Your Family Data, Under Your Control
You're trusting FamRoot with relationships, phone numbers, photos and personal messages. Here's exactly how we handle them, including the things we haven't done yet.
Delivered only to the people you choose.
Six facts worth knowing
No badges, no superlatives. Just what we actually do today.
Stored in India
FamRoot runs on Amazon Web Services (AWS) in the Mumbai region. Your data is stored on servers in India.
HTTPS in transit
All data travelling between your device and FamRoot is sent over HTTPS.
Encrypted at rest
Most sensitive data is encrypted at rest. Notes and last messages are encrypted with AES-256.
Masked logs
Sensitive data that passes through our application logs is masked, so it isn't written out in plain form.
Call logs stay on your phone
Smart Caller ID sends only phone numbers to our server. Your call logs never leave your device.
Not for sale
We use your details to run FamRoot. Your family data is not sold.
Private by design, not by setting.
- No public tree. Your family tree has no public link. It's visible to relatives connected to you within seven relationship levels.
- Friends see your profile only. Not your family tree.
- Nobody owns the tree alone. Every member of the tree is a moderator. Existing members approve who joins next, so the tree stays in the family's hands, not one person's.
- Changes need a second person. In a tree with more than one user, editing or removing a relationship needs approval from at least one other user.
- Vault messages are shared one by one. Last messages and future messages go only to the people you choose.
Added by a relative?
Relatives can add you to their tree before you join. If you find your details on FamRoot and you're not a user, email support@famroot.com or grievances@famroot.com.
We verify the request using your mobile number, remove your details, and make sure they aren't added again.
The most personal things get the most protection.
- AES-256 encryption for notes and last messages.
- A separate Vault password, on top of your login, as an extra layer of protection.
- Verified delivery. Last messages are released only after a death report is acknowledged by two people in your first circle.
- Your choice of recipients for every message.
"Look after each other…"
"On your wedding day…"
Can FamRoot staff see my content?
Honest answer: technically, it's possible. By process and policy, FamRoot staff do not view your Vault content, except where the law requires it.
We won't tell you access is impossible when it isn't. Access to user data is restricted by process and policy.
No certifications or audits, so far
FamRoot has not completed any security certifications or external security audits so far. When that changes, we'll say so here.
Backups: full backups are taken daily, encrypted before they leave the server, and stored off-site, separate from the main servers.
No system is perfectly secure, and we won't claim otherwise.
What happens when a relative calls
Smart Caller ID (Android only) needs to know who's calling. Here's what it uses, and what it doesn't.
Sent to our server
The caller's phone number, so we can look up whether they're in your family network and how you're related.
Never leaves your phone
Your call log. Call logs are not stored on our server.
Android permissions it asks for: access to your call log, permission to make and manage phone calls, and permission to display over other apps (so the caller card can appear on the incoming call screen).
Who helps us run FamRoot
These companies process some data on our behalf, only for the job listed.
| Provider | What they do for FamRoot |
|---|---|
| Amazon Web Services (AWS) | Cloud hosting and storage, Mumbai region (India) |
| MSG91 and Twilio | SMS and one-time passwords (OTP) |
| Zoho Mail | |
| Cloudflare Web Analytics | Cookieless website analytics on famroot.com |
| FormSubmit | Delivering website form submissions, such as sign-ups |
| Apple and Google | Push notifications to your device |
More detail in our Privacy Policy and Cookies page.
Keeping your account yours
You log in with your mobile number. Your first sign-in uses a one-time password sent by SMS, after which you set your own password. The Vault has a separate password.
If you think someone else has accessed your account, email support@famroot.com straight away.
Delete your account any time
Delete from Settings, confirmed with an OTP. Your account is inaccessible immediately and your personal data is removed from our servers within 90 days.
Found a security issue?
Please tell us privately at support@famroot.com so we can fix it. Don't access other people's data or disrupt the service while testing.
Vivekananthan
Email grievances@famroot.com. Grievances are acknowledged within 24 hours and resolved within 7 days.
Common questions
Where is my FamRoot data stored?
On AWS servers in India, in the Mumbai region.
Can people outside my family see my family tree?
No. There is no public link to your tree. Friends in your network see your profile, not your tree.
Is my Vault encrypted?
Notes and last messages are encrypted with AES-256, most other sensitive data is encrypted at rest, and the Vault has its own password.
Can FamRoot staff read my last messages?
Technically it's possible. By process and policy, FamRoot staff do not view this content, except where the law requires it.
Is FamRoot certified for security or privacy?
No, not yet. We haven't completed any certifications or external audits so far.
Does Smart Caller ID read my call history?
Your call logs never leave your device and aren't stored on our server. Only phone numbers are sent, to look up the relationship.
More in the FAQ and Help & Learn.