Privacy and security
How Tunnda protects your family's memory, and what we rule out ever doing with it.
An app that keeps a family's memory handles sensitive information: dates of death, addresses, photographs of children, the voices of people who have died. We would rather describe precisely what is protected, and how, than wave reassuring words around.
Your data lives on your phone
Tunnda stores everything in a local database. The app is usable end to end with no connection at all: adding a person, writing a story, recording a voice, searching, exporting.
What is backed up on our infrastructure
So that you can find your vault again, your account and your content are backed up on our infrastructure, hosted by our provider Appwrite. Exchanges with that service are encrypted in transit (HTTPS).
- Your account: email address, name, password
- The person profiles, the kinship ties, the stories
- The photos and audio recordings you add
What never leaves the device
Some data stays strictly local, by design.
- Your fingerprint and your face: the phone verifies them, the app never sees them
- Your lock PIN code, kept in the system's secure store
- Technical error logs, capped in number, never transmitted, and switchable off
No audience measurement, no advertising
The app ships with no behavioural tracking or audience measurement tool. We do not know which screens you open, or how long you spend on them. We show no advertising and we hand your data to no one.
People who are not users
A family profile often describes someone who has never installed Tunnda, and sometimes someone who has died. That information is entered by your family, under its own responsibility. Anyone concerned can write to us to request the deletion of the data about them, and we will pass the request on to the family vault in question.
Our commitments
Four principles we hold to, and on which you can judge us.
Your data is never pooled with that of another family, never added to a collective database, never offered to a stranger.
We do not sell, rent or transfer your data to anyone, and we display no advertising.
You can export your entire vault in GEDCOM format at any time, and leave without losing anything.
You can request the deletion of your account and your data, and we carry it out within thirty days.