Privacy policy
This is a private register for one family. In plain words: what we keep, who can see it, and what you can change.
- Private by defaultContact details and birth dates of the living start private.
- Your choiceYou decide who sees each part of your record.
- Never soldNo advertising, no profiling, no trackers.
- Not in search enginesProfiles, the tree and the directory are kept out of search engines.
What we keep
- Your account: user name, name, email address or mobile number, language and time zone. Passwords are stored only in scrambled (hashed) form.
- The family register: names, dates, places, family links and the sources behind them, and a photo where permission was given.
- What you do here: suggested changes, messages, help requests, pledges and event sign-ups.
- Donations: the amount, currency and reference. Card and bank details stay with the payment provider; we never see or store them.
- A record of changes: an audit log of approvals, settings, money events and views of sensitive documents, so every decision can be checked later.
Who can see a record
- PublicAnyone, including visitors. Never used for a minor.
- MembersRelatives whose request to join was approved.
- BranchMembers of the same family branch.
- PrivateThe person, their guardian and the administrators who review records.
A record you are not allowed to see does not appear anywhere for you — not in search, counts, the tree or downloads.
Starting settings for each part of a record
Each part of a record has its own setting. These are the starting points; the person (or their guardian) can change them.
| Part of the record | Living, or not known | Deceased |
|---|---|---|
| Phone and email | Private | Private |
| Birth date and place | Private | Members |
| Where they live | Members | Members |
| Photo (only with permission) | Members | Members |
| Biography, education and work | Members | Members |
When we do not know whether someone is alive, we treat them as living.
-
Children and relatives without a login
- A minor’s record is never public, and its details stay within their branch at most.
- Relatives without their own email or phone can be added by a guardian, who manages their record until handing it over with a one-time link.
-
Photos and documents
- A photo is shown only when permission to display it has been recorded.
- Uploaded files are checked, stored under random names and opened only for people allowed to see them.
-
Emails and text messages
- Notification emails carry only a short title and a link — never the private details behind them.
- Text messages carry only one-time codes. There is no marketing.
-
Cookies
- Only what the site needs: one to keep you signed in, one that protects forms, and one that remembers your language.
- Your light or dark theme is remembered in your own browser. There are no analytics or advertising cookies.
What you can do
- Change who sees each part of your record, at any time, from your privacy settings.
- Correct your own details directly, or suggest a change to names, dates and family links for a reviewer to check.
- Hide your profile from other members.
- Download a copy of the information this site holds about you, from your account settings.
- Close your account yourself, from your account settings.
Hiding, closing and deleting
Hiding takes your profile out of view. Closing your account removes your login, your email address, your mobile number and the names on the account, and ends your membership.
Neither erases history: the record that a person lived and how they are related stays in the register for the family, and can be changed only through review.
Donation records (including any receipt email you gave), the suggestions you made and the audit log are kept, so the family’s records can always be checked.
What is cleared, and when
- A request to join that was not approved or was withdrawn loses its contact details, address, the relatives and reference you named, and any document 365 days after the decision.
- The document sent with an approved request to join is deleted 365 days after the approval.
- Notifications you have read are deleted after 180 days.
- An account that was never confirmed and never used is deleted after 90 days.
- The document attached to a closed help request is deleted 365 days after it closes.
Keeping it safe
The site is served over an encrypted connection. Passwords are stored only in hashed form; one-time codes expire after ten minutes; sign-in, sign-up, password reset, search and contact requests are rate-limited; and each permission is checked on the server, not only hidden on the page.
Questions and requests
To ask about your information, correct something, or raise a concern about how it is handled:
Ask a site administrator. Signed-in members can also use “Report” on a person’s profile, a notice, a help request or a conversation.
Changes to this policy
When the way the register handles information changes, this page is updated, with the date of the change shown at the top.