Your family's memories are safe here

Last updated: July 2026

You are about to put your parents' voices, photographs and stories somewhere. That deserves more than a padlock icon and the word “secure”. Here is exactly what we promise, exactly how it works, and — just as importantly — what we do not claim.

The Family Promise

These memories belong to your family. Not to us. Not to advertisers. Five things we promise, and hold ourselves to:

Your memories are never sold — and never used to train AI models.
Only your circle can ever see them. No public feed, no strangers, no ads.
Nothing is ever deleted unless you delete it.
You can take everything with you, any day.
No family will ever pay to grieve — memorial spaces are never behind a paywall.

— Gopi Vairavanathan, founder · Aadyash Technologies Private Limited

How we keep them safe

Everything is encrypted — on the way, and at rest

Every photo, video and voice note travels over an encrypted connection and is stored encrypted on disk in a private, locked space. Nothing your family shares sits on the open internet, and nothing is discoverable by search engines or strangers.

Links to your memories expire

When the app shows you a photo, it is fetched with a signed link that stops working within the hour. Even if such a link were somehow copied out of the app, it would be a dead end shortly after — there is no permanent public address for your family's media.

One circle can never see another

Every single request is checked against who you are and which circle you belong to. We have deliberately attacked this ourselves — three separate audits specifically hunting for ways one family's data could leak into another's view — and fixed everything we found.

We have no tool for reading your memories

This is the part we care about most. Our internal support console can look after accounts, plans and support tickets — it has no feature that opens your family's photos, voice notes or stories, because we never built one. Every action anyone on our side takes is written to an audit log. Access to that console requires a password and a code from an authenticator app, and sessions expire on their own.

Guests can knock without coming in

When you invite friends and relatives to leave birthday wishes, they get a simple page where they can write a wish — and nothing else. They cannot see your circle, your photos, or anyone else's wishes. An invite link opens exactly one circle and never reaches your other circles.

Sealed means sealed

A time capsule sealed for a wedding day years from now is refused to everyone until its day arrives — the person who wrote it can look back at their own words, and no one else can, not early, not by accident.

It is yours to take or to erase

You can export your family's archive whenever you like, and delete your account — everything with it — from inside the app or from this page. If a paid plan lapses, older memories become quietly hidden rather than destroyed: they are still there, and they come back with you.

The honest part

Hertis is not end-to-end encrypted, and we will not pretend otherwise.

End-to-end encryption means a service can never see your content at all. That is the right design for a messaging pipe — and the wrong one for a home built to do something with your memories: weave the yearly film, read a story aloud, translate between languages, write a family quiz from your own month. Those need the memories to be readable by the service.

So when we say “we don't read your memories”, we mean it as a promise we can be held to — no tooling to do it, audit logs for every action, and a second factor on the door — not as a mathematical impossibility. Any company claiming both full-featured memory-weaving and true zero-knowledge encryption is selling you one of those two things. We would rather be trusted than impressive.

Who else touches your data

Running Hertis means relying on a handful of providers. Each one only receives what it needs, and none of them may use your family's content to train their models:

Amazon Web Services — stores and delivers your photos, videos and voice notes. Media lives in the Mumbai region.
Render — runs the Hertis application and database (Singapore).
Anthropic — text only, to power the Companion, story prompts and gentle insights.
OpenAI — turns voice notes into captions and translations, and powers search.
Google Firebase — verifies your phone number when you sign in.
Expo — delivers push notifications.
Apple, Google and RevenueCat — handle subscriptions. We never see your card details.

Our full legal detail lives in the Privacy Policy and Terms.

For the relative who checks these things

Every family has one person who gets asked “but is it safe?”. This section is for them.

Sign-in: phone number plus a one-time SMS code. No passwords to leak or reuse. Sessions use short-lived tokens; the long-lived refresh token is stored only as a hash on our side, rotates on every use, and can be revoked.
Media pipeline: uploads go directly from the device to private object storage using a permission-checked, time-limited, single-purpose upload URL scoped to that circle's own prefix. Server-side encryption is set on every write. Reads are signed and short-lived. Public access to the bucket is blocked.
Isolation: circle membership is verified per request on every route, including media references — you cannot hand the API someone else's identifier and get an answer.
Paid content: when something is outside a free plan's window, the server withholds the content itself rather than hiding it in the app — locked memories are never sent to a device at all.
Internal access: password + TOTP second factor, expiring sessions, an audit trail on every administrative action, and no endpoint anywhere that returns family content.
Transport: HTTPS everywhere, including the media edge.
If something ever goes wrong: we contain it, work out exactly what was reached, and tell the affected families plainly and quickly — what happened, what it means for them, and what we are doing about it. You should never hear about a Hertis incident from anyone but us.

We have not yet commissioned an independent security review, so you will not find the words “independently security-tested” anywhere on this site. When that is true, it will be said here — and not a day before.

Ask us anything

If there is something here you want explained, or a question this page didn't answer, write to hello@hertis.app. A real person — usually the person who built it — will answer.