Welcome to Shadetree
A quiet, private place for the voices, faces, and stories that make your family yours.
Each household keeps its own Shadetree. Starting yours doesn't put you apart from anyone: families link up afterwards, and you'll see what they share.
Other ways to get in
By continuing, you agree to our .
Start your family
Create your own private place. You'll be its first member, and can invite everyone else with a code.
Join your family
Enter the invite code you were given and your name. That's it - we'll connect you automatically.
Invite someone
Inviting them to . Show them the QR in person, or send the message.
On your other device - a tablet, or a second phone - open Shadetree, tap “I have an invite code”, and enter this code. It'll join as another of your own devices.
Someone who isn’t in your family?
The code above brings a person into your own family. If a friend wants Shadetree for their family, they’d start a place of their own, and you can connect the two later.
Link to another family. Invitation only - a steward hands a code to a steward, in person.
Welcome back
Let's get you back to your family - same you, same memories.
Now let’s keep it safe
You’ve made your first memory. Here’s the one thing that brings it back if this phone is ever lost, broken or replaced.
Keeping it safe
Make something
Settings
Everything this app has done on this phone - what it sent, what arrived, and who it went to. It stays on this phone and is never shared with anyone.
You belong to more than one family. Open whichever one you want to work with.
Your families
👪 Start your family
Relatives who have a family of their own - your parents, a sibling, a cousin - stay separate from yours. You connect the two instead: each keeps its own space, and each side chooses how much it wants from the other.
Start or join another family of my own
🔑 Your recovery code
📧 Email recovery
Appearance
Text size
Keep your memories safe
Your memories live on this phone. Save a copy somewhere safe - a cloud drive, or your files - so they're still yours even if this app is ever removed.
↺ Get my memories back
Your information on our server
You can take your name and backup off Shadetree's server whenever you like. The memories on this device stay put.
Sometimes it isn't anything wrong - someone just sends more than you want, or you need a little room for a while. Turning someone down here stops their memories reaching this phone. Nobody is told, and nobody can see it - not them, not a steward, not the rest of your family. You can turn them back on whenever you like.
You can still share memories with anyone you've turned down - this only changes what comes the other way. While someone is turned down, what they send doesn't reach you and won't arrive later if you turn them back on.
Before you write
Here's honestly what we can and can't do.
We can stop someone reaching you, and we can stop a person or a whole family using Shadetree at all.
We can't delete a memory that has already arrived on someone's phone, and we can't read it. That's the same thing that keeps your own memories private from us - there is no key on our side to use, for anyone.
If you just want someone to stop reaching you, you don't need us at all: , quietly and instantly.
Or write to us directly: hello@theshadetree.co
Someone reads every one of these, and you'll hear back within a day. If somebody is in danger right now, please call your local emergency number - we're a small family project and we can't help quickly enough.
Other people have sent you memories over the years. Bring them into a family you belong to, and that family keeps them too - so they can be passed on again long after you.
These are the other screens that are yours - a Hearth frame, a second phone. When you name a memory or star a favorite on one, it quietly shows up on the others. Only your own devices, never the rest of the family.
A Hearth is a tablet or a spare screen that sits somewhere in the house and quietly shows your family's memories all day. It is one of your devices, so nothing new is shared with anybody - it just shows what you already have.
This device
If something isn't working
Try these in order. Nothing here can lose a memory.
Starting over
I look after the Shadetree server
Free up space
Pick a batch of memories, save them to your phone's Files, and remove the heavy photos and videos from this device. Each one stays in your timeline as an archived card - the media lives safely in the saved file.
Someone wants to join
Say yes to welcome them in, or Not now if you're not sure. Nothing happens until you choose.
Recently declined
Changed your mind, or tapped the wrong one? You can still add them.
Members of
Everyone in this family. Tap a name to see what you can do about them.
What do “steward” and “remembered” mean?
A steward helps run the family: they can invite new people and remove ones who don't belong. It is shared help, not extra power - a steward cannot read, change, or delete anyone's memories. Whoever started the family is its first steward, and any steward can make another one.
Remembered is for someone who has died. Everything they shared stays here forever and their name stays in the family - nothing is removed, ever. It only means Shadetree stops waiting on them: it won't keep trying to deliver to their phone, or ask them to share something. It can be undone whenever you like.
If you see the same person twice, one is usually an old or extra device - you can safely remove it.
Key directory
Every enrolled device. Compare the fingerprints shown here against what each phone shows on its own “Me” screen, in person.
Reconnect to your family
Photos waiting for their story
Tap any photo and tell us about it - who's in it, where it was, what you remember. It becomes a memory. The rest wait quietly, no rush.
Invite someone to share a memory by asking them directly. Your question lands on their phone, and they can answer with their voice, a video, a photo, or a few words. It's the easiest way past the blank page - and they'll know it's worth answering, because you asked.
Pick a photo and who it's for. They'll see it for the first time while the app records their reaction - so keep the hint a secret!
💌 A surprise from
When you're ready, tap below - we'll show you the photo and record your reaction at the same moment.
Your reaction
A quiet place for your family's memories
The little things slip by so fast - the story behind a photo, the way someone laughs telling it, an ordinary afternoon you'd love to remember. This is a warm, private place to hold onto those moments, and share them with the people who matter most.
Not the polished, posed ones. The real ones. A grandmother explaining who's in an old picture. A grandchild telling a story that goes absolutely nowhere. The little things that make a family yours.
How to use it
Use it the way you'd use a shoebox of photographs - to hold on to each other. Add a photo and tell the story behind it. Ask someone a question only they can answer. Send a surprise and catch their face when they see it.
There's no wrong way, and no feed to keep up with. A few memories a year is a treasure. You're never falling behind.
What this is - and isn't
We built it differently on purpose:
For the family member who worries about that sort of thing: there's no company behind this mining it, and no account selling your data. For everyone else, it just means this is a safe, private place that belongs to you.
Learn more
Passing it on
Tips
Help
A diagnostic report holds no memory content, names, or messages - just what the app did and any errors, kept only on this device until you choose to send it.
This app
Shadetree was made by Brian Miller, for his family.
Questions & how-to
Tap any question to open it.
Families, in one minute
A family is a small circle that shares its everyday memories together - just your closest people. You always have "My family". To share with relatives who have their own families - your parents, a sibling - you don't all pile into one big family; you stay separate families and connect. Memories you make go to your own family by default.
How do I add my family?
Go to Me → Your family and tap Invite someone. If you don't see that, you're not a steward of this family - the app will name who is, so you can ask them. Hand that person the code (show it to them, or send the message). They enter it and they're in - a full member who sees everything shared in your family. That's how you bring in your spouse, your kids, anyone who shares this life with you.
Someone gave me a code - what do I do?
A code is one of two things. An invite welcomes you INTO someone's family - you'll be a full member and see everything shared there. A connect code links your family to theirs while you stay two separate families. For a connect code, go to Me → Connected families and tap Connect with another family - a steward of your family does this part, and the app names yours if it isn't you. For an invite to join someone else's family as a member, go to Me → Your family and open Start or join another family of my own at the foot of the page, then choose Join with a code. Between relatives, it's almost always connect.
Join, or connect? (the one rule)
This is the thing worth remembering:
- Join only for people who share everything with you - a partner, your kids, another device of your own. They become full members of your family and see all of it.
- Connect for everyone else you love - your parents, your siblings, aunts, uncles, cousins, in-laws. You each stay your own family, with your own private space, and choose what to share across.
Quick test: "Would they see literally everything I post?" Only if they truly share this home → join. Anyone else, even your parents → connect.
How do I stay in touch with aunts, uncles, cousins?
They have their own family; you're not in it and they're not in yours - but you'd like to share the occasional big moment and see theirs. That's connecting. Go to Me → Connected families and tap Connect with another family. That one is a steward's job - if the button isn't there, the app tells you who to ask. It's invitation-only: create a code to hand to a steward of their family, or enter one they gave you. Then each of you chooses how much you want from the other:
- Nothing for now
- Just the "for everyone" memories - the default: birthdays, graduations, the big stuff
- Everything they share there
Your everyday memories stay in your own family. Only what you mark "also share with the wider family" crosses the connection - and no further; it doesn't hop to their connections.
How does sharing a memory work?
Make a memory and it goes to your family by default - one tap. If you're in more than one family, you'll pick which. And if you're connected to other families, you can tick "also share with the wider family" to send that one memory on to them.
Someone just joined - will they see our old memories?
Yes. When you add a new member to your family, your phone automatically re-shares the memories you made for that family, so they arrive with the history instead of a blank page. You don't have to do anything - you'll just see "Syncing" while it catches them up.
How do memories reach my children, and their children?
This is the whole point of Shadetree, so it's worth five minutes.
Every memory anyone sends you is yours to keep. It sits on your phone in full, and it stays there. Nothing expires, nothing is stored on a server waiting to be deleted one day. If your grandmother sends you a story, you have it for life.
Passing it on works in two different ways, depending on one thing: whether the people you're passing it to are in the same family as you.
Inside your own family, it's automatic
If your children are members of the family a memory was sent to, they already get it. Add your daughter to your family and your phone quietly hands her everything that family holds - not just what you made, but what your grandmother sent, too. You don't do anything.
When she starts her own family, you do one thing
One day your daughter moves out, marries, and starts a family of her own here. That new family is a fresh circle. It has never met your grandmother, so it can't reach those old memories - and if nothing were done, they would stop with your daughter.
So the app offers her this, right as she creates it:
What you were given - it takes every memory other people gave her and brings it into her new family. Her children then inherit all of it the automatic way above, and when they start families, they do the same thing. That's the chain.
How to actually do it
- Go to Me.
- Tap What you were given. If you don't see it, there's nothing waiting - every memory you have can already reach the families you're in. It appears on its own when that changes.
- It tells you how many memories are waiting and who they came from. Tap Bring them in.
- That's it. They reach the rest of that family the next time their app looks.
You can do it whenever you like, as many times as you like - relatives will keep sending you things for years, so come back now and then. And if you change your mind, the same screen has Release them.
What this does and doesn't do
Nothing leaves the family that gave them to you. It's a copy. Your parents keep every memory they ever sent you.
Nobody's name changes. Your grandmother stays the author of her own memory forever, in her own words. What you pass on is the right to keep it, never the credit for it. A memory that has been passed along says so underneath, permanently: who brought it forward, and when. Three generations later it still reads "Ruth's memory. Sarah carried this into the Bell family in 2041."
If a memory's photos were freed to save space, it travels as a card with no picture. Bring your archive back onto the phone first and it'll go with everything.
The other way, which never stops working
All of the above needs Shadetree to still exist. So there's a second path that doesn't: Me → Your archive writes your whole collection to a folder you keep - the photos and recordings as ordinary files, plus a page that opens in any web browser and a written description of the format. Someone in 2085 can read it with no app, no account, and no company.
Do it whenever there's something new worth keeping - the app will say so on the Me screen when it's been a while. It's the shoebox in the attic, and it's the honest answer to "what if you're not around?"
I made a mistake - can I fix a memory I already sent?
Yes, for anything you made. Open it and tap the pencil beside its title. You can change the title, the date, the story, crop the photo or swap it for a different one. Tap Save changes and the corrected version goes out to everyone who already has it - it replaces their copy rather than arriving as a second memory.
Underneath, the memory quietly says it was edited and when. Not a warning, just the truth: a photo shouldn't silently become a different photo on somebody else's phone.
Two things worth knowing. If someone gave the memory their own name on their phone, your title change leaves their name alone - their copy, their title. And a correction reaches the people you can reach: not a phone that got the memory second-hand, years later, in a family you were never part of.
On somebody else's memory, the pencil still just renames your copy, and nobody else sees it.
Can I use Shadetree on my phone and my tablet?
Yes - the trick is to use your recovery code, not an invite. On the second device, on the welcome screen tap “Already set up before? Restore with your recovery code” and enter it. That makes the tablet the same you, sharing one identity across both devices.
Don't set the tablet up as a brand-new person and join with an invite code - that creates a second, separate “you” in the family (two names the same). If that already happened, a steward can fix it: go to Me → Your family, open Members, find the copy that isn't marked “this device,” and tap Remove.
What's a steward?
A steward is someone who helps run a family - they can invite new members and remove ones who don't belong. Whoever founds a family is its first steward, and any steward can make another member a steward too (Me → Your family, then Members). It's just a way to share the load; nobody can remove the founder.
I don't see “Invite someone” or “Members”
Then you're a member of the family rather than one of its stewards, and those two are a steward's job - along with connecting to another family. It isn't a limit on what's yours: you can make and share memories exactly like everyone else, keep your own collections, and add your own Hearth or second phone.
Go to Me → Your family and the app names the stewards, so you know who to ask. Any of them can make you one too.
How it works
The short version: your memories are encrypted on your device before they ever leave it, and our server only ever handles locked boxes it can't open. Here's the honest detail, for anyone who wants it.
Your keys stay on your device
When you set up, your device creates a pair of cryptographic keys. The private one never leaves your phone - we never see it, and we couldn't hand it over even if someone forced us to.
Every memory is locked before it's sent
When you share a memory, your device encrypts it with a fresh key, then locks that key individually for each person you're sending to, using their public key. Only their device can unlock it. Our server relays the locked result and never sees what's inside.
Tampering shows up
Each memory is signed by the sender. If anything changed in transit, the recipient's app would notice and flag it - so you know a memory really came from who it says, unaltered.
A memory can outlive the person who sent it
Memories are meant to travel down a family, so a person can pass on what they were given (see "How do memories reach my children" in Questions & how-to). Two honest notes about what that means.
When someone passes a memory along, they sign the delivery - their signature proves who handed it to you, not who made it. The original author's name travels sealed inside the memory itself, where nobody along the way can change it. So "your grandmother wrote this" stays true no matter how many hands it passes through, while "your aunt brought it forward in 2041" is your aunt's own word for it. Both are shown; only the first is mathematics.
And a recall reaches the people you can reach. If you unsend a memory, it disappears from the phones of everyone you sent it to - but not from a phone that received it second-hand, years later, in a family you were never part of. We can't reach that far, and we'd rather say so than let you believe otherwise.
The server forwards; it doesn't hoard
Encrypted memories pass through on the way to your family and are removed once delivered. No accounts, no passwords kept with us, no analytics, no third-party trackers, no ad networks. To actually deliver a memory, the server does keep a little readable information: the name you chose, who's in your family, and the outside of the envelope for each memory (who sent it to whom, and when) - never what's inside. It also keeps a backup of your keys, itself locked under a recovery code that only you hold. The full, plain-language list is in our Privacy Policy.
If you ever need to report something
We cannot read your memories, and that does not change when something goes wrong - there is no key on our side to reach for. So if you report a memory to us, nothing is taken from your phone automatically. The report is written into your own email app, where you can see every word before you send it, and you choose whether to include what the memory says. Photos, video and voice recordings are never included; if we need to see one, we ask you. We can stop a person or a whole family reaching you, and stop them using Shadetree at all - but we cannot delete a memory that has already arrived on somebody's phone, and we will not pretend otherwise.
You can always walk away with everything
Export a full, self-contained copy of your memories anytime. It opens on its own, with no app and no internet. If we vanished tomorrow, your memories wouldn't.
What it is - and isn't
This is a small, private tool made for families, not a bank or a government system. The encryption is real and standard, but the app hasn't been through a formal third-party security audit, and its safety leans on you inviting only people you actually know - which is why joining is invitation-only, in person. Treat it as a heartfelt place for family memories. That's exactly what it is.
Who built it, and how
Shadetree was made by one person - Brian Miller, a K-12 educator - in the evenings, over months. There is no company and there is no team.
Much of the code, and a good deal of the writing, was worked out in a long collaboration with Claude, an AI assistant made by Anthropic. That is worth saying plainly, because you have every right to know how a thing was built before you trust it with something precious.
It has nothing to do with what you keep here. No memory of yours has ever been seen by an AI, or by anyone at all except the people you sent it to. That isn't a promise about how careful we are - it is how the thing is built. Everything is locked on your phone before it goes anywhere, and there is no key on our side to change our minds with.
Terms & Privacy
Last updated: July 23, 2026
Shadetree is operated by Brian Miller ("we," "us," "our"), in Indiana, USA. By using Shadetree, you agree to the terms below. If you do not agree, please do not use it.
Shadetree is a free, private place to keep and share family memories. We built it with care, but it is provided as-is, with no guarantees. It is not a backup service - the only safe copy of your memories is the one you export and keep yourself. Please read on.
Terms of Use
1. It's free (for now). Shadetree is currently free to use. We may add optional paid features later, and we may change, add, or remove features at any time. We do not promise that any particular feature will remain free or available.
2. As-is, no warranty. Shadetree is provided "as is" and "as available," without warranties of any kind, express or implied. We do not guarantee that it will work, be available, be error-free, or that your memories will be stored, delivered, preserved, or recoverable.
3. You use it at your own risk. Digital data can be lost - through a lost or damaged device, software problems, failed uploads, the service being unavailable, or other causes. You accept that risk when you use Shadetree.
4. Back up your own memories. Shadetree is not a backup service. The reliable, lasting copy of your memories is the export you make yourself (Me › Export your archive) and keep somewhere safe. Keep your recovery code somewhere safe too - without it, a lost or wiped device cannot be restored, and no one, including us, can recover your account or memories for you. Any loss that results from not keeping your own backups or recovery code is your responsibility.
5. Strong encryption means we cannot recover it. Your memories are encrypted so that only the people you share them with can read them - not us. That privacy is the whole point, but it has a trade-off: if you lose your keys or recovery code, your data cannot be recovered by anyone. This is by design.
6. Limitation of liability. To the fullest extent permitted by law, we are not liable for any damages of any kind arising from or related to your use of Shadetree - including, without limitation, lost or corrupted memories, lost or damaged devices, failed backups or transfers, downtime, or the service being changed or discontinued - even if we were advised such damages were possible. To the extent any liability cannot be excluded, our total liability to you is limited to the amount you paid us, which for a free service is zero.
7. We may change or stop the service. We may modify, suspend, or discontinue Shadetree, in whole or in part, at any time, without notice and without liability to you.
8. Acceptable use and enforcement. Shadetree is for personal, family, and lawful use only. Do not use it to break the law, harm others, or interfere with the service or other people's use of it. Because your memories are encrypted end to end, we cannot see or screen what people share; even our own relay only ever holds locked data it can't read. So our ways of dealing with misuse are limited to what we can do without reading anyone's memories: if we have good reason to believe an account or a family is being used unlawfully or to harm others, we may remove that person's or that family's access to the relay and delete the data they hold on it. We cannot selectively review or edit content, and copies already delivered to someone's device are beyond our reach. We cooperate with valid legal requests, and where the law requires it we report unlawful material to the proper authorities. If you become aware of misuse, please tell us at hello@theshadetree.co. Because only the people a memory was shared with can read it, describe what you saw (and, if you choose, include what you received) so that we can act on it.
9. Your content is yours. You keep all rights to the memories you create. You are responsible for what you share and for having the right to share it.
10. Indemnification. You agree to defend, indemnify, and hold us harmless from any claims, losses, or costs arising out of your use of Shadetree or the content you share.
11. Changes to these terms. We may update these terms from time to time. If we do, we will change the date at the top. Continuing to use Shadetree after a change means you accept it.
12. Governing law. These terms are governed by the laws of the State of Indiana, USA, without regard to its conflict-of-laws rules. If any part of these terms is found unenforceable, the rest still applies.
Privacy Policy
We built Shadetree so that we cannot read your memories, and so that we collect as little else as we possibly can. Here is exactly what that means, in plain terms: what we never see, what we have to keep for the app to work, what you can choose to add, and what never leaves your device at all.
What we never see or store.
- The inside of your memories. Your photos, videos, voice notes, the words you write, and even a memory's title are encrypted on your device before they ever leave it. They can be opened only on your device and the devices of the people you share with. We cannot read them, and neither can our hosting company.
- Your recovery passphrase, if you choose email recovery (below). It never leaves your device.
- We run no ads, no trackers, and no analytics that follow you, and we never sell or share your data. There is no advertiser and no data broker anywhere in this.
What we have to keep for the app to work. A few things cannot be locked away, because the server needs them to carry a memory to the right people. We keep them to a minimum, and we would rather tell you plainly than pretend they aren't there:
- The name you choose for yourself, along with your device's public keys. These let your family see who a memory is from. Your name is stored in readable form and stays until you or your family's steward removes your device. Your profile photo is not kept here: it travels inside your encrypted memories, so our server never holds a picture of you or your family.
- Who belongs to a family, and which families have chosen to connect. This is how a memory reaches the right circle and no one else.
- The outside of the envelope for each memory on its way: which device sent it, which devices it is headed to, and when. We can see that you sent something to someone at a certain time. We cannot see what is inside. The encrypted memory itself passes through and is deleted once everyone has received it, or within about 21 days at the latest.
- A backup of your keys, so a lost phone doesn't mean a lost account. It is the keys only, never your memories, and it is locked with your recovery code, which only you hold. We keep the locked box and cannot open it.
Being straight with you: added together, the readable parts above come to your chosen name, the shape of your family, and a record of who shares with whom and when. If our server were ever broken into, that is what could be exposed. Your memories and your photographs, including the picture of yourself, would stay unreadable.
What you can choose to add. Email recovery is optional. If you turn it on, you give us an email address so that an email and a passphrase can bring you back if you ever lose both your device and your recovery code. When you set it up or use it, your email is turned into a one-way fingerprint. We store only that fingerprint, never the address itself, and we cannot turn it back into your email. Your passphrase never reaches us. To be sure the address really is yours, we send it a one-time verification code when you turn the feature on - that is the only email we ever send you, and we never use your address for anything else. Turning the feature off removes the fingerprint. If you skip it, we hold no email for you at all.
What never leaves your device. Your private keys, your full library of memories, your favorites and the way you've arranged things, and any exports you make all live on your own device. Uninstalling the app erases that copy.
What we do not do. No ads. No tracking. No analytics that follow you. No selling or sharing your data with anyone. There is no advertiser and no data broker in the picture.
Service providers. We would rather name these than leave you to find them. Four other companies touch Shadetree, none of them able to read a memory:
- Our web host runs the relay. It holds the encrypted and routing data described above on its disks. It cannot read your memories.
- Cloudflare provides the bot check on the one screen where somebody starts a brand-new family, to stop the relay being filled with fake ones. Your device contacts them at that moment and they see its network address. Nothing about you, your family, or your memories is sent.
- Apple and Google deliver notifications, and only if you turn them on. We ask them to ring a particular phone. The message we hand them is the same fixed sentence every time and contains no name, no memory, and nothing about who it came from - but they do learn that your phone was pinged, and when.
- An email delivery service sends your verification code, and only if you choose email recovery. Your address passes through them to reach you. No memory, name, or anything about your family goes with it.
Children. Shadetree is set up and controlled by adults. A child only ever takes part through a device that an adult in their family has set up and looks after, and that adult is responsible for the child's use and agrees to these terms on their behalf. Shadetree is not directed to the general public or to children under 13 as a public service, and we do not knowingly collect personal information from a child directly. The relay only handles the readable directory and routing information described above, and cannot read the content of anyone's memories.
Keeping and deleting your data. Memories in transit are deleted after delivery, or within about 21 days at the most. The readable directory and routing information above stays until it is removed. Uninstalling the app clears only the copy on your device. To also remove your device, name, and key backup from our relay, email us and we will erase them. A family steward can also remove your device from the family.
Changes. If this policy changes, we will update the date at the top.
Contact. Questions about these terms or your privacy? Email hello@theshadetree.co.
These terms are written to be clear and fair, not to trick anyone. They are not legal advice.
What’s new
The latest changes to Shadetree, in plain language.
Make a photo book
Choose some memories and Shadetree lays them out as a little book. Save it as a PDF and print it at home, or take it to any photo-book service - it's yours to keep, and to give. Free, always.
