Your family's memories are safe here

Last updated: November 2026

You are about to put your parents' voices, photographs and stories somewhere. That deserves more than a padlock icon and the word “secure”. Here is exactly what we promise, exactly how it works, and — just as importantly — what we do not claim.

The Family Promise

These memories belong to your family. Not to us. Not to advertisers. Five things we promise, and hold ourselves to:

Your memories are never sold — and never used to train AI models.
Only your circle can ever see them. No public feed, no strangers, no ads.
Nothing is ever deleted unless you delete it.
You can save your photos and videos any day, and ask us for a copy of everything else.
No family will ever pay to grieve — memorials are never behind a paywall.

— Gopi Vairavanathan, founder · Itechglo Solutions Pty Ltd

Two notes on these promises. On the second: if someone in your circle reports a moment, a chat message or a guest wish to us — in the app, or by writing to us from Talk to us — our team can then see a short preview of it and hide it from the circle (how that works). On the fourth: you can save photos and videos to your phone from the app, and for a full copy of everything else, write to us (more below).

How we keep them safe

Everything is encrypted — on the way, and at rest

Every photo, video and voice note travels over an encrypted connection and is stored encrypted on disk in a private, locked space. Nothing your family shares sits on the open internet, and nothing is discoverable by search engines or strangers.

Links to your memories expire

When the app shows you a photo, it is fetched with a signed link that stops working within two hours. Even if such a link were somehow copied out of the app, it would be a dead end shortly after — there is no permanent public address for your family's media.

One circle can never see another

Every single request is checked against who you are and which circle you belong to. We have deliberately attacked this ourselves — three separate audits specifically hunting for ways one family's data could leak into another's view — and fixed everything we found.

We have no tool for browsing your memories

This is the part we care about most. Our internal support console can look after accounts, plans and support tickets — it has no feature that opens your family's photos, voice notes or stories, because we never built one. It shows two things, narrowly, and only so that we can act when your family asks us to. When someone in your circle writes to us from Talk to us in the app about something that shouldn't be there, then — only while that request is open — we can see a list of what kind each piece in that circle is, when it was shared and by whom, never its words, photos or recordings, so that we can find the one they mean and hide it from the circle. And anything reported to us, or hidden by us, goes to our moderation queue, which shows up to the first 140 characters of its text. For a photo, video or voice note it shows only which kind it is and the start of its caption, never the photo, video or recording itself. Hidden content is kept, not deleted, and can be put back. Every action anyone on our side takes is written to an audit log, and so is every time that list or the moderation queue is opened. Access to that console requires a password and a code from an authenticator app, and sessions expire on their own.

Guests can knock without coming in

When you invite friends and relatives to leave birthday wishes, they get a simple page where they can write a wish — and nothing else. They cannot see your circle, your photos, or anyone else's wishes. An invite link opens exactly one circle and never reaches your other circles.

Sealed means sealed

A time capsule sealed for a wedding day years from now is refused to everyone until its day arrives — the person who wrote it can look back at their own words, and no one else can, not early, not by accident.

It is yours to take or to erase

You can save photos and videos to your phone from inside the app, and, with Hertis Family, save keepsake books as PDFs. For a full copy of anything else, write to us. You can delete your account from inside the app, or from this page. Your details go with it; a circle no one else in your family has joined is erased too, unless it holds a Legacy Guarantee; and circles you share stay for your family. If a paid plan lapses, older memories become quietly hidden rather than destroyed: they are still there, and they come back with you.

The honest part

Hertis is not end-to-end encrypted, and we will not pretend otherwise.

End-to-end encryption means a service can never see your content at all. That is the right design for a messaging pipe — and the wrong one for a home built to do something with your memories: weave the yearly film, read a story aloud, translate between languages, write a family quiz from your own month. Those need the memories to be readable by the service.

So when we say “we don't read your memories”, we mean it as a promise we can be held to — no tooling to browse them, a narrow and logged exception when your family asks us to act on something, audit logs for every action, and a second factor on the door — not as a mathematical impossibility. Any company claiming both full-featured memory-weaving and true zero-knowledge encryption is selling you one of those two things. We would rather be trusted than impressive.

Who else touches your data

Running Hertis means relying on a handful of providers. Each one only receives what it needs, and none of them may use your family's content to train their models:

Amazon Web Services — stores, prepares and delivers your photos, videos and voice notes, and keeps a daily encrypted copy of our database. Both are in the Mumbai region.
Render — runs the Hertis application and database (Singapore).
Anthropic — text only: the Companion, story prompts, sorting stories into chapters, gentle notes to the family about how a parent seems, composing the yearly film, and translation between languages.
OpenAI — turns voice recordings into text, and powers search.
Google Firebase — verifies your phone number when you sign in.
Expo, with Apple and Google — delivers push notifications.
Apple, Google and RevenueCat — handle subscriptions. We never see your card details.
Sentry — receives crash reports from the app: technical details such as the device model, operating system, app version and what the app was doing when it failed. It never receives your photos, videos or voice recordings, and the app never sends it your name, phone number or messages. Held in the EU (Germany).
Zoho — hosts our email, so it holds whatever you write to us (Australia).
Vercel — hosts this website and our internal support console.

The Companion may look up public facts on the web, such as the news, a score or the weather, when a parent asks. The search is run by the AI service we use. The Companion is told to search with the question only, never with your family’s names or private details, and we check every search for the names it knows from your family circle.

Our full legal detail lives in the Privacy Policy and Terms.

For the relative who checks these things

Every family has one person who gets asked “but is it safe?”. This section is for them.

Sign-in: phone number plus a one-time SMS code. No passwords to leak or reuse. Sessions use short-lived tokens; the long-lived refresh token is stored only as a hash on our side, rotates on every use, and can be revoked.
Media pipeline: uploads go directly from the device to private object storage using a permission-checked, time-limited, single-purpose upload URL scoped to that circle's own prefix. Server-side encryption is set on every write. Reads are signed and expire within two hours. Public access to the bucket is blocked.
Isolation: circle membership is verified per request on every route, including media references — you cannot hand the API someone else's identifier and get an answer.
Paid content: when something is outside a free plan's window, the server withholds the content itself rather than hiding it in the app — locked memories are never sent to a device at all.
Internal access: password + TOTP second factor, expiring sessions, an audit trail on every administrative action, and no endpoint that returns family content, with two narrow exceptions, each audit-logged on every read: the moderation queue for reported content, which returns up to 140 characters of a reported item's text (for media, only its kind and caption, never the file); and, only while someone in that circle has an open request with us, a list of what kind each piece is, when and by whom — never its text or media — so that support can find and hide the one the family means.
Transport: HTTPS everywhere, including the media edge.
If something ever goes wrong: we contain it, work out exactly what was reached, and tell the affected families plainly and quickly — what happened, what it means for them, and what we are doing about it. You should never hear about a Hertis incident from anyone but us.

We have not yet commissioned an independent security review, so you will not find the words “independently security-tested” anywhere on this site. When that is true, it will be said here — and not a day before.

Ask us anything

If there is something here you want explained, or a question this page didn't answer, write to hello@hertis.app. A real person — usually the person who built it — will answer.