I don't store their emails, I use forwardemail.net and they have a pretty reasonable privacy policy: https://forwardemail.net/en/privacy

Some people in my family use it as their main address, others don't, it's entirely their call.

But yes, ultimately I control the domain and could be nefarious if I wanted to. But there's a certain baseline level of trust as a family, I'm reasonably certain my wife won't poison the milk in the fridge and she's reasonably certain I'm not going to read her emails.