(privacy + your family’s data)

• Your email address, used only to identify your account and to send one-time sign-in codes, alerts about your trees, and a weekly newsletter about your family that you can turn off.
• The demographic details you enter about yourself and relatives: names, dates and places of birth and death, where someone living lives now, and relationships. Where someone lives is shown only to members of their trees, never on a share link or to visitors from another tree.
• Photos and recordings you choose to upload, and when a photo was taken.
• When you add a photo, the names and date saved in it are read on your device, to suggest who’s in it and when it was taken. The photo is uploaded without them, and without where it was taken.
• Activity needed to run the tree: who created an entry, claims, stories, reports, and in-app notifications.
• The days you use ancestree — the date only, not what you looked at — so the site’s owners can see how much it’s used. They go when your account does.
• While you have a tree open, its other members who have it open too see that you’re there and where your pointer is. It’s passed between you as it happens and never stored; people viewing through a share link, or from another tree, don’t see it.
• If you ask to join a tree, or ask a relative on ancestree to invite you, the name and email you give — kept only so a relative or the site owner can answer you, and deleted on request.
• When you ask a relative on ancestree to invite you, a note of your email and when you asked, whoever your relative is, used only to limit how often one address can ask. Your relative’s address is never kept. Notes older than a day, and asks a relative leaves unanswered for 30 days, are deleted as new asks come in.
• If you send a story to the library, the story, its photo and your email: used to send you a copy, to answer you, and to publish it once edited. It’s kept until the library’s editors delete it, which they do on request.
• While a sign-in code is on its way, a cookie holding your email (and your name, if you’re signing up), so the page still asks for the code if you reload it. It’s gone within the hour, or once you sign in.
• If you like a post in the library, a cookie holding a random number, so your like counts once. It says nothing about who you are.
• Google Analytics, on every page: which pages are visited, from where, on what kind of device, and for how long. It sets a cookie to tell one visit from the next. Nothing you enter about your family goes to it, and it never sees who you are on ancestree. The site’s owners use it to see which pages are read. In the European Economic Area, the UK and Switzerland it sets no cookie until you allow it, and runs without one if you don’t.

• Joining a tree is by invite. Every database row is protected by row-level security so only members of your tree can read it.
• The site’s owners see each tree’s name and its counts — members, entries, days used — never its entries or who anyone is. For the links they share to start a tree, they see only how many opened each one, signed up and started a tree, never who.
• The site’s owners can suspend an account, which stops it signing in until they restore it, and delete an account or a tree, as its member or Root could.
• Photos and recordings live in private storage and are only ever served through short-lived signed URLs.
• A photo shows in someone’s album only once they, or whoever can edit their entry, approve it.
• Nothing on the tree is public or indexed by search engines, except a story a member shares by its link: anyone with the link can read that story, never its comments. The person it’s about, whoever can edit their entry, or whoever told it can turn its links off.
• A story told aloud in the phone app is heard by the phone’s own speech recognition (Apple’s or Google’s, which may send the sound to them to do it) and written up by Claude, Anthropic’s AI, which also looks in it for births, deaths and relatives to suggest for the tree: what was heard, and the names, births and deaths of the family on your trees around whoever it’s about, go to Anthropic for that alone. Nothing goes on the tree until whoever recorded it has read it over and said yes.
• We never sell or share this data with third parties.

• Only a parent adds their own child under 18 — not a Root, not anyone else. Whoever adds someone who could be a child, or draws a line that makes them one, is asked whether they’re 18 or older. A no, or a date of birth under 18, is refused.
• Only a parent, or the child themselves, can give someone a date of birth under 18 later.
• A Root or a Branch may hold a child’s place instead: a placeholder shown as “First Child”, “Second Child”…, with no name, dates, photo or any other detail. The parent is told, or can be invited to join if they’re not a member yet.
• Only the parent fills a placeholder in. Until they do, nobody else can edit it, suggest a change, claim it, tell a story about it or tag it in a photo, and it never comes up in search.
• Children added by someone else before these rules became placeholders. What had been entered about them is held back, seen only by their parent and the child. The parent chooses what, if anything, the family sees, or deletes it. Nobody else decides.
• A child may be invited to claim their placeholder. It becomes theirs, but stays a placeholder to everyone else until their parent approves showing it.
• The parent can delete their child’s placeholder until the child has claimed it.

• You’re one entry, shown on every tree that brings you in. Your details follow your home tree’s rules, and you choose which tree that is.
• A Root of another tree can bring you over only from a tree they belong to that already shows you. Until you say yes, that tree shows just your name, your place of birth and who you’re connected to — no dates, photo, stories or album.
• You’re told by notice and email, and answer under “Asked of You” in your account’s settings. A no isn’t asked again. Either answer can be changed later; a yes taken back hides the rest again. Asks left unanswered for 30 days lapse, and the rest stays hidden.
• Accepting an invite to a tree, or claiming your entry on it, counts as a yes there.
• For a relative who isn’t a member, whoever looks after their entry on its home tree answers for them.
• A Root may let members of another tree they belong to view their tree, read-only: no stories, album or edits. Tick “Hide my entry from visitors” in settings and those visitors see a blurred card with no name or details.
• A tree’s Roots can take you off it at any time.

• On any tree but your home, you can make your card show only your name, from “Your Entry” in your account’s settings. It’s drawn as a small name tag, still joined to your family there, with no place of birth, dates, photo, stories or album.
• If you’re a member of that tree, you leave it too, and what you added there passes to one of its Roots. A Root can’t leave their own tree this way, and nobody can leave their only tree.
• The tree’s Roots are told. None of them can undo it, and taking your card off and bringing it back keeps it name only.
• Only you can show more again. Your card goes back to your name and place of birth, and showing the rest is still your yes to give.
• A Root may make the card of anyone brought over from another tree name only, unless they’re a member there. The Root can undo that; so can you.

• See your data. A Root can export the full tree as a JSON file on request.
• Correct an entry. Edit your own entry any time, or report a problem with another for the owner or a Root to fix.
• Delete an entry. Ask a Root to remove an entry and its photos and stories.
• Stop relatives asking. Untick “Relatives can ask me to invite them” in your account’s settings, and nobody’s ask for an invite reaches you. They aren’t told you’ve turned it off.
• Delete your account. From your account you can permanently delete your login. Entries you added remain part of the shared family record under a Root’s stewardship, and stories you told stay without your name, unless you also ask for them to be removed.

The tree’s Roots are its data stewards. Reach out to the relative who invited you, or a Root, with any privacy request.