Encrypted on your device
Personal details are encrypted before they leave your phone or computer, using modern authenticated encryption (XChaCha20-Poly1305). Our servers only ever see scrambled ciphertext.
Coming soon
Privacy first, privacy always
A family tree is full of people who never signed up for it: grandparents, cousins, children. Amora Tree is designed so their personal details stay private, even from us.
Our promise
Even Amora Tree can’t read your relatives’ personal details
Phone numbers, email addresses, home addresses and any field you mark Personal are end-to-end encrypted on your own devices. We only ever store data we can’t read.
No master key, no back door
There’s no master key, no key escrow and no support override. Your keys live only on your devices and in a recovery key that you hold.
Sign-in is separate from encryption
Knowing your password doesn’t unlock personal details, and forgetting it doesn’t lose them. Your encryption keys are never derived from anything we see.
Who sees what
You decide, field by field
One clear table in Settings controls what each audience can see. Personal details follow a hard rule, not a setting.
| Who | Everyday details (names, dates, places, photos, notes) | Personal details (phone, email, address, anything marked Personal) |
|---|---|---|
| You, co-owners and super admins | Yes, everything, clearly labelled | Yes, in our signed apps on your own devices |
| Family members you invite | What you allow, for their own branch | Never |
| Other trees, starter copies and exports for someone else | What you choose to share | Never |
| AI assistants | What you allow | Never |
| Amora Tree, our staff and our hosting providers | Stored securely to run the service | Never: we only hold encrypted data we can’t read |
Anything a contributor adds to your tree is yours to see. Anything someone builds in their own account stays theirs unless they choose to share it, and their personal details never transfer.
Under the hood
How the encryption works
One key per tree, sealed to each device
Each tree has its own random 256-bit key. It’s sealed separately to every device you approve, and each device’s private key stays in its secure hardware: the iOS Keychain, Android Keystore, macOS Keychain or Windows secure storage.
Adding a device or a co-owner
You approve a new device from one you already trust, by scanning a code. When you add a co-owner, you compare a short safety code with them, so nobody, including us, can slip in a key of their own.
Removing someone
Remove a person or a lost phone and your device creates a fresh key, re-encrypts every personal detail, and shares the new key only with the devices that remain.
Living relatives and children protected
In anything you share beyond your tree, living people and children show only their name, family links and birth year by default: no exact dates, notes or photos.
Your recovery key
You hold the key. Literally.
When you set up Amora Tree, your device creates a recovery key and shows it once. Save it in a password manager or print it, and we’ll remind you now and then to check you still have it.
If you ever lose every device, your recovery key or a co-owner’s device brings your personal details back. Because we hold no keys, we can’t recover them for you. We think that’s the honest price of real privacy, and we’ll always say so plainly. The rest of your tree is stored normally and stays safe either way.
Honest about the limits
What we can and can’t see
- We can’t see personal details. We can see that a field exists and when it changed, and we pad values so their length reveals little.
- Everyday details such as names, dates and photos are stored securely on our servers so the tree works across devices and with family.
- If we’re ever legally required to hand over data, personal details can only be handed over in encrypted form.
- The web app never decrypts personal details, because code served to a browser could be changed. They open only in our signed apps.
Security and compliance
Built to be trusted
Signed, verifiable apps
Every app is code-signed, loads no remote code, and keeps its encryption in a small, isolated module published with test vectors.
Independent audit planned
An independent security audit and penetration test are planned before launch.
GDPR-ready
Designed for UK GDPR, EU GDPR and US state privacy laws: clear consent, access to your data, correction, export and real deletion.
Your data, always
Export your whole tree as GEDCOM or a full backup on every plan. Delete your account and your data is deleted too.
Respect for everyone in the tree
Relatives can ask to be removed or corrected, and family members who leave take their own photos and notes with them.
Secure sign-in
Passkeys and two-step verification protect every account, with owners required to use two-step sign-in.
Coming soon
Privacy first, privacy always
Join the waitlist to be among the first families to try Amora Tree.
We’ll only email you about Amora Tree’s launch. One click to unsubscribe. We never share your address.