Legal
A family archive can include People, Memories, relationships, collections, media, stories, letters, documents, voice recordings, dates, locations, invitations, activity, comments, and subscription records. User accounts are separate from Person records, so an archive may include relatives who never create an account.
Archives are private by default. Access is based on authenticated User accounts, Archive membership, role, record visibility, and explicit grants for Limited Viewers. Viewers can be free while subscriptions scale storage, contributors, and premium features.
Subscriptions belong to Archives. A failed payment may eventually make an Archive read-only, but existing authorized family content should remain viewable unless a separate privacy, safety, legal, or deletion rule applies.
Product analytics and support tooling are designed to use privacy-safe metadata. Private family content, raw media URLs, story bodies, comments, filenames, and tokens should not be copied into analytics or support records by default.
PhotogenXX is architected for privacy requests, exports, correction, account deletion, and archive deletion workflows. These workflows require identity and authority checks because account deletion is not the same as deleting a shared family Archive.