Privacy Policy

Last updated: August 2026

Introduction

Bonds ("we", "our", or "us") is a family-tree and messaging app. This policy explains what the app collects, where that information goes, and what you can control. It describes what the app actually does, including the features that send information to companies other than us.

Information We Collect

You provide directly:

• Phone number, used to verify your identity
• Name, profile photo, and optional details such as date of birth, gender, and wedding or death dates
• Family relationships, including information you enter about other people — some of whom may not use Bonds
• Messages, photos, videos, and files you send
• Shared group albums, events, and calendars

Collected automatically:

• A notification token identifying your app installation, so calls and messages can reach your device
• Basic delivery and error diagnostics for calls and notifications

The AI Assistant

Bonds includes an assistant you can talk to in order to find people or propose changes to your family tree. When you send it a message, information about your family tree leaves our systems and is processed by a third-party AI provider.

Specifically, the following is sent for that turn:

• Your message, and recent messages in the same conversation
• A summary of your tree containing the names of people in it, and — where needed to distinguish people with the same name — their parents' names
• Details about your own immediate relatives (spouse, parents, children, siblings)

Internal database identifiers are replaced with short placeholders before sending, but names are sent as they are written. Dates of birth, phone numbers, and email addresses are not included in that summary; some of them may be sent if you type them into a message yourself, or if the assistant looks them up to answer your question.

Depending on the app build, the provider is OpenRouter (which routes to an underlying model provider), Groq, or Anthropic. Requests are relayed through our servers, so the provider does not receive your account identity, phone number, or IP address. Their handling of the content they receive is governed by their own privacy terms.

If you do not want your family-tree information processed this way, do not use the assistant. The rest of the app works without it.

Face Recognition (Biometric Information)

Bonds can detect faces in photos you add to a shared album and suggest which family member each face belongs to.

• This is off unless you turn it on. It is controlled by a per-account setting and can be turned off at any time.
• Face detection and the generation of face signatures happen on your device. Photos are not sent to a third-party face-recognition service.
• When a face is matched to a person, we store a cropped image of that face and a numeric signature derived from it, so the same person can be recognised in later photos. In some jurisdictions that signature is treated as biometric information.
• You can delete an individual face or the entire face gallery for a person. Deleting removes the crop and its signature.

Faces may be detected in photos that include people other than you. Only add photos to a shared album if you are comfortable doing so on behalf of the people in them.

Finding People You Know

If you grant contacts permission, Bonds reads your device address book so you can find people you already know. Contact names stay on your device for that screen.

To check whether a phone number belongs to a Bonds user, the number is converted into a fixed-length code (a SHA-256 hash) and compared against a directory of registered numbers stored in the same way. This is not anonymisation. Because the set of possible phone numbers is small enough to search exhaustively, anyone who obtained that directory could recover the numbers in it. We treat it as personal information and restrict access to it accordingly; we mention the limitation here rather than describing it as anonymous.

You can use Bonds without granting contacts permission.

Calls

Audio and video calls are carried by LiveKit, and network-relay credentials are issued by Cloudflare when a direct connection is not possible. Call media passes through those services in order to reach the other participants.

Who Else Receives Information

We do not sell your personal information, and we do not share it for advertising.

Encryption

Chat messages and chat media are end-to-end encrypted: they are encrypted on your device and we cannot read them. The key that protects your chat history is held on your device and can be backed up, encrypted with a PIN that only you know. If you forget that PIN, we cannot recover your chat history — there is no recovery code and no copy held by us.

Shared album photos, face crops, profile information, and family-tree data are not end-to-end encrypted. They are stored encrypted at rest and access is restricted to the people you have shared them with.

Data Retention

• Your content is kept while your account exists.
• When shared content such as an album photo, a face record, or a family member is deleted, a recovery copy is retained for 30 days so an accidental deletion can be reversed, and is then permanently removed.
• Deleting your account removes your profile and your access; content you contributed to a shared group may remain visible to that group. How to request account deletion sets out exactly what is deleted and what is kept.

Information About Other People

Bonds lets you record information about relatives who may not use the app and have not agreed to this policy. Please add only what those people would reasonably expect you to, and remove anything they ask you to remove. If someone contacts us about information another user has recorded about them, we will act on it.

Your Rights

• Access the information held about you
• Correct or update your information
• Delete your account
• Turn face recognition off, and delete face data already stored
• Use the app without granting contacts permission, and without using the assistant

Children's Privacy

Bonds is not directed at children under 13, and we do not knowingly create accounts for them. A family tree may contain information about children recorded by an adult relative.

Changes to This Policy

We may update this policy. Material changes — in particular any change to which third parties receive your information — will be reflected here with a new "last updated" date.

Contact Us

Questions or requests: bondssupport@gmail.com