Privacy is an architectural decision

Move trust to the edge

Family histories contain precisely the kind of information that should not become readable merely because a server is curious or compromised. Encrypting before data leaves the device turns that expectation into a system property.

The server can store and synchronise ciphertext without becoming another reader. That is a more useful promise than asking everyone to trust that an administrator will always make the right choice.

Constraints shape the interface

Once the service cannot inspect the records, convenient shortcuts disappear. Search, recovery, sharing, and key handling all need deliberate answers. The interface has to explain those consequences without turning cryptography into homework.

The constraint is productive: it forces privacy decisions into the design instead of leaving them for a settings screen at the end.

Demonstrate the shape, not the secrets

When showing the work publicly, a fictional tree is enough. It communicates relationships, interaction, and visual language without borrowing anybody’s real history.