Private by default, and specific about what that means
Everybody's privacy page says "we take your privacy seriously". Here is what is actually true of this software, in specifics you can check.
- Reachable only by a secret link, and blocked from every search engine
- Each family gets its own isolated database and photo directory
- Export everything or delete everything, yourself, at any time
A secret link, not a public page
Your registry lives behind a long random token. Without it every page returns "not found" — including the photographs, which are served through the same gate rather than sitting in a public folder somebody could guess their way into.
Every registry page carries instructions telling search engines not to index it, not to follow its links, not to archive it and not to show a snippet. The only page on this platform that search engines are invited to read is the marketing site you are on now.
Your family's data is not mixed with anyone else's
Each registry gets its own database file and its own upload directory. This is not a shared table with a tenant column, where one missing filter in one query leaks another family's memories — the separation is at the file level.
Things we deliberately do not do
No advertising, and no advertising network embedded anywhere in the product. No selling or sharing of anything you write here. No third-party analytics watching your village read your photos. Your QR codes are drawn inside your own browser rather than fetched from a QR service, because sending your private link to a third party to render a picture of it would defeat the point.
Leaving is a button, not a support ticket
Export the whole vault as a ZIP whenever you like — photos plus everything written, in readable files. Delete the registry permanently by typing its address to confirm, which also cancels the subscription before anything is removed, so nobody is ever left paying for a registry that no longer exists.
And if a payment fails or a plan lapses, nothing is deleted. The site goes read-only: your village can still visit and read it all, the export still works, and you can pick it back up whenever you are ready.
What it does not do
A secret link is a secret, not a password. Anyone your family forwards it to can see the registry, which is exactly what makes it usable for a grandparent — and it means you should treat it like the address of a party rather than a bank login.
Guests are identified by a link on a device, not a password. That is why there are no private messages in the village chat.
Questions
Can I rotate the link if it gets out?
Yes — the registry token can be regenerated, which invalidates the old link everywhere.
Do you read what we write?
No. Support access to a family's console exists for the operator, is bound to one registry, expires by itself, and every use is written to an audit log.
Where is the data kept?
On the server running the platform. If you self-host, that is your own machine and nobody else has it at all.
Next
Start your registry in about two minutes
Fourteen days, every feature switched on, no card. Pick a theme, add your due date, share your private link.
🌱 Start my free registry