Claims with mechanisms.

Anyone without a death date is treated as living, and living people's details are hidden by default — even from other members of the family — until someone with the authority to decide says otherwise. Unknown never means public.

Visibility is tunable per person and per member, and a deny outranks every other grant in the system, including the family account's own admins.

Living minors are held to a harder line than the rest of the tree. A story that names a living minor is refused outright — it cannot be filed, by a person or by an AI assistant. Photos of living minors are blocked from leaving the family's private space: no share links, no external export paths.

The console we use to run Passage shows counts and metadata — how many people, how much storage — never names, dates, places, relationships, or media. To see a family's tree, we would have to be invited in as a member, like anyone else.

Impersonating a user is disabled in the code itself, not discouraged by policy.

Passage makes zero AI calls. All AI work happens in your own assistant, connected by you.

If you connect the Claude or ChatGPT you already use, it authenticates as you, reads only what you can see, and files its work as proposals by default. You pay your AI provider directly; nothing for AI appears on your Passage bill.

If a trial ends unconverted or a subscription lapses, the tree is archived — never deleted. Everyone in the family can still sign in, see everything, and take a full GEDCOM or GEDZIP export, free, forever. What pauses is building: edits, uploads, and invitations wait until someone subscribes again.

Full GEDCOM and GEDZIP export works on the trial, on every paid plan, and in the archive state. Your family's history is yours to take with you at any moment, in the standard format every other serious tool reads.