Private by architecture, not by promise

Why architecture beats promises

A privacy policy is a promise. It can be rewritten, sold with the company, or bent by a business model that needs your data to make money. FamiliaSync takes a different approach: we designed the app so that collecting your family's data isn't just against policy - it isn't possible.

That distinction matters more than it sounds. Policies govern what a company chooses to do with the data it holds. Architecture governs what data exists in the first place. One is a decision that can be revisited every quarter; the other is a fact.

Three pillars

1. 1Local-first storage: calendars, budgets, lists, documents, and everything else live in a local database on your devices. There is no FamiliaSync cloud account and no copy on our servers.
2. 2Real encryption: data at rest is protected with AES-256-GCM, and the secrets that unlock it stay in the iOS Keychain and Android Keystore, behind your PIN and biometrics.
3. 3Manual sync: when you want a second family device to see the same data, you initiate an encrypted, device-to-device transfer. No server relays it, and nothing syncs silently in the background.

Even the AI assistant respects this boundary. FamiliaSync's assistant runs entirely on-device, so your questions and your family's data are never sent to a model hosted in the cloud.

What the encryption actually does

AES-256-GCM is the same authenticated encryption that secures TLS connections and modern password managers. The 'authenticated' part matters: it detects tampering, not just eavesdropping, so modified or corrupted data is rejected instead of silently loaded. The keys that unlock your data are generated on your device and stored in the iOS Keychain or Android Keystore - hardware-backed vaults the operating system guards with your PIN and biometrics.

That means someone who copies the database file off your device gets ciphertext, and someone who steals an unlocked device still hits the biometric gate. The key material never leaves the secure enclave, and the app can demand its own unlock independent of the phone's lock screen. This is encryption doing real work - not a badge on a landing page.

The threat model we're actually defending against

When we say "private", we mean something specific. Four things can't happen to data we don't hold: it can't be breached from us, it can't be sold by us, it can't be compelled from us, and it can't be quietly repurposed when a business model changes.

Most family apps hold everything: your kids' names, your address, your daily routines, your spending. That data sits in a database that employees can query, that a breach can expose, and that an acquirer inherits along with the brand. A privacy policy is a promise about how that database is used - it is not a limit on what it contains.

• Your family's calendar, locations, and routines
• Budgets, income, and spending history
• Grocery lists, meal plans, and household notes
• The questions you ask the assistant

None of that exists on our infrastructure, because we don't have the infrastructure for it to exist on. That's the whole trick - and it's why the guarantee doesn't depend on trusting us.

How sync works without a server

Sync without a cloud sounds like a contradiction, so it's worth explaining how it actually works. When you add a family device, FamiliaSync opens a direct, encrypted channel between the two devices - the same way you'd hand someone a printed page instead of mailing a copy to a warehouse first.

You initiate the transfer. Both devices confirm it. The data moves device-to-device, end to end, with no relay in between to compromise and no account to hijack. Because nothing syncs silently, you always know exactly which devices hold your family's data - and removing a device is a decision you make, not a setting a server forgot to honor.

What we never collect

The clearest way to see the architecture is to list what doesn't exist on our side:

• No FamiliaSync accounts, passwords, or cloud profiles
• No analytics or telemetry inside the app
• No advertising identifiers or third-party trackers
• No server-side copy of your family's data - not even encrypted

The only personal data this company holds is the email address you give the waitlist on this website - and even this site runs no analytics, so we couldn't tell you how many people read this post. When the product itself can't see you, marketing honesty gets a lot easier.

Why most apps can't make this promise

Most family organizers couldn't adopt this model even if they wanted to. Their business is built on the data: analytics that justify ad revenue, engagement metrics that justify funding rounds, cloud features that justify subscriptions. Take the data away and you take the business away.

FamiliaSync's model is simpler: a paid app, no ads, no data to monetize. Privacy isn't a feature we bolted on - it's a side effect of not needing your data in the first place. That's also why 'private by architecture' is a claim competitors can't copy with a settings toggle or a marketing page. It has to be true of the database schema.

And it's why the guarantee survives failure. If our servers were breached tomorrow, attackers would find no user database - we never built one. If a court compelled us to hand over your family's data, there would be nothing to hand over. If the company were acquired, an acquirer would inherit a product with no data to sell.

The honest trade-offs

Honest privacy also means honest trade-offs. Building without a cloud costs us things competitors get for free, and it's fair to name them.

• Sync is manual. You choose when devices exchange data - an extra step cloud apps don't have.
• There's no web app. Your data lives on your devices, so you can't sign in from a browser. There's no account to sign into.
• Recovery is your devices. If every device is lost at once, there's no cloud backup to restore from - because there's no cloud.

We think those are good trades for a family organizer. They're also the kind of trade you only get to make when privacy is designed in from the first commit - not bolted on after the database already holds everyone's data.

None of this requires you to be a security expert, because the defaults do the work. Install the app and your family's data is local and encrypted before you've added the first calendar event. Privacy by architecture means the safest configuration is the only configuration - there's no settings page where you could accidentally opt back into the cloud.

If you're evaluating family organizers, ask each one a simple question: where does my data actually live? If the answer is a company's servers, the privacy policy is all that stands between your family's routines and whoever owns that company next year. We'd rather give you an answer that can't change: nowhere but your own devices.

“The safest data breach is the one where the data was never collected.”