Updated October 18, 2026

Built to respect the family information you share.

Reunion Portal combines private family spaces with controls for identity, family membership, content visibility, and subscriptions. Security is ongoing work, so we describe the safeguards the service actually uses and avoid promises no online service can make.

Account protection

Sign-in includes password verification, failed-attempt lockout, protected authentication cookies, expiring server-side sessions, and session revocation after security changes. People may add authenticator-app two-step verification and receive recovery codes. Sensitive account changes can require the current password or an additional verification code.

Family boundaries

A person must have an active membership to enter a private family space. Roles and permissions are assigned per family, so access in one family does not grant access in another. Ownership transfer uses a dedicated workflow, and a family must retain an owner while other account holders remain. A Super Admin role does not by itself grant private family-data access.

Content and messaging

Profile visibility, family membership, content-sharing selections, and feature permissions limit access to family profiles, events, media, recipes, updates, and messages. Messaging includes participant checks, reporting controls, attachment validation, and user data export. People should still avoid placing passwords, payment credentials, government identifiers, or unnecessary sensitive information in family content.

Deliberate sharing and local drafts

Some features intentionally share outside the signed-in family space, including public recipes and expiring guest-gallery links. Treat an active guest link as access to its selected media. Recipients can forward it or keep downloaded copies. Revoking a link stops future use of that link, not copies already held elsewhere.

Unsent message text can be saved in local browser storage so it can be restored. Some preferences also remain between visits. Sign out on shared devices and review whether local drafts or site data should be cleared. Session and local browser storage are not a substitute for protecting access to the device itself.

Financial permissions and records

The hub checks adult eligibility and the relevant permissions before fund actions. Fund audiences, managers, receipt reviews, and expense approvals are distinct from ordinary membership. One-time contributions are sent directly through the organizer's shared Venmo profile link and confirmed manually by an organizer. Reunion Portal does not verify ownership of that account, obtain automatic payment confirmations, or hold the money. Recorded balances are application records, not available bank or Venmo funds.

Infrastructure and providers

Production traffic uses encrypted HTTPS connections. SmarterASP hosts the web applications, database, and outgoing email; Cloudflare provides DNS, delivery, and security services; Stripe processes platform subscriptions; and Google Maps supports optional map and address functions. Venmo handles contributions outside the hub under its own terms and privacy practices. Application secrets are supplied through protected deployment configuration rather than public source files.

Monitoring and response

We keep bounded authentication, authorization, delivery, administrative, and operational records to investigate failures and suspicious activity. We may revoke sessions, restrict an account, disable a feature, or preserve information when reasonably necessary to contain an incident, protect people, or comply with law.

What you can do

• Use a long password that you do not reuse on another service.
• Turn on two-step verification and store recovery codes somewhere safe.
• Review family roles, invitations, profile visibility, and message settings.
• Sign out on shared devices and report unexpected access promptly.

Report a problem or security concern

Use the problem report form for an app error. It accepts up to three optional screenshots and explains the limited technical information included. For a security concern, email [email protected] with a concise description. Do not send passwords, authentication codes, card details, exploit payloads containing private family content, or other people’s personal information.

For information-handling details, read the Privacy Notice. No system can guarantee absolute security.