Privacy

What we hold

Your name, email address and profile picture from Google. The people you add to your household and what you record about them: dates of birth, blood group, allergies, conditions, medicines, doctor visits, the documents you scan, and the messages your family writes in a journal thread. This is health data about named people, which is why the rest of this page exists.

How it is stored

Every field that says something about a person is encrypted with AES-256-GCM before it is written, and document files are encrypted the same way before they leave the server. Each file gets its own key, that key is wrapped with a key belonging to your household, and that one is derived from a master key held outside the database. The ciphertext is bound to the record it belongs to, so a blob cannot be moved from one person's file to another's. Search works on keyed hashes: what you type is hashed before the query reaches the database, so the database never sees the words.

This is not end-to-end encryption, and we will not pretend otherwise. The running server can decrypt your records, because it has to in order to read a prescription or write the summary of an episode. What limits that is the audit log: every read and every change is recorded with who did it and when, and the household owner can see it.

Who sees it

The people you invite to your household, and nobody else's household can see yours. We do not sell anything, we do not advertise, and we do not share your records with anyone except the processors below.

• MongoDB Atlas — the database, on a cluster used by this app alone.
• Cloudflare R2 — document files, as ciphertext. Cloudflare cannot read them.
• Vercel — runs the app and serves it to your browser.
• Google — sign-in only. We get your email, name and picture.
• Anthropic — reads a document you ask it to parse, or an episode you ask it to look over. Sent only when you press the button, and under Anthropic's API terms, which do not allow training on it.

Analytics

We count page views with Umami, which we run ourselves on our own server. It records the page path, a rough country, and the kind of browser. No cookies, no cross-site tracking, no advertising network, and nothing that identifies you. No path in this app carries a person's name, so there is nothing medical in what it sees.

Email

Signing in accepts occasional product email from us. Turn it off on the Settings screen and it stays off — signing in again does not switch it back on. Mail about your own account, like an invite you were sent, is not something you can opt out of.

How long

Until you delete it. Deleting a document deletes the ciphertext and its key. The audit log is append-only and is kept while the household exists, because a log you can edit is not a log. Ask us and we will delete the whole household, the log included.

Your rights

Ask for a copy of what we hold, a correction, or deletion, at support@greyfeathers.io. We answer within 30 days. Greyfeathers is the data controller.