Privacy

Your family trusts us with birth certificates, passports and plans to leave. Here is what we keep, where it lives, who else sees it, and how to take it with you or delete it. Effective October 1, 2026.

What we keep

If you only use the free check: your answers, and your email if you save them.

If you join: your name, email and birth year; your family tree (names, dates, places and citizenships); the records and papers you upload or we order for you; your claims and where each one stands; your chats with Postern; and, only if you set them up, your tax inputs, your travel log, and the accounts you open to move money.

If you connect a mail or calendar account for your travel log, we read travel bookings from it, read-only. If you let us use a government portal login for you, we keep it for the step you approved and log each use.

We don’t keep your card details. Stripe does.

How it’s protected

Each family has its own encryption key, held in Google Cloud’s key service. Everything that describes a person is sealed with that key before it’s stored. Your record is opened only inside a locked-down machine that runs for your family alone and proves what code it runs before the key is released to it. Our website can’t open it.

Our database shows only that a family exists, how many people are in it, and routing details like membership status. If someone at Postern ever needs to read your case to help you, they have to write down why, and we keep that record.

Who else sees it

Only the people and services doing something you asked for:

  • Google Cloud hosts Postern, stores the encrypted data and keys, and runs the AI behind Postern’s chat (Vertex AI).
  • Stripe takes your membership payment.
  • Resend sends our emails.
  • Government offices, archives and consulates get the applications and record requests you approve, in your name.
  • Services for single steps, each only when that step runs: online notaries (Proof), certified translators (such as RushTranslate), mail and shipping (Lob, EasyPost), a mail hub that receives and scans your records (Stable), and identity checks some government portals require (such as ID.me).
  • Money providers, only if you open accounts: Bridge verifies you and opens accounts in your name, Privy holds your own wallet behind your passkey, and Stripe issues cards.
  • Google or Microsoft, if you connect a mail or calendar account.

We don’t sell your data, and we don’t show ads.

Your household and your cousins

Everyone you invite into your family’s account sees the family record and the chat history with Postern. Chats are shared within the household, not private to one person.

If a cousin’s family joins through your invite, an adult in your family can choose to share one ancestor’s records with them, so the same record is ordered once. You can stop sharing any time: the copies are taken back, and steps they already finished stay finished.

Cookies and analytics

We use a sign-in cookie, and short-lived cookies that carry your answers into joining or an invite. Our own analytics count page events with a random id stored in your browser. They never record your IP address, your browser, your email or your account. There are no ad or third-party trackers.

How long we keep it

While you’re a member, we keep your record so Postern can keep your plan current. If your membership ends, we keep it for 12 months so you can come back, unless you delete it first. Saved free-check answers are kept for 12 months, unless you become a member.

Taking it with you, or deleting it

Download everything any time from your papers page: your family record, every paper and every claim, in one file.

To delete your family’s account, go to Your account. The person who set up the family deletes it; anyone else in the household can leave. When you delete:

  • Right away: your family record, papers, claims, chats, portal logins, sharing, household sign-ins, saved answers and our email log are deleted, and your membership is canceled with no further charges.
  • Within the hour: your encrypted files are deleted, and your family’s key is scheduled for destruction. Google destroys it within 30 days. After that, no copy of your family’s sealed data can be opened by anyone.
  • We stop emailing everyone in your household. We keep a scrambled fingerprint of each address so no email goes to it again, not the address itself. If you sign up again later, it’s cleared.
  • Encrypted backups of our database expire after 30 days. Until then they still hold your sign-in email and name.
  • What stays: anything already filed with a government, accounts opened in your own name with bank or wallet providers, and the payment records Stripe must keep by law.

If you connected a mail or calendar account, disconnect it before you delete, so Google or Microsoft forget Postern too.

Questions

Write to privacy@joinpostern.com. Postern is run by PRIA Technologies, LLC, a Delaware company at 3200 Windy Hill Rd SE, Suite 920W, Atlanta, GA 30339. Depending on where you live, you may have more rights over your data; ask us and we’ll help.

If we change this notice, we’ll email members before the change takes effect. See also our Terms.