Guide · Every family
A family tenant: what private should mean for your child's photos
Most family apps are a feed with a lock.
Short answer: ask five questions of any app that holds your child's photos and words. Is each family isolated in the database, not just in the app? Do I know where the files live? Can I export everything and delete everything? Are there ads or third-party analytics on the child's data? What does the AI see, and is there a log? A private space answers yes, yes, yes, no, and here it is.
Why "private" usually is not#
Most family apps are a social feed with a smaller audience. The data model is a feed; privacy is a setting. Free tiers pay for themselves with ads, which means analytics, which means the child's photos are inputs to an ad system even when nobody outside the family can see them. Two of the largest family photo apps added ads to their free tiers in 2025.
A private space is different in structure, not in settings.
Five things that make a space private#
- Tenancy in the database. Each family's rows carry a family id, and the database itself refuses to return rows for another family. An application bug cannot leak across families because the database will not let it.
- A known region. Photos and recordings are large files in object storage. You should be told which region they live in, for example Singapore or the European Union, and that should be enforced when the file is written, not promised in a policy. Metadata such as GPS location should be stripped from uploads.
- Export. Everything, in formats you can open without the app: JSON for the data, CSV for tables, PDF for the portfolio. Any time, without asking.
- Delete, with a grace period. A real delete of the family's data, scheduled, with a window to cancel, and a banner every adult can see while it is pending.
- No ads, no third-party analytics on child content. Ever. If the business model needs them, the space is not private.
Roles, not one password#
An adult who runs the mornings should not have owner rights "for convenience". A grandparent who only wants to watch should not have a login at all. Roles should be the smallest that works: Account owner, Full access, Day-to-day, Highlights. A Day-to-day adult sees Today and their own history. A Highlights viewer sees a page a parent curated, through a link that expires.
AI, on a leash#
If an app uses AI, ask what it sends, whether each feature is opt-in, whether the model is told not to diagnose, and whether there is an audit log of every call. A coach that suggests next week's trays from your logs and cites the entries it used is useful. A "smart" feature that reads all your photos by default is not.
Sessions and links#
Sign-in by magic link or a one-tap invite means no password to leak, and it is what a grandparent can actually use. Share links should expire. The public marketing site and the private app should be separate origins so that a session cookie never touches a public page.
How Yearkeep does this#
Every Yearkeep family is a tenant enforced by row-level security in Postgres. Media is stored in Singapore, with an EU region available on request before setup. Export gives JSON, CSV, and PDF from Settings; delete is owner-only, requires typing the family name, schedules the deletion with a grace period, and shows a banner to every adult until it runs. There are no ads and no third-party analytics on child content. Each AI feature has its own switch; the coach cites the entries a suggestion is based on, never diagnoses, and writes every call to an audit log you can read in Settings. Roles are Account owner, Full access, Day-to-day, and Highlights; viewers use expiring highlight links without an account. The marketing site and the app are separate origins.
FAQ
What is a family tenant?
A tenant is a hard boundary in the database itself, so that a query from one family cannot return another family's rows even if the application has a bug. It is stricter than an access check in the app.
Do you use AI on my child's photos?
Only the features you leave switched on, only with the minimum data needed, with names replaced by placeholders, and every call is recorded in an audit log you can read. The coach suggests; it never diagnoses.
Can grandparents see everything?
No. A viewer gets a weekly highlight link that expires, with the moments a parent chose. They do not need an account and cannot see the full record.