Your family trusts us with birth certificates, passports and plans to leave. Here is what we keep, where it lives, who else sees it, and how to take it with you or delete it. Effective October 1, 2026.
If you only use the free check: your answers, and your email if you save them.
If you join: your name, email and birth year; your family tree (names, dates, places and citizenships); the records and papers you upload or we order for you; your claims and where each one stands; your chats with Postern; and, only if you set them up, your tax inputs, your travel log, and the accounts you open to move money.
If you connect a mail or calendar account for your travel log, we read travel bookings from it, read-only. If you let us use a government portal login for you, we keep it for the step you approved and log each use.
We don’t keep your card details. Stripe does.
Each family has its own encryption key, held in Google Cloud’s key service. Everything that describes a person is sealed with that key before it’s stored. Your record is opened only inside a locked-down machine that runs for your family alone and proves what code it runs before the key is released to it. Our website can’t open it.
Our database shows only that a family exists, how many people are in it, and routing details like membership status. If someone at Postern ever needs to read your case to help you, they have to write down why, and we keep that record.
Only the people and services doing something you asked for:
We don’t sell your data, and we don’t show ads.
Everyone you invite into your family’s account sees the family record and the chat history with Postern. Chats are shared within the household, not private to one person.
If a cousin’s family joins through your invite, an adult in your family can choose to share one ancestor’s records with them, so the same record is ordered once. You can stop sharing any time: the copies are taken back, and steps they already finished stay finished.
We use a sign-in cookie, and short-lived cookies that carry your answers into joining or an invite. Our own analytics count page events with a random id stored in your browser. They never record your IP address, your browser, your email or your account. There are no ad or third-party trackers.
While you’re a member, we keep your record so Postern can keep your plan current. If your membership ends, we keep it for 12 months so you can come back, unless you delete it first. Saved free-check answers are kept for 12 months, unless you become a member.
Download everything any time from your papers page: your family record, every paper and every claim, in one file.
To delete your family’s account, go to Your account. The person who set up the family deletes it; anyone else in the household can leave. When you delete:
If you connected a mail or calendar account, disconnect it before you delete, so Google or Microsoft forget Postern too.
Write to privacy@joinpostern.com. Postern is run by PRIA Technologies, LLC, a Delaware company at 3200 Windy Hill Rd SE, Suite 920W, Atlanta, GA 30339. Depending on where you live, you may have more rights over your data; ask us and we’ll help.
If we change this notice, we’ll email members before the change takes effect. See also our Terms.