Privacy

The short version

Your family is yours. We treat genealogical records as the most sensitive thing on the site, and we go out of our way not to send them anywhere they don’t need to go.

• The public demo at /explore parses your GEDCOM file entirely in your browser. The file contents never leave your machine.
• We use Google Analytics 4 to understand traffic — page views, CTA clicks, and bucketed funnel events. We never send your ancestors’ names, your file contents, or your email to the analytics layer.
• For authenticated users, your account, tree, and uploaded media live on Google Cloud servers we operate. We don’t share that data with third parties.

What analytics actually collects

When you accept analytics (or visit from a region where consent is implicit), Google Analytics 4 records standard web-analytics signals: page paths, referrers, session duration, country, browser, device class, and a randomly assigned client identifier.

On top of that we send a small set of product events to understand the funnel:

• Which CTA you clicked on the landing page (demo or waitlist)
• Whether you opened the demo and which source you picked (sample data or your own GEDCOM)
• A bucketed person count when a GEDCOM finishes parsing (e.g. “100–499 people” — never the exact number)
• A bucketed engagement duration when you leave the demo
• For signed-in users: when you registered, completed an onboarding step, or finished a GEDCOM import

For signed-in users, we identify you in analytics with a salted SHA-256 hash of your account ID. The raw account ID never leaves the server.

What we don’t collect

• Your GEDCOM file or any of its contents
• The names, birth/death dates, or biographical details of any person in your tree
• Your email address (we don’t send it to analytics; we do, of course, store it for your account)
• Your IP address in any analytics destination we control (GA4 hashes it; we never store it)

Cookies

With consent, GA4 sets two cookies: _ga (a 2-year visitor identifier) and _ga_* (a session identifier). We don’t set advertising cookies, and we explicitly tell GA4 not to enable ad personalization.

We also store your consent choice in localStorage so you don’t see the banner on every visit. Clearing your site data from the browser will resurface the banner.

Opting out

From the EU, EEA, UK, or Switzerland, the consent banner is opt-in: nothing is loaded until you click Accept. From other regions, analytics is on by default with an opt-out — clear the av:analytics-consent entry in your browser’s site data, and on next visit choose Decline.

We’ll add a one-click opt-out toggle on this page in a later iteration.

Contact

For data requests or questions about this notice, write to the project maintainers via the project site.