How Chronickel protects your family's information

How does Chronickel protect sensitive documents?

The Vault (Family and Legacy plans) provides encrypted storage for sensitive personal documents. Its encryption key is derived from a separate vault passphrase you set — not your account sign-in password — so unlocking the Vault is a deliberate, additional step.

What confirmed controls does Chronickel have?

• Role-based access control. Every family space enforces roles (Owner, Editor, Viewer, Friend) on the server, on every request — not just hidden in the interface.
• An audit log. Invitations, revocations, visibility changes, plan changes, billing changes, and photo uploads/removals are all recorded.
• Signed, short-lived media delivery. Photos and Vault documents are never served from public links — every request is authorized first, then redirected to a short-lived signed URL.
• Server-side membership checks. Every request that touches a family space's data validates the requester's membership against the database before running.

What infrastructure and vendors do we rely on?

Chronickel is built on established providers rather than self-hosted infrastructure. We don't hand your data to anyone beyond what's needed to run the service:

• Vercel — application hosting, deployment, and the edge network that serves this site.
• Neon — our production Postgres database.
• Cloudflare R2 — encrypted object storage for photos, documents, and Vault files.
• Stripe — payment processing for paid plans; we never see or store your card details ourselves.
• Resend — delivery of transactional email (invitations, password resets, notifications).
• OpenAI — automated moderation of uploaded text and images via its Moderation API.

See our Privacy Policy for how each of these providers is used, and our Terms of Service for the terms that govern our reliance on them.