f-tree

HomePrivacy

No account, no server, no analytics

f-tree keeps your family on your device. This page is the specific version of that sentence: what stays put, what can touch a network, and where the limits are.

What stays on your device

Everything you enter: names, dates, photographs, notes and the relationships between people. There is no account to attach it to and no server to send it to. The Android app keeps it in a private database; the desktop apps keep it in the .ftree file you chose.

There is no analytics, crash reporting or advertising in either app or on this website. The desktop window is refused the network outright, which is why its typefaces are read from disk rather than fetched. This website’s fonts are hosted on the same site too.

What can reach a network

Three things, all optional and all started by you:

  • The update check. Off until you switch it on in Settings. It asks GitHub for the newest release and verifies the SHA-256, package name and signing certificate before offering anything.
  • The book-template check. Off until you switch it on. It downloads designed book templates from a signed catalogue.
  • Nearby sharing. Off until you switch it on. It talks only to a device on the same Wi-Fi. The handshake is encrypted, both screens show the same six digits, and the receiver must accept before anything is stored.

Everything a received file does goes through the normal import review, which backs up your tree first.

This website calls GitHub’s public API from your browser to show the current version and file sizes. It has no analytics script and sets no cookies.

Every Android permission, and why

The app declares eight. Two are asked for at the moment you use the feature that needs them, and neither is requested otherwise. There is no location, contacts, storage or microphone permission.

  • INTERNETOnly for the update check, the book-template check and nearby sharing on your local network. The first two are off until you switch them on.
  • REQUEST_INSTALL_PACKAGESLets f-tree hand an update you have approved to Android’s installer. It checks the file’s SHA-256, package name and signing certificate first.
  • ACCESS_NETWORK_STATELets the app tell whether a network is available.
  • ACCESS_WIFI_STATEUsed by nearby sharing to see the Wi-Fi network you are on.
  • CHANGE_WIFI_MULTICAST_STATEUsed by nearby sharing to find another device on the same Wi-Fi.
  • RECEIVE_BOOT_COMPLETEDLets birthday reminders survive a restart, if you have switched them on.
  • CAMERA (asked at the time)Asked for only when you scan a nearby-sharing QR code. Never used otherwise.
  • POST_NOTIFICATIONS (asked at the time)Asked for only when you switch birthday reminders on.

The limits, stated plainly

  • No encryption by f-tree itself. It relies on your device’s protection, such as Android’s device encryption and your lock screen. Anyone with your unlocked phone can open the app.
  • An exported .ftree is a plain ZIP, on purpose, so you can always read your own family. Treat the file as you would any private document.
  • The Windows installer isn’t code-signed. A checksum catches a corrupted or tampered download, not a compromised release. Only code signing fixes that, and it hasn’t been done yet.

Check it yourself

  • The source is on GitHub under the MIT licence. The network code is confined to the update and nearby packages.
  • Every release file is built by GitHub Actions from a tagged commit, and its SHA-256 is published by GitHub. The download page shows how to compare it.
  • Found a problem? The security policy explains how to report it privately. Reports are acknowledged within 7 days.

Your family, on your device

Free, open source, and nothing to sign up for.

Download f-treeSee all features