Last updated: October 27, 2026
How we protect your data
FamiliaLista stores sensitive information — your phone, your family's phones and emails, what you write in your manual, the personal messages you leave. Here's exactly how we look after it.
What you write is encrypted
When you create your account, we generate a unique 256-bit encryption key just for you. That key is itself stored encrypted under a master key we can rotate, and it never leaves our servers.
Your manual, the personal messages you write for each person and your Tribal & Trust Land notes are encrypted with your own key (AES-256-GCM) before they are saved. Your loved ones' phone numbers and emails, your account details and the documents you upload live in our private database and storage, encrypted at rest (AES-256) by our database provider; only you, and later the people you chose, can open your documents.
If someone ever got into the database (it hasn't happened, but real security plans for it), your manual and your messages would read as meaningless noise. Without our keys, they cannot be read.
The companies we work with
To run FamiliaLista we rely on a few technology companies. Each does one specific job, and each is independently audited. Every link below goes to that company's own page about how it encrypts and protects data.
Supabase
Stores your information (database, accounts and uploaded files)
Encryption at rest (AES-256) and in transit (TLS). SOC 2 Type 2 audited and HIPAA compliant. Our database is in the United States (Ohio).
Stripe
Processes card payments on the website
We never see or store your card number — Stripe handles it directly and encrypts card numbers with AES-256. PCI Service Provider Level 1, the highest level in the payments industry. Purchases inside the iPhone and Android apps are handled by Apple and Google.
Twilio
Sends our text messages and WhatsApp messages
Carries check-ins, reminders and delivery notices by text (US numbers) and by WhatsApp. Data is encrypted in transit (TLS) and at rest. SOC 2 Type 2 audited and ISO/IEC 27001 certified. Our texting is registered with US carriers (A2P 10DLC).
Resend
Sends our emails
Sends your check-ins, reminders and your family's delivery emails. Data encrypted at rest and in transit (TLS). SOC 2 Type II audited. Your email is never sold or added to marketing lists.
Vercel
Runs the website and the app
Serves familialista.com and app.familialista.com. Data encrypted at rest (AES-256) and every connection uses TLS 1.3. SOC 2 Type 2 audited and ISO 27001 certified.
What we DON'T do
- We don't sell your data to anyone. Not to advertisers, brokers or insurers.
- We don't use your manual to train artificial intelligence.
- We don't share your information with your family until your plan is delivered — and then only with the people you chose.
- We don't read your manual. It is encrypted and only decrypted to deliver it.
- We don't give partners or advertisers in the app your name, your contact details or anything you wrote. They only see how many times their page was opened.
More questions?
If you have a specific question about how we handle your data, write to us. We respond in less than 24 hours.
This page is updated whenever something changes in how we handle your data. Last updated: October 27, 2026.