Family Data Privacy: Who Can Actually See Your Family Tree

A family tree is not ordinary data. It holds a mother's full name, dates of birth, places of birth and family relationships — the same combination banks and government offices use to verify your identity over the phone.

That is why "who can see it?" has to have a precise answer, not a comfortable one.

Every query is limited to your family

That restriction is not placed on the screen alone. It sits at the data layer: every query that touches family information — members, gallery, documents, stories, events, chat, QR codes, grave records, the welfare fund — is filtered to the user's own family before anything is displayed.

The difference matters. An interface that merely hides a button can still be bypassed by anyone who changes one number in the browser's address bar. A filter at the data layer cannot.

Privacy levels are set by the family

The head of the family sets the level for each section separately — profile, family tree, gallery, documents and chat. The default is Family Members Only. A family that wants to share a branch with distant relatives can open it up; a family that does not need do nothing at all.

Confidential documents are tighter than the rest

A document marked confidential can be opened only by the members it concerns and the head of the family, and every download is recorded. Certificates, land titles and estate documents fall into this category by default.

Chat is tighter still

Being in the same family does not grant the right to read a conversation. Only the participants in a conversation can read it — a stricter condition than sharing a family, and deliberately so.

When support staff open your family

Platform staff can open a family they are not members of, because investigating a complaint without access means asking for the family head's password — and that is worse.

But every such entry is written to the audit log as its own record. The power to open someone else's door must leave a trace that can be inspected.

The audit log cannot be edited

Audit records are append-only. There is no path to edit them and no path to delete them — including for administrators. A log that can be tidied by the person being examined is not a log.

Personal Data Protection Act 2010

This system complies with the PDPA 2010. You have the right to access, correct and restrict the processing of your personal data, and the right to export the whole family record at any time in a format other systems can read.