Disclaimer: I'm not a lawyer, just someone who read the bill a couple of months ago because I was checking to see whether the idea I have in the back of my head for a social media platform was still viable. Heather Burns[0] is an actual lawyer who's a leading authority on this.
The basic principle is that what people do online can have negative consequences in the real world, and the bill basically holds online service operators (such as yourself) at least partially responsible for those negative consequences. Operators need to demonstrate that they're mitigating those consequences risk assessments and policies.
Judging by your profile, you're offering e2ee to family groups, so your intended users are low-risk for sending harmful content. However, your service is freely available to anyone with the app, so it could potentially be used by terrorist organisations, gangs or CSAM sharing groups. e2ee services like this are pretty much the only service that is outright incompatible with the requirements of the bill, so I think you'll be in trouble as soon as Ofcom comes knocking, if they do so. I think the chance of them doing so is small, but that's just my personal opinion, and you will have to make your own decisions.
The family tree and calendar features look like they're low risk, and could be adequately covered by risk assessments, but the file and photo sharing features are also problematic, because (I think) they're encrypted.
You're very unfortunate to be at the intersection of the three factors that could make Ofcom care about you:
* service freely available to the public;
* arbitrary user-to-user communication; and
* no means of checking for harmful conduct on your service.
The only way forward that I can see for you is to make the backend a selfhost-only affair, which would make your UK-based users responsible under the bill.
The basic principle is that what people do online can have negative consequences in the real world, and the bill basically holds online service operators (such as yourself) at least partially responsible for those negative consequences. Operators need to demonstrate that they're mitigating those consequences risk assessments and policies.
Judging by your profile, you're offering e2ee to family groups, so your intended users are low-risk for sending harmful content. However, your service is freely available to anyone with the app, so it could potentially be used by terrorist organisations, gangs or CSAM sharing groups. e2ee services like this are pretty much the only service that is outright incompatible with the requirements of the bill, so I think you'll be in trouble as soon as Ofcom comes knocking, if they do so. I think the chance of them doing so is small, but that's just my personal opinion, and you will have to make your own decisions.
The family tree and calendar features look like they're low risk, and could be adequately covered by risk assessments, but the file and photo sharing features are also problematic, because (I think) they're encrypted.
You're very unfortunate to be at the intersection of the three factors that could make Ofcom care about you:
* service freely available to the public; * arbitrary user-to-user communication; and * no means of checking for harmful conduct on your service.
The only way forward that I can see for you is to make the backend a selfhost-only affair, which would make your UK-based users responsible under the bill.
[0] https://webdevlaw.uk/about/