Your organizer administers the group: invites, approvals, removals. We operate the service underneath.

Accounts belong to adults. Children's details are content that parents choose to enter, end-to-end encrypted, never child accounts. Nothing about a child is readable by us.

What do you actually hold about me?

A short list: your display name, email address, password hash, sessions, group membership and role, and for organizers, billing status. Card numbers are handled by our payment provider and never reach us. Everything personal beyond that list is ciphertext.

Do I have to share my details?

No. Every contact field is opt-in, each with its own sharing setting. The default is sharing nothing beyond your name.

Do you show ads or sell data?

Never. No ad networks, no trackers, no analytics beacons, no data sales, no profiling. The organizer's subscription pays for the service.

What happens when I leave?

Your encryption access and sessions are revoked immediately. Your data enters a short grace period in case the removal was a mistake, then is permanently deleted. Deleted data may persist briefly in backups before those rotate out.

Can I take my photos and videos with me?

Yes. Downloads decrypt on your device at full quality, a single shot or a whole album at once.

Access, correction, deletion, and complaint, honored under GDPR and applicable law. For group content, requests go through your organizer or to us directly.

How it works

Security and privacy

Updated 2026-07-31

The server can store your group's life. It can never read it. Here is exactly how that works, and exactly what it does and does not cover.

The promise

Most apps encrypt data on the way to their servers and on their disks. That is good, and it is standard. But the company still holds the keys, so the company can still read everything. Group Space is built so that we cannot.

Your group's personal content is encrypted on your device before it is sent. The server stores ciphertext it cannot decrypt, and neither can we.
Encryption is on by default and included on every plan. Privacy is never an upgrade.
Safety tools (report, block, content locking) are included on every plan too.
No ads, no trackers, no profiling, and no selling data. The organizer's subscription is the entire business model.

What that protects you from is the thing that actually happens to family data: a breach, a stolen backup, or someone with access to the servers deciding to look. All any of them can get is ciphertext.

What is encrypted, and what is not

A few practical things stay readable so the app can sign you in and send invites. Both sides are listed in full, so you never have to guess what "private" means here.

End-to-end encrypted

Discussion titles and post bodies
Contact phone numbers and addresses
Children's names and grades
Photos and videos, both the full media and the thumbnails
Album names and descriptions
Every event detail: title, description, location, times, RSVP deadline, capacity, and each member's RSVP answer
Chip In details: name, amount, and payment information
Push notifications, which are decrypted on your device rather than on the server

Readable, so the app works

Display names
Email addresses, for sign-in and invites
The fact that someone responded to an event, never their answer
Your group's name and branding
Each field's sharing setting, meaning the setting itself and not the value
Timestamps on records

Even event times are encrypted. Your device sorts the calendar after decrypting, so the server cannot see when your group meets. That right-hand column is the whole list. If it is not there, it is encrypted.

Your group has one key, and we never have it

The group key is created on your device, not our servers. When a group is set up, its key is generated right in the organizer's browser or app. It encrypts everything the group shares, and it never travels anywhere unlocked.
Every member has a personal lock, opened by their password. Each member gets their own key pair. The private half is sealed using their password, and the password itself never leaves their device.
Joining a group is like being handed a key in person. When an organizer approves you, the group key is sealed to your personal lock. Only your device can open it. The server just passes the sealed package along.
Every photo and video gets its own key. Each file is encrypted with a unique key before it is uploaded, so the server stores media it cannot open.
The emergency backup belongs to your organizer, not to us. At setup the group key is also wrapped under a one-time recovery code, shown once to the founding organizer. That code is the group's safety net. We do not have one of our own.
When someone leaves, their access ends. Removing a member revokes their key access and signs them out everywhere.

"How do I know you do not keep a copy of the key?"

It is the right question to ask anyone who promises encryption. Four answers, and the second one is the one that actually proves it.

The design has no master key. There is no company key, no support key, and no admin unlock anywhere in the system.
You can see the consequence yourself. If you forget your password, we cannot recover your content. Your organizer has to re-approve you, because that is the only way to hand you the key again. A company keeping a spare key would never need to put you through that.
The sealing happens before anything is sent. Encryption runs on your device, so what arrives at our servers is already locked. Anyone technical can watch it happen in their browser's developer tools.
The claim is checkable. The encryption design is documented publicly, the app that runs in your browser can be inspected, and the native apps are code-signed.

Application security

Encryption protects your content. The rest of the app is hardened to the same standard, built against the OWASP Application Security Verification Standard and the OWASP Top 10.

Area	How it is protected
Signing in	Passwords are hashed with a memory-hard algorithm and never stored readably. Sessions use secure, httpOnly cookies. Password-reset links are single-use and expire in an hour, and sign-in attempts are rate-limited.
Who sees what	Deny by default. Every permission check runs on the server and is never trusted to the app in your hand. Each contact field's sharing setting is enforced before data leaves the server, so a hidden field is never sent anywhere.
Malicious input	Everything submitted is validated at the boundary, database access uses parameterized queries only, and the standard browser protections (content security headers, HSTS, frame denial) are set.
Uploads and media	Size and type limits, files stored under randomized names, served only to approved members of your group, and encrypted at rest.
Invites	Invite links carry high-entropy tokens stored hashed, with expiry and use limits, so a leaked or guessed link does not open your group.
Accountability	Sensitive administrative actions (approvals, removals, role changes, invites) are logged, so the group's history of who did what is auditable.

Dependencies are pinned and audited, security checks run on every change, and security researchers can reach us for responsible disclosure at support@group-space.com, which is a mailbox a person actually reads.

Safety tools that do not break the encryption

The hard question for any encrypted product: how do you handle abuse that nobody at the company can read? The answer is to put the tools in the group's hands and make every action visible.

Any member can report a photo or message. The first report immediately locks it, and the server simply stops serving that content to the group.
Group managers resolve reports by removing or restoring the content. Every action is logged.
Block someone and their content no longer reaches you.
Locked or removed content never reaches members' devices, and hiding it requires nobody to decrypt it.
If a report needs outside review, decrypting that single reported item requires an explicit, recorded access grant. There is no standing key that lets anyone browse.
Illegal content that is confirmed and removed is reported to the proper authorities, as the law requires.

Moderation is member-initiated, manager-resolved, and auditable. Nobody quietly reads your group. See Section 7 of the Terms for what is and is not allowed.

Straight answers about your data

Question	Answer
Who runs my group?	Your organizer administers the group: invites, approvals, removals. We operate the service underneath.
What about my kids?	Accounts belong to adults. Children's details are content that parents choose to enter, end-to-end encrypted, never child accounts. Nothing about a child is readable by us.
What do you actually hold about me?	A short list: your display name, email address, password hash, sessions, group membership and role, and for organizers, billing status. Card numbers are handled by our payment provider and never reach us. Everything personal beyond that list is ciphertext.
Do I have to share my details?	No. Every contact field is opt-in, each with its own sharing setting. The default is sharing nothing beyond your name.
Do you show ads or sell data?	Never. No ad networks, no trackers, no analytics beacons, no data sales, no profiling. The organizer's subscription pays for the service.
What happens when I leave?	Your encryption access and sessions are revoked immediately. Your data enters a short grace period in case the removal was a mistake, then is permanently deleted. Deleted data may persist briefly in backups before those rotate out.
Can I take my photos and videos with me?	Yes. Downloads decrypt on your device at full quality, a single shot or a whole album at once.
What are my rights?	Access, correction, deletion, and complaint, honored under GDPR and applicable law. For group content, requests go through your organizer or to us directly.

School platforms, childcare apps, and team apps rightly advertise encryption in transit and at rest, security certifications, and compliance. All of that protects data from outsiders, not from the company, because the company holds the keys. Group Space treats that layer as the baseline and adds the part that matters most for your family's photos and contacts: the host cannot read your group's content, so even a breach yields only ciphertext.

What we do not claim

Privacy promises fail when they are vague. Here is what you will not hear from us, so that what you do hear means something.

No "unhackable", and no "military-grade". The precise, checkable claim is that the server, and whoever operates it, cannot read your group's encrypted content.
A short list stays readable. Names, emails, membership, and timestamps keep the app working. They are listed in full above, not hidden behind the word "everything".
Your device is part of the system. No encryption can protect a lost, unlocked phone or a shared password. Keep those safe and the rest holds.
We do not strip metadata from your photos. A photo can carry the camera model, the time, and sometimes the location it was taken. That data is encrypted along with the file, so the server cannot read it, but anyone in your group who downloads the photo gets the original file with its metadata intact. If that matters for a particular picture, remove it before you upload.

For the technically curious: the cryptography is built on libsodium, using widely reviewed, standard building blocks. Nothing here is hand-rolled.