Privacy Policy

Last updated: 16 August 2026

Who we are

Family Tree (familytree.fit) is operated by Alan Davis, an individual based in the United States. You can reach us at hello@familytree.fit with any question about this policy or your data, and we will respond within 30 days.

What we collect

Two different things, and the distinction matters:

Your account. An email address and an encrypted password hash. We never see or store your password itself.
What you put in your tree. Names, dates of birth and death, places, occupations, relationships and free-text notes — for yourself and for anyone else you add.

We do not use analytics, advertising, tracking pixels, or third-party cookies. The only data stored in your browser is your tree (when signed out), your login session, and any attachments you add.

About the other people in your tree. A family tree is unusual: most of the personal information in it describes people who are not you and who never agreed to be listed. Details about people who have died carry far fewer legal restrictions than details about the living.

Please think before adding dates of birth, addresses, health information or photographs of living people, particularly children — and especially anything a relative would object to. If someone asks to be removed from your tree, please remove them. If they contact us directly we will pass the request on to you.

Where your data is stored

Your trees are held in a Postgres database run by Supabase, on servers in Canada (AWS ca-central-1). We operate from the United States, so if you are outside Canada your information is transferred and stored there.
The website itself is served by Cloudflare, which processes standard web request logs.
Photos, video, audio and documents you attach stay on your own device, in your browser's storage. They are not uploaded to us and we cannot see them. They are also not encrypted there, so anyone with access to your computer account can open them — and they will not appear if you sign in from a different device. Use Export to carry them elsewhere.

Supabase and Cloudflare act as our processors: they hold data on our behalf and do not use it for their own purposes.

How it is protected

Encrypted in transit (HTTPS/TLS) and at rest (AES-256).
Database access is enforced per-account by Postgres row-level security, so one account cannot read or write another's trees — this is enforced by the database itself, not merely by the app.
We can see your data. As the operator, we hold administrative database access, used only to keep the service running or when you ask for help. We do not read trees casually, sell data, or share it with anyone except the processors listed above.

Why we process it

We use your email address to operate your account — signing you in, confirming your address, resetting your password. We store your tree because storing it is the service you came for.

We do not sell your personal information, share it for cross-context behavioural advertising, or use it to train machine learning models. Information you record about other people is entered by you and processed under your direction; you decide what goes in.

If you are in the UK or EU, we rely on our agreement with you for account data and on your consent for tree contents — consent you can withdraw at any time by deleting your account.

How long we keep it

Your data stays until you delete it. Delete a tree and it goes, along with everyone in it. Delete your account and everything goes — every tree, person, relationship and attachment record.

We hold no database backups. Deletion is therefore immediate and final: there is no archived copy anywhere, and we cannot restore anything afterwards even if you ask us to.

That is good for your privacy and unforgiving of mistakes. Use Export to keep your own copy of anything you would be sorry to lose.

Your rights

See your data — it is all visible in the app.
Correct it — edit any person at any time.
Take it with you — Export downloads a complete tree as a standard JSON file, attachments included.
Erase it — Delete account is in the menu beside your email address, and removes everything.
Ask or complain — email hello@familytree.fit. Depending on where you live you may also complain to a regulator: your state Attorney General in the US, the ICO in the UK, or your national data protection authority in the EU.

We offer these to everyone, wherever you live, rather than only where a law compels it. We will not refuse you service or treat you differently for exercising any of them.

Children

Accounts are not intended for anyone under 16, and we do not knowingly collect personal information from children under 13. If you believe a child has created an account, email us and we will remove it.

Note this concerns account holders. Children may of course appear in a tree that an adult builds, and the caution above applies to them with particular force.

Changes

If this policy changes materially we will update the date at the top and, where the change affects how your data is used, notify you by email.