I don't store their emails, I use forwardemail.net and they have a pretty reasonable privacy policy: https://forwardemail.net/en/privacy

Some people in my family use it as their main address, others don't, it's entirely their call.

But yes, ultimately I control the domain and could be nefarious if I wanted to. But there's a certain baseline level of trust as a family, I'm reasonably certain my wife won't poison the milk in the fridge and she's reasonably certain I'm not going to read her emails.

How do you manage the bus factor? You die tomorrow and what happens to management of the domain and therefore access to their emails?