Security
How family data is protected
Short and factual. The privacy page says what we collect and why; this page says how it is kept safe.
Isolation
Every row of family data carries a family id, and Postgres row-level security refuses to return rows for another family. The API runs as a database role that cannot bypass that policy. Background jobs run per family with the same policy set.
Sign-in and sessions
Adults sign in with a magic link sent to their email, or with a password they set later. Day-to-day adults and viewers join with a one-tap invite link. Sessions are cookies scoped to the app origin only. State-changing requests are checked against an allow-list of origins. Magic links, share uploads, and RSVP links are rate-limited.
Media
Photos and recordings are stored in an S3-compatible bucket in Singapore (an EU bucket exists for families who ask before setup) and served through the API with signed, short-lived access. Every upload is re-encoded on our side, which strips EXIF, location, and device metadata, and the original is deleted.
Sharing
Grandparent highlight links expire on a schedule the family sets. Viewers never receive a full account. Concern flags stay between the adults of the family.
AI
Each AI feature has its own switch in Settings › Privacy, and the whole coach can be turned off; switching it off deletes stored chats and suggestions. Calls send only the text needed for that feature. Every call is written to an audit log the family can read in Settings. The coach is instructed never to diagnose and to cite the entries a suggestion is based on.
Two origins
This public site and the app are separate origins. The site holds no session cookie and reads no family data. Sign-in and sign-up happen on the app origin only.
Reporting a problem
Write to hello@yearkeep.com with the subject “Security”. We reply to every report.