Privacy Policy

Last updated: 28 August 2026

Who we are

Family Tree (familytree.fit) is operated by Alan Davis, an individual based in the United States. You can reach us at hello@familytree.fit with any question about this policy or your data, and we will respond within 30 days.

What we collect

Two different things, and the distinction matters:

Your account. An email address and an encrypted password hash. We never see or store your password itself.
What you put in your tree. Names, dates of birth and death, places, occupations, relationships and free-text notes — for yourself and for anyone else you add.

We run no analytics scripts in your browser — no advertising, tracking pixels, or third-party cookies either. The only traffic numbers we look at are the aggregate statistics Cloudflare derives from the request logs it already keeps as our host (visit counts, pages, countries — never tied to your account by us). The only data stored in your browser is your tree (when signed out), your login session, and any attachments you add.

If you share a tree. Inviting someone gives them a genuine copy of the access you choose — view or edit — to everything in that tree: every person, every date, every note, and every attachment, including ones added by other people. There is no way to share part of a tree.

If you share a view. A view is your own lens on a tree — which relatives it folds away, and the order it draws family names in. Sharing one does not widen what the other person may see of the tree itself; they already had that from being a member. What it does hand over is your choices: the set of people that view hides, the name you gave it, and the surname order it draws by. Give someone edit access to a view and they can change all three — for you and for everybody else on it. Anyone in the tree can also see who holds a view, though not what a view they are not on contains.

They will also see your name, and so will anyone else in the same tree. That is the name you enter when you create your account, or the first part of your email address if you leave it blank; you can change it at any time under your email address in the app. Nobody in a shared tree is shown your email address by us.

While a shared tree is open, the other people in it can see that you have it open, under the same name, and which person you currently have selected. Their changes appear on your screen as they make them, and yours on theirs. This is live only: it is not written down, and it disappears the moment you close the tab. Nobody outside the tree can see it.

Most of what you would be sharing is information about other people, most of whom did not agree to any of it. Please have their interests in mind, not only your own, and re-read the note above before inviting anybody.

About the other people in your tree. A family tree is unusual: most of the personal information in it describes people who are not you and who never agreed to be listed. Details about people who have died carry far fewer legal restrictions than details about the living.

Please think before adding dates of birth, addresses, health information or photographs of living people, particularly children — and especially anything a relative would object to. If someone asks to be removed from your tree, please remove them. If they contact us directly we will pass the request on to you.

Where your data is stored

Your trees are held in a Postgres database run by Supabase, on servers in Canada (AWS ca-central-1). We operate from the United States, so if you are outside Canada your information is transferred and stored there.
The website itself is served by Cloudflare, which processes standard web request logs. The aggregate traffic statistics mentioned above are derived from those same logs — nothing extra runs in your browser to produce them.
Photos, video, audio and documents you attach are end-to-end encrypted. If you switch encrypted attachments on, they are scrambled inside your own browser before being uploaded, and we store only the scrambled version — including the filename and any caption. We do not hold the key and cannot produce your files for anyone, ourselves included. Until you switch it on, attachments stay on the device that made them and are not uploaded at all. A copy stays on your device either way, unencrypted, so anyone with access to your computer account can open them there.
Backups. Supabase takes a daily backup of the database and keeps the most recent seven days. We also keep our own nightly copy at Cloudflare, in North America, for thirty days. The database copy we make is encrypted before it leaves us, with a key Cloudflare never holds. Attachments are copied in the same scrambled form they already have — so a backup of your photographs is no more readable, to us or to anyone storing it, than the originals are.

Supabase and Cloudflare act as our processors: they hold data on our behalf and do not use it for their own purposes. So does Anthropic, but only for members who have switched on the assistant described below — if nobody has, nothing of yours ever reaches them.

How it is protected

Encrypted in transit (HTTPS/TLS) and at rest (AES-256).
Database access is enforced per-account by Postgres row-level security, so one account reaches only the trees it owns or has been invited to, with exactly the access it was given — this is enforced by the database itself, not merely by the app. A viewer cannot write, whatever their browser is persuaded to send.
Invitation links carry the key, and we never hold it. When you invite somebody to a tree with encrypted attachments, the key is sealed inside the link itself and only a fingerprint of it reaches us. We could not hand your attachments to the person you invited, let alone to anyone else. It also means an invitation link is worth guarding: while it is unused, whoever opens it joins. Links expire, and you can cancel one that has not been used.
We can see your trees. We cannot see your attachments. As the operator we hold administrative database access — enough to read the names, dates and relationships you record, used only to keep the service running or when you ask for help. We do not read trees casually, sell data, or share it with anyone except the processors listed above. Encrypted attachments are a different matter: administrative access does not help, because the key is derived from your password and never reaches us.

What encrypting your attachments costs you. Because we hold no key, we cannot help you recover files if you lose the means to open them. That is not a policy we could soften — it is the same fact that stops us handing your photos to anybody else.

When you switch it on we show you a one-time recovery code and ask you to type it back before any upload is allowed. It is the only way back in after a password reset. Lose both your password and that code, and the uploaded copies of your attachments are gone permanently. The copies on your own device are unaffected, and Export takes a full readable copy at any time.

Removing someone's access is not retroactive. Removing a person from a tree deletes their key and stops them fetching anything new, immediately. It cannot reach a device they have already downloaded to, and no design could. Treat anything you have shared as shared.

Anything they added while they were there stays in the tree, and so does anything they added that later gets deleted from their own account — their contributions belong to the tree, not to their membership of it.

Why we process it

We use your email address to operate your account — signing you in, confirming your address, resetting your password. We store your tree because storing it is the service you came for.

We do not sell your personal information, share it for cross-context behavioural advertising, or use it to train machine learning models. That covers the assistant too: Anthropic's terms for the interface we use say that by default they will not use inputs or outputs from their commercial products to train their models, and we have not opted out of that default. Information you record about other people is entered by you and processed under your direction; you decide what goes in.

If you are in the UK or EU, we rely on our agreement with you for account data and on your consent for tree contents — consent you can withdraw at any time by deleting your account. We keep backups on the basis of our legitimate interest in not losing your records, and we use the assistant only where you have switched it on, which is your consent and is withdrawable in the same place.

Asking Claude for help with a tree

You can switch on an assistant, built on Claude by Anthropic, that answers questions about a tree and makes changes you ask for. It is off until somebody turns it on, and it takes two separate decisions to reach you:

the tree's owner decides whether it may be used on that tree at all, and by whom;
you decide, on your own account, whether you use it. Declining does not stop anyone else in that tree using it on theirs, and it does not stop them making changes you will see.

When you use it, the parts of the tree needed to answer you — names, dates, relationships, and whatever you type — are sent to Anthropic, processed, and returned. For a member who has not switched it on, nothing is sent. Attachments are never sent: they are encrypted and we could not read them to send them even if we wanted to.

Looking things up on the web is a separate switch, and it is off by default. With it on, the assistant can search the open web about a person in your tree — which means that person's name and details leave our systems and reach a search engine.

Please think particularly hard before using it on someone living, who never agreed to be in your tree, let alone to being looked up. Whatever it finds is shown to you with its source, and nothing found on the web is written into your tree unless you accept it. Treat what it finds as a lead to check, not a fact: it can be confidently wrong, and a wrong date in a family tree gets inherited by everyone who reads it afterwards.

How long we keep it

Your data stays until you delete it. Delete a tree and it goes, along with everyone in it and every uploaded attachment belonging to it — for everyone it was shared with, too. Delete your account and everything goes: every tree you created, every person, relationship and attachment in them, scrambled copies included.

Deleting your account does not reach into trees that belong to other people. If you contributed to a tree someone shared with you, what you added stays where it is and stops being connected to you; your access to it ends. We would rather leave a stranger's family tree intact than quietly take pieces out of it on your way past.

We now keep backups. We used to keep none, and said so here. That changed on 28 August 2026. Holding nothing was the more private choice and we meant it — but one mistake on our side is all it takes to lose a family's records permanently, and we came to think that was the worse risk to be carrying on your behalf.

When you delete something. It goes from the live service straight away, and out of the backup copies within a month. We do not use a backup to bring back anything you have deleted: backups exist to recover from our failures, not to undo your decisions.

A backup cannot rescue a lost key. Your attachments sit in every copy exactly as scrambled as they are here, so if you lose both your password and your recovery code, the backup is as unreadable as the original. That is the same fact that stops us handing your photographs to anybody else, and it does not bend.

Export is still the only copy that is yours rather than ours. Use it for anything you would be sorry to lose.

Your rights

See your data — it is all visible in the app.
Correct it — edit any person at any time.
Take it with you — Export downloads a complete tree as a standard JSON file, attachments included.
Erase it — Delete account is in the menu beside your email address, and removes everything from the live service at once. Backup copies cycle out within a month and are never used to bring back what you deleted.
Ask or complain — email hello@familytree.fit. Depending on where you live you may also complain to a regulator: your state Attorney General in the US, the ICO in the UK, or your national data protection authority in the EU.

We offer these to everyone, wherever you live, rather than only where a law compels it. We will not refuse you service or treat you differently for exercising any of them.

Children

Accounts are not intended for anyone under 16, and we do not knowingly collect personal information from children under 13. If you believe a child has created an account, email us and we will remove it.

Note this concerns account holders. Children may of course appear in a tree that an adult builds, and the caution above applies to them with particular force.

Changes

If this policy changes materially we will update the date at the top and, where the change affects how your data is used, notify you by email.