Privacy policy

Effective 1 November 2026 · Updated 3 November 2026 · Version 2026-11-01 · Website and Android app (au.chapterandkin.app)

Operator: Chapter & Kin — ABN 62 144 654 542. Privacy and customer support: support@chapterandkin.com.au.

Chapter & Kin is an Australian sole trader business (ABN 62 144 654 542) providing a private family memory book and care log for adult parents, caregivers and invited family members. This policy explains how the Chapter & Kin service handles your information. Contact our support team at support@chapterandkin.com.au about privacy, access, correction, deletion or a complaint.

What we collect and why

• Account information: email address, display name, account identifier and authentication information, to sign you in, recover access and manage permissions. Passwords are handled by Supabase Auth; never send a password to support.
• Family content you choose to enter: children's names, birth details, profile pictures, photos, videos, stories, milestones, manually entered family-tree names, short notes and parent/partner connections, growth measurements and care entries, including optional health-related notes. We store these to provide your books, care logs, search and exports. Only enter information you are entitled to provide.
• Sharing and interactions: membership roles, email-bound invitations, legacy invitation records, likes and comments, to support the family access you choose. Reports and account requests include the details you submit so we can respond, protect users and handle deletion.
• Reminders and preferences: browser push subscription details, optional Android push device tokens, schedules, delivery status and notification preferences. The private activity inbox records new photos, likes and comments only for books you can access; its notification records are retained for up to 60 days. Android local reminder schedules and some interface preferences stay on that device. Local reminders use generic wording by default. If you choose to show the activity, its name may appear in the notification and on your lock screen. Notifications require permission; you can cancel them in the app or device settings.
• Technical information: our hosting, authentication and delivery providers process connection information, such as IP address, approximate city/country inferred from the connection, device/browser and request identifiers, timestamps, response timing and diagnostic/security logs. They use this information for operations, security and troubleshooting; this does not mean the app requests your phone's precise location.

Metadata inside files: original-quality photos and videos can retain embedded information such as the camera's location, date and device details. If you do not want to share that information, remove it from the file before selecting the original for upload. The photo editor does not automatically find or cover private body areas; check the finished image before saving or sharing.

Small video previews may be generated on your device and stored with the private video record. They use the same family permissions and deletion lifecycle as the video. Existing videos are not automatically downloaded in bulk to generate previews.

Storage and cost monitoring

Authorised app operators can review family-account storage totals, unfinished upload reservations, file counts and sizes, and limited daily storage history to manage allowances, reliability and service costs. The dashboard uses account references rather than family names or email addresses. Daily snapshots follow a 90-day rolling retention schedule; account-linked history is removed when the account is deleted, while project-wide totals are kept without individual account references. This cost dashboard does not add per-person click or viewing profiles or export family content to website analytics. The provider technical logs described above still apply.

Who can see family information

Owners and co-parents can choose Family or Parents only for each saved photo or video. Existing attachments remain shared with their existing book audience until changed. Parents only limits new attachment metadata, file, poster and photo-comment access to the owner and co-parent; it does not hide the memory’s title or story or family-tree notes. Previously issued file URLs work until expiry, and downloaded or open copies cannot be recalled.

Books are private by default. Owners choose one co-parent account and family viewers through emailed invitations. The same co-parent can be invited to more than one book owned by that owner. Invitees must use the verified email account that was invited and agree to the current terms before private family access is granted. Legacy anonymous guest links no longer open family books. The co-parent can add or change family content and care records. Viewers can see shared photos, stories, milestones and the family tree, and like or comment; structured care logs, growth measurements and birth health details are limited to the owner and their designated co-parent. Family-tree notes are shared with everyone invited to that book, so avoid entering private contact or health details there.

Owners can remove members or revoke pending invitations. Restricting downloads does not prevent screenshots or recall copies someone has already saved. Previously issued media links can remain usable until they expire.

Upload allowances

We keep an owner-scoped record of accepted photo upload paths and timestamps to enforce lifetime Free limits. Deleting a photo or book does not reset this count; these records remain until account deletion. Existing stored uploads seed the count when these rules are introduced; previously purged files cannot be reconstructed. File contents are not duplicated into this ledger.

무료 업로드 한도를 적용하기 위해 소유자별 사진 업로드 경로와 시간을 기록합니다. 사진이나 앨범을 삭제해도 횟수는 초기화되지 않으며 계정 삭제 시 함께 지워집니다. 도입 시 현재 저장된 사진으로 횟수를 계산하고 이미 완전히 삭제된 파일은 복원해 계산할 수 없습니다.

Security and temporary media links

Private media uses HTTPS/TLS in transit and provider-managed encryption at rest. The service is not end-to-end encrypted. Authorised operators can access private content when necessary for service operation, support, safety or legal obligations. A valid signed media URL can be opened by anyone holding it until it expires, without another sign-in. Viewing and download URLs can have different lifetimes; removing membership does not instantly revoke one already issued. We have not completed an independent external penetration test. Internal automated checks do not replace that independent assessment.

Service providers and location

We use Supabase for authentication, database, private file storage and server functions, and Vercel for the website and hosting. The current Supabase project is in the Sydney region, Australia. These providers and their subprocessors may process technical, support or operational information in other countries; this is not a promise that every copy stays in Australia.

Offsite recovery backups: we use a private Backblaze B2 bucket in the US East region and temporary GitHub Actions hosted runners to copy and verify recovery backups. A runner may process unencrypted source data outside Australia during a job. Backup data is encrypted with AES-256-GCM before upload to B2; the bucket also has provider-side encryption. Restricted read-only source credentials and the backup encryption key are supplied through GitHub encrypted secrets to the backup job, not the app, job logs or downloadable job artifacts. The initial encrypted B2 backup and an isolated database/media recovery rehearsal succeeded on 2 November 2026. Daily backup jobs and a backup-age watchdog are enabled. Jobs can be delayed or fail because of provider, capacity or spending limits; unchanged files are not fully downloaded and restored every day. Hosted account sign-in restoration and an independent security assessment have not been completed.

Browser notifications pass through the browser/device provider's push service. When enabled in a supported Android version, family activity alerts use Google Firebase Cloud Messaging, which processes device registration tokens, Firebase installation IDs and technical app/device information such as app version and the Firebase user agent for delivery and service operation. Family push messages use generic text and opaque identifiers by default. If you enable Show commenter names in phone alerts, the commenter’s chosen display name and a grouped author count can be sent to your notification provider and shown on your lock screen. Email addresses, child names, photos, comment text and care records are not included. You can turn this name setting off without turning off family alerts. Family activity alerts are optional and can be turned off separately from routine reminders. Turning alerts off requests messaging-token unregistration; it does not by itself delete the Firebase installation ID. Under Google’s published retention policy, installation IDs remain until an explicit ID-deletion request, after which removal from live and backup systems can take up to 180 days. Email providers process account messages and any email you send support. We do not sell your personal information or use family content for advertising. Authorised operators may access information when necessary to operate the service, respond to support or safety reports, or meet legal obligations. We may disclose information where legally required or necessary to address abuse or protect safety.

Website visit statistics and device storage

The website uses Vercel Analytics for aggregate page views and broad device/country statistics. App code strips query strings, invitation tokens and content identifiers from analytics page addresses. Names, email addresses, photos, comments and care records are not supplied as analytics events. This setup does not use analytics cookies or session recordings, and the packaged Android app does not load that website analytics integration.

Use Visit statistics privacy in the website footer to opt out on that browser. We also respect Do Not Track and Global Privacy Control. Essential local storage maintains your session, preferences and notification setup; these are separate from optional statistics.

Retention, deletion and backups

We keep account and family information, including family-tree records, while it is needed to provide your account and books. Removing a person from a tree removes that card and its connections from the live tree; it does not delete an app account, photos or stories. Moving a memory to Recently Deleted keeps the memory and its files until it is restored or permanently deleted. Editing a saved photo preserves the previous version in Recently Deleted. Upload reservations can expire independently of saved content.

You can request deletion of your account and associated personal data using the account deletion page. We verify the request and resolve ownership of shared books before removing data. We aim to complete verified requests within 30 days and explain any necessary delay. Limited information may need to be retained for a legal obligation, security investigation or to record the handling of your request; we will explain the reason and applicable period.

Deleted records can remain in restricted operational backups until those copies expire. Supabase's current Pro daily database backup window is seven days. Database backups do not contain the actual photo/video files. Separate offsite copies include media and target a 30-day retention period. Automatic offsite pruning is not yet enabled, and an outage or failed replacement backup can require keeping the last verified recovery copy longer. Existing restricted PC copies and the fixed OneDrive recovery archive are not automatically deleted by setting up B2. Before a restored service is made available, recorded deletions and current access restrictions must be reapplied. Backup availability and recovery are not guaranteed. Keep your originals and use More → Back up this book for a separate private download. Copies you or other recipients have downloaded are outside our control.

Your choices and questions

You can edit information in the app, manage family access, download a book backup, disable notifications, or contact support for access, correction and deletion. Please contact us if you believe information about you or your child was shared without authority. We may ask for proportionate evidence of identity or parental authority; do not send identity documents unless we explain why and provide an appropriate method. If a privacy complaint is not resolved, you may contact the privacy regulator in your jurisdiction, including the Australian Information Commissioner where applicable.

Children and changes to this policy

The app is intended for adults to keep family records, not for children to create their own accounts. Adults must have appropriate authority to upload or share a child's information. We will update this page when our practices change and provide an in-app notice for material changes where appropriate.