Separate memory features from photo custody
A family journal may combine written memories, developmental observations, photos, books and provider sharing. Those features do not all require the same storage model.
Photos can be encrypted on the device and copied as ciphertext to a user-owned cloud account. The journal service can store permissions and opaque references without receiving readable photo bytes.
Practical checklist
- Encrypt photo bytes and metadata before cloud upload.
- Use random identifiers instead of original filenames.
- Request only narrow, app-created cloud-file permissions.
- Keep the vault passphrase away from the journal server.
Make recovery a permanent user right
Encryption without recovery planning can permanently lock a family out of its memories. The product should offer an encrypted recovery bundle, key-envelope backup and a documented restore test.
Decryption, local recovery and complete export should not disappear when a paid plan ends. Subscriptions can support automation and convenience without holding access to family data hostage.
Practical checklist
- Back up the wrapped key separately from encrypted media.
- Test restoration on another device.
- Explain what happens when a cloud connection is removed.
- Provide portable exports in documented formats.
Limit family and provider sharing deliberately
Family roles should control who can read, contribute, administer and export. Provider sharing should include only selected items and use a separate encrypted package rather than granting access to the full journal.
Revocation has limits: removing a cloud permission cannot erase a copy already downloaded with its share code. The interface should state those limits clearly.
Practical checklist
- Use revocable sessions and visible permission history.
- Share selected files, not the entire vault.
- Deliver share codes through a separate channel.
- Avoid unsupported claims of healthcare certification.
Common questions
Who should control the encryption passphrase?
The family or user. A privacy-first design does not send the vault passphrase to the application server or cloud provider.
Is user-owned cloud storage automatically private?
No. The app should encrypt before upload, use narrow permissions and verify ciphertext integrity during backup and restore.
Can revoked access erase downloaded files?
No. Revocation can prevent later cloud access, but it cannot erase an independently downloaded copy.