected by row-level security. A signed-in member can only read rows that belong to their own family. This is enforced by the database, not just hidden in the app.
- Private vault entries are visible only to their author until that person releases them.
- Direct messages are visible only to the two people in the thread. The family admin cannot read or delete them.
- Billing fields (plan, seats, storage) can only be changed by our payment system. App users cannot write to them, even with a modified app.
Joining a family
The tree only grows by invitation. Invite codes are single-use and expire. Redemption happens through a server function that checks the code, so a code cannot be guessed or reused.
Accounts and sign-in
- Sign in with Apple or email and password, handled by Supabase Auth.
- Sessions are stored in the app's private sandbox on your device and refreshed automatically.
- Password reset links open the app directly and expire.
Payments
Card details go straight to Stripe and never touch our servers. Stripe notifies us of a payment with a cryptographically signed message; we verify that signature before changing anyone's plan.
Notifications and email
Push notifications say who did what ("Rose added a photo") and never include the contents of a message or entry. Invite emails go through Resend and are rate-limited per member to stop abuse.
Backups and export
- Each family's data is backed up automatically every week. Backups stay on our servers and are used only to restore that family's data.
- Any member can save a readable copy of the tree, stories and chat, or export the tree as a GEDCOM file, from Profile → Data Sovereignty at any time. Photos, voice notes and video stay in the app.
Limits that protect everyone
- Per-family storage quotas (250 MB on Sapling with no video, 25 GB per paid plan) and a 750 MB per-file cap. Guest accounts cannot upload until they add an email.
- Rate limits on invites and notifications.
- Crash reports strip email addresses and link tokens before leaving the device.
- Self-service account deletion in the app (Profile → Delete my account) removes your auth record, member row, vault entries, messages, invites and media at once.
What we are still working on
- True end-to-end encryption, with the family seed never stored on our servers.
- An independent security review. We will publish the summary when it is complete.
Found something?
Email kinfolktree888@gmail.com with "security" in the subject. We read every report, we will not take action against good-faith research, and we will credit you if you want us to.