Plainly
How we keep it safe
You are trusting us with photographs of your children, recordings of your parents’ voices, and the shape of your family. Here is what we do with that, and what we will never do — written so that anyone can check it.
What we do
- Private by default
- Nothing here is public. There is no sign-up page; a stranger with the address sees a sign-in screen and nothing else. Search engines are told to stay away, and do.
- Only people the family has named get in
- A keeper adds someone by their Google address. Sign-in happens through Google, so we never see or hold a password. Remove someone from the list and their access ends at once.
- Each family's archive is sealed from every other
- The separation is enforced inside the database itself, not by the website on top of it. We have tested it by trying to break through — from one family into another, as a stranger, as a guest — and it holds.
- Photographs live in private storage
- Every link to a photograph or recording is temporary and expires within an hour. Nothing is reachable by guessing an address.
- Guests come in through a door you control
- A guest link opens one event only, expires on a date you choose, and can be closed in a second. Guests are never tracked or recorded; they add what they add and leave.
- No face recognition. Ever.
- People are named in photographs by hand. We hold no biometric data of any kind, and we won't.
- Kept in the EU
- The archive and its files are stored in Ireland, under UK and EU data-protection law.
- Yours to take, yours to end
- Any keeper can export the entire archive — every original file, in ordinary formats — at any time. Any keeper can delete the entire archive, completely, and we keep no copy.
What we don’t do
- Show advertising, of any kind.
- Sell, share or rent anything about you or your family to anyone.
- Use your photographs, recordings or words to train any AI.
- Browse your archive. Access by the people who run tokeepsafe is limited to what support needs, and we don't look otherwise.
- Scan faces, or hold biometric data.
- Track guests, or your family, across the web.
- Delete an archive for non-payment. A lapsed archive becomes read-only, not gone.
- Lock your photographs in. Export is always available and always complete.
If something goes wrong
The archive is backed up every day. If we ever became aware of a breach affecting your family, we would tell you directly and promptly, say what happened in plain terms, and say what we did about it. You can reach a person at hello@tokeepsafe.com.
The small print
The formal version of all of this is the privacy notice. It says the same things at greater length.