Pinkas

Trust

Privacy & Family Permissions

Share one part of the family without opening everything else. You choose the branches a relative can see and the material shared within them.

A branch invitation only opens the part of the family you chose to share. A guest link only opens its named task.

Shared with this relative

Father’s branch

Yosef
Rivka

Not shared

Mother’s branch

Branch access is only one part of sharing. Photos, recordings, and other items have their own audiences. A family connection does not automatically share the material.Fictional family example

Family roles, branch access, and export authority

  • Account owner — manages the family archive, billing, administrators, and deletion.
  • Family administrator — manages members and family settings without owning the archive.
  • Editor — reviews and changes family records.
  • Contributor — adds material for family review.
  • Viewer — reads the family material shared with them.
  • Branch viewer, branch contributor, and branch steward — apply only inside a separately shared branch.
  • Data trustee — a separately granted capability required for a complete archive export.

One archive, overlapping private branches

A branch starts with particular people and relationships, not a surname. A relative can see only the branches explicitly shared with them, including any overlap.

At the edge of a shared branch, a person may appear with just enough information to explain a connection. Their unrelated relatives, full profile, photos, and stories stay hidden. Each item has its own audience: seeing a person never automatically opens everything attached to them.

Living and deceased people

A person profile is never public merely because the person is deceased. Marking someone deceased enables memorial and calendar behavior; it does not waive family privacy. A living person's dates, portrait, and stories deserve particular care and can be marked private.

A private person stays off shared tree and derived calendar surfaces.

Photos and recordings

Choose visibility when adding photos and other media. Family members should upload only what they have permission to share, especially images of children, medical details, and interview recordings.

Original media is stored privately. Authorized downloads use short-lived links rather than permanent public file addresses.

Before sending an invitation, review the people, limited connection profiles, and material it includes. The invitation is tied to that recipient, branch version, and role. It expires and can be withdrawn. Guest links and family access codes open less, but still need to be treated like keys.

Exports leave the permission boundary

An ordinary export includes only what the person requesting it is allowed to see. A complete archive export requires separately granted Data Trustee access and uses expiring download links. Once you share a ZIP outside Pinkas, that copy is no longer protected by Pinkas permissions.