Welcome to Shadetree
A quiet, private place for the voices, faces, and stories that make your family yours.
Each household keeps its own Shadetree. Starting yours doesn't put you apart from anyone: families link up afterwards, and you'll see what they share.
Other ways to get in
By continuing, you agree to our .
Start your family
Create your own private place. You'll be its first member, and can invite everyone else with a code.
Join your family
Enter the invite code you were given and your name. That's it - we'll connect you automatically.
Invite someone
Inviting them to . Show them the QR in person, or send the message.
On your other device - like an iPad or a second phone - open Shadetree, tap “I have an invite code”, and enter this code. It'll join as another of your own devices.
Someone who isn’t in your family?
The code above brings a person into your own family. If a friend wants Shadetree for their family, they’d start a place of their own, and you can connect the two later.
Link to another family. Invitation only - a steward hands a code to a steward, in person.
Welcome back
Let's get you back to your family - same you, same memories.
Now let’s keep it safe
You’ve made your first memory. Here’s the one thing that brings it back if this phone is ever lost, broken or replaced.
Keeping it safe
Make something
Settings
Your own family is your private space - just your closest people. Relatives who have their own family - your parents, a sibling - stay separate, and you connect the two: each keeps its own space, and each side chooses how much it wants.
Your family
Connected families
Start or join another family of my own
👪 Start your family
🔑 Your recovery code
📧 Email recovery
Appearance
Text size
Keep your memories safe
Your memories live on this phone. Save a copy to iCloud Drive (or wherever you keep files) so they're safe even if this app is ever removed. On iPhone or iPad, tap the button, then choose Save to Files.
↺ Get my memories back
Your information on our server
You can take your name and backup off Shadetree's server whenever you like. The memories on this device stay put.
Sometimes it isn't anything wrong - someone just sends more than you want, or you need a little room for a while. Turning someone down here stops their memories reaching this phone. Nobody is told, and nobody can see it - not them, not a steward, not the rest of your family. You can turn them back on whenever you like.
You can still share memories with anyone you've turned down - this only changes what comes the other way. While someone is turned down, what they send doesn't reach you and won't arrive later if you turn them back on.
Before you write
Here's honestly what we can and can't do.
We can stop someone reaching you, and we can stop a person or a whole family using Shadetree at all.
We can't delete a memory that has already arrived on someone's phone, and we can't read it. That's the same thing that keeps your own memories private from us - there is no key on our side to use, for anyone.
If you just want someone to stop reaching you, you don't need us at all: , quietly and instantly.
Or write to us directly: hello@theshadetree.co
Someone reads every one of these, and you'll hear back within a day. If somebody is in danger right now, please call your local emergency number - we're a small family project and we can't help quickly enough.
These are the other screens that are yours - a Hearth frame, a second phone. When you name a memory or star a favorite on one, it quietly shows up on the others. Only your own devices, never the rest of the family.
This device
If something isn't working
Try these in order. Nothing here can lose a memory.
Starting over
I look after the Shadetree server
Free up space
Pick a batch of memories, save them to your phone's Files, and remove the heavy photos and videos from this device. Each one stays in your timeline as an archived card - the media lives safely in the saved file.
Someone wants to join
Say yes to welcome them in, or Not now if you're not sure. Nothing happens until you choose.
Recently declined
Changed your mind, or tapped the wrong one? You can still add them.
Members of
Everyone in this family. Stewards (marked below) can approve new members and remove ones who don't belong. If you see the same person twice, one is usually an old or extra device - you can safely remove it.
Key directory
Every enrolled device. Compare the fingerprints shown here against what each phone shows on its own “Me” screen, in person.
Reconnect to your family
Photos waiting for their story
Tap any photo and tell us about it - who's in it, where it was, what you remember. It becomes a memory. The rest wait quietly, no rush.
Invite someone to share a memory by asking them directly. Your question lands on their phone, and they can answer with their voice, a video, a photo, or a few words. It's the easiest way past the blank page - and they'll know it's worth answering, because you asked.
Pick a photo and who it's for. They'll see it for the first time while the app records their reaction - so keep the hint a secret!
💌 A surprise from
When you're ready, tap below - we'll show you the photo and record your reaction at the same moment.
Your reaction
A quiet place for your family's memories
The little things slip by so fast - the story behind a photo, the way someone laughs telling it, an ordinary afternoon you'd love to remember. This is a warm, private place to hold onto those moments, and share them with the people who matter most.
Not the polished, posed ones. The real ones. A grandmother explaining who's in an old picture. A grandchild telling a story that goes absolutely nowhere. The little things that make a family yours.
How to use it
Use it the way you'd use a shoebox of photographs - to hold on to each other. Add a photo and tell the story behind it. Ask someone a question only they can answer. Send a surprise and catch their face when they see it.
There's no wrong way, and no feed to keep up with. A few memories a year is a treasure. You're never falling behind.
What this is - and isn't
We built it differently on purpose:
For the family member who worries about that sort of thing: there's no company behind this mining it, and no account selling your data. For everyone else, it just means this is a safe, private place that belongs to you.
Learn more
Passing it on
Tips
Help
A diagnostic report holds no memory content, names, or messages - just what the app did and any errors, kept only on this device until you choose to send it.
This app
Shadetree was made by Brian Miller, for his family.
Questions & how-to
Tap any question to open it.
Families, in one minute
A family is a small circle that shares its everyday memories together - just your closest people. You always have "My family". To share with relatives who have their own families - your parents, a sibling - you don't all pile into one big family; you stay separate families and connect. Memories you make go to your own family by default.
How do I add my family?
Go to Me → Your family, tap your family's name, then tap Invite someone. Hand that person the code (show it to them, or send the message). They enter it and they're in - a full member who sees everything shared in your family. That's how you bring in your spouse, your kids, anyone who shares this life with you.
Someone gave me a code - what do I do?
A code is one of two things. An invite welcomes you INTO someone's family - you'll be a full member and see everything shared there. A connect code links your family to theirs while you stay two separate families. Both live on Me → Your family. For a connect code, tap Connect with another family under "Connected families." For an invite to join someone else's family as a member, open Start or join another family of my own at the foot of that page and choose Join with a code. Between relatives, it's almost always connect.
Join, or connect? (the one rule)
This is the thing worth remembering:
- Join only for people who share everything with you - a partner, your kids, another device of your own. They become full members of your family and see all of it.
- Connect for everyone else you love - your parents, your siblings, aunts, uncles, cousins, in-laws. You each stay your own family, with your own private space, and choose what to share across.
Quick test: "Would they see literally everything I post?" Only if they truly share this home → join. Anyone else, even your parents → connect.
How do I stay in touch with aunts, uncles, cousins?
They have their own family; you're not in it and they're not in yours - but you'd like to share the occasional big moment and see theirs. That's connecting. Go to Me → Your family and tap Connect with another family, under "Connected families." It's invitation-only: create a code to hand to a steward of their family, or enter one they gave you. Then each of you chooses how much you want from the other:
- Nothing for now
- Just the "for everyone" memories - the default: birthdays, graduations, the big stuff
- Everything they share there
Your everyday memories stay in your own family. Only what you mark "also share with the wider family" crosses the connection - and no further; it doesn't hop to their connections.
How does sharing a memory work?
Make a memory and it goes to your family by default - one tap. If you're in more than one family, you'll pick which. And if you're connected to other families, you can tick "also share with the wider family" to send that one memory on to them.
Someone just joined - will they see our old memories?
Yes. When you add a new member to your family, your phone automatically re-shares the memories you made for that family, so they arrive with the history instead of a blank page. You don't have to do anything - you'll just see "Syncing" while it catches them up.
Can I use Shadetree on my phone and my tablet?
Yes - the trick is to use your recovery code, not an invite. On the second device, on the welcome screen tap “Already set up before? Restore with your recovery code” and enter it. That makes the tablet the same you, sharing one identity across both devices.
Don't set the tablet up as a brand-new person and join with an invite code - that creates a second, separate “you” in the family (two names the same). If that already happened, a steward can fix it: go to Me → Your family, tap your family's name, open Members, find the copy that isn't marked “this device,” and tap Remove.
What's a steward?
A steward is someone who helps run a family - they can invite new members and remove ones who don't belong. Whoever founds a family is its first steward, and any steward can make another member a steward too (Me → Your family, tap your family's name, then Members). It's just a way to share the load; nobody can remove the founder.
How it works
The short version: your memories are encrypted on your device before they ever leave it, and our server only ever handles locked boxes it can't open. Here's the honest detail, for anyone who wants it.
Your keys stay on your device
When you set up, your device creates a pair of cryptographic keys. The private one never leaves your phone - we never see it, and we couldn't hand it over even if someone forced us to.
Every memory is locked before it's sent
When you share a memory, your device encrypts it with a fresh key, then locks that key individually for each person you're sending to, using their public key. Only their device can unlock it. Our server relays the locked result and never sees what's inside.
Tampering shows up
Each memory is signed by the sender. If anything changed in transit, the recipient's app would notice and flag it - so you know a memory really came from who it says, unaltered.
The server forwards; it doesn't hoard
Encrypted memories pass through on the way to your family and are removed once delivered. No accounts, no passwords kept with us, no analytics, no third-party trackers, no ad networks. To actually deliver a memory, the server does keep a little readable information: the name and photo you chose, who's in your family, and the outside of the envelope for each memory (who sent it to whom, and when) - never what's inside. It also keeps a backup of your keys, itself locked under a recovery code that only you hold. The full, plain-language list is in our Privacy Policy.
If you ever need to report something
We cannot read what you save, and that does not change when something goes wrong - there is no key on our side to reach for. So if you report a memory to us, nothing is taken from your phone automatically. The report is written into your own email app, where you can see every word before you send it, and you choose whether to include what the memory says. Photos, video and voice recordings are never included; if we need to see one, we ask you. We can stop a person or a whole family reaching you, and stop them using Shadetree at all - but we cannot delete a memory that has already arrived on somebody's phone, and we will not pretend otherwise.
You can always walk away with everything
Export a full, self-contained copy of your memories anytime. It opens on its own, with no app and no internet. If we vanished tomorrow, your memories wouldn't.
What it is - and isn't
This is a small, private tool made for families, not a bank or a government system. The encryption is real and standard, but the app hasn't been through a formal third-party security audit, and its safety leans on you inviting only people you actually know - which is why joining is invitation-only, in person. Treat it as a heartfelt place for family memories. That's exactly what it is.
Who built it, and how
Shadetree was made by one person - Brian Miller, a K-12 educator - in the evenings, over months. There is no company and there is no team.
Much of the code, and a good deal of the writing, was worked out in a long collaboration with Claude, an AI assistant made by Anthropic. That is worth saying plainly, because you have every right to know how a thing was built before you trust it with something precious.
It has nothing to do with what you keep here. No memory of yours has ever been seen by an AI, or by anyone at all except the people you sent it to. That isn't a promise about how careful we are - it is how the thing is built. Everything is locked on your phone before it goes anywhere, and there is no key on our side to change our minds with.
Terms & Privacy
Last updated: July 23, 2026
Shadetree is operated by Brian Miller ("we," "us," "our"), in Indiana, USA. By using Shadetree, you agree to the terms below. If you do not agree, please do not use it.
Shadetree is a free, private place to keep and share family memories. We built it with care, but it is provided as-is, with no guarantees. It is not a backup service - the only safe copy of your memories is the one you export and keep yourself. Please read on.
Terms of Use
1. It's free (for now). Shadetree is currently free to use. We may add optional paid features later, and we may change, add, or remove features at any time. We do not promise that any particular feature will remain free or available.
2. As-is, no warranty. Shadetree is provided "as is" and "as available," without warranties of any kind, express or implied. We do not guarantee that it will work, be available, be error-free, or that your memories will be stored, delivered, preserved, or recoverable.
3. You use it at your own risk. Digital data can be lost - through a lost or damaged device, software problems, failed uploads, the service being unavailable, or other causes. You accept that risk when you use Shadetree.
4. Back up your own memories. Shadetree is not a backup service. The reliable, lasting copy of your memories is the export you make yourself (Me › Export your archive) and keep somewhere safe. Keep your recovery code somewhere safe too - without it, a lost or wiped device cannot be restored, and no one, including us, can recover your account or memories for you. Any loss that results from not keeping your own backups or recovery code is your responsibility.
5. Strong encryption means we cannot recover it. Your memories are encrypted so that only the people you share them with can read them - not us. That privacy is the whole point, but it has a trade-off: if you lose your keys or recovery code, your data cannot be recovered by anyone. This is by design.
6. Limitation of liability. To the fullest extent permitted by law, we are not liable for any damages of any kind arising from or related to your use of Shadetree - including, without limitation, lost or corrupted memories, lost or damaged devices, failed backups or transfers, downtime, or the service being changed or discontinued - even if we were advised such damages were possible. To the extent any liability cannot be excluded, our total liability to you is limited to the amount you paid us, which for a free service is zero.
7. We may change or stop the service. We may modify, suspend, or discontinue Shadetree, in whole or in part, at any time, without notice and without liability to you.
8. Acceptable use and enforcement. Shadetree is for personal, family, and lawful use only. Do not use it to break the law, harm others, or interfere with the service or other people's use of it. Because your memories are encrypted end to end, we cannot see or screen what people share; even our own relay only ever holds locked data it can't read. So our ways of dealing with misuse are limited to what we can do without reading anyone's memories: if we have good reason to believe an account or a family is being used unlawfully or to harm others, we may remove that person's or that family's access to the relay and delete the data they hold on it. We cannot selectively review or edit content, and copies already delivered to someone's device are beyond our reach. We cooperate with valid legal requests, and where the law requires it we report unlawful material to the proper authorities. If you become aware of misuse, please tell us at hello@theshadetree.co. Because only the people a memory was shared with can read it, describe what you saw (and, if you choose, include what you received) so that we can act on it.
9. Your content is yours. You keep all rights to the memories you create. You are responsible for what you share and for having the right to share it.
10. Indemnification. You agree to defend, indemnify, and hold us harmless from any claims, losses, or costs arising out of your use of Shadetree or the content you share.
11. Changes to these terms. We may update these terms from time to time. If we do, we will change the date at the top. Continuing to use Shadetree after a change means you accept it.
12. Governing law. These terms are governed by the laws of the State of Indiana, USA, without regard to its conflict-of-laws rules. If any part of these terms is found unenforceable, the rest still applies.
Privacy Policy
We built Shadetree so that we cannot read your memories, and so that we collect as little else as we possibly can. Here is exactly what that means, in plain terms: what we never see, what we have to keep for the app to work, what you can choose to add, and what never leaves your device at all.
What we never see or store.
- The inside of your memories. Your photos, videos, voice notes, the words you write, and even a memory's title are encrypted on your device before they ever leave it. They can be opened only on your device and the devices of the people you share with. We cannot read them, and neither can our hosting company.
- Your recovery passphrase, if you choose email recovery (below). It never leaves your device.
- We run no ads, no trackers, and no analytics that follow you, and we never sell or share your data. There is no advertiser and no data broker anywhere in this.
What we have to keep for the app to work. A few things cannot be locked away, because the server needs them to carry a memory to the right people. We keep them to a minimum, and we would rather tell you plainly than pretend they aren't there:
- The name and photo you choose for yourself, along with your device's public keys. These let your family see who a memory is from. They are stored in readable form and stay until you or your family's steward removes your device.
- Who belongs to a family, and which families have chosen to connect. This is how a memory reaches the right circle and no one else.
- The outside of the envelope for each memory on its way: which device sent it, which devices it is headed to, and when. We can see that you sent something to someone at a certain time. We cannot see what is inside. The encrypted memory itself passes through and is deleted once everyone has received it, or within about 21 days at the latest.
- A backup of your keys, so a lost phone doesn't mean a lost account. It is the keys only, never your memories, and it is locked with your recovery code, which only you hold. We keep the locked box and cannot open it.
Being straight with you: added together, the readable parts above come to your chosen name and photo, the shape of your family, and a record of who shares with whom and when. If our server were ever broken into, that is what could be exposed. Your actual memories would stay unreadable.
What you can choose to add. Email recovery is optional. If you turn it on, you give us an email address so that an email and a passphrase can bring you back if you ever lose both your device and your recovery code. When you set it up or use it, your email is turned into a one-way fingerprint. We store only that fingerprint, never the address itself, and we cannot turn it back into your email. Your passphrase never reaches us. To be sure the address really is yours, we send it a one-time verification code when you turn the feature on - that is the only email we ever send you, and we never use your address for anything else. Turning the feature off removes the fingerprint. If you skip it, we hold no email for you at all.
What never leaves your device. Your private keys, your full library of memories, your favorites and the way you've arranged things, and any exports you make all live on your own device. Uninstalling the app erases that copy.
What we do not do. No ads. No tracking. No analytics that follow you. No selling or sharing your data with anyone. There is no advertiser and no data broker in the picture.
Service providers. Our relay runs on standard web hosting. That provider only ever handles the encrypted and routing data described above; it cannot read your memories either. If you turn on email recovery, an email delivery service sends your verification code for us, and your email address passes through them to reach you. No memory, name, or anything about your family goes with it.
Children. Shadetree is set up and controlled by adults. A child only ever takes part through a device that an adult in their family has set up and looks after, and that adult is responsible for the child's use and agrees to these terms on their behalf. Shadetree is not directed to the general public or to children under 13 as a public service, and we do not knowingly collect personal information from a child directly. The relay only handles the readable directory and routing information described above, and cannot read the content of anyone's memories.
Keeping and deleting your data. Memories in transit are deleted after delivery, or within about 21 days at the most. The readable directory and routing information above stays until it is removed. Uninstalling the app clears only the copy on your device. To also remove your device, name, and key backup from our relay, email us and we will erase them. A family steward can also remove your device from the family.
Changes. If this policy changes, we will update the date at the top.
Contact. Questions about these terms or your privacy? Email hello@theshadetree.co.
These terms are written to be clear and fair, not to trick anyone. They are not legal advice.
What’s new
The latest changes to Shadetree, in plain language.
Make a photo book
Choose some memories and Shadetree lays them out as a little book. Save it as a PDF and print it at home, or take it to any photo-book service - it's yours to keep, and to give. Free, always.
