Privacy Policy

Innovation Dynamics, LLC is the controller of the personal information described in this policy. This policy covers the Treechival website at treechival.com, the family trees and archives hosted on it, our email and SMS notifications, and our keepsake and print ordering.

It does not cover any third-party website you reach from Treechival, or what a family member does with information after they have seen or downloaded it from a tree they legitimately access.

Genealogy is different from most services. A family tree contains information about people who did not sign up, did not agree to anything, and may not know the tree exists — living relatives, in-laws, children, and the deceased. We want to be straightforward about that rather than bury it.

Most of the personal information in Treechival was entered by a family member about someone else. We did not collect it from the person it describes, and in most cases we have no direct relationship with them. Family members who enter information are required by our Terms of Service to do so lawfully and with appropriate consent.

If you appear in a Treechival tree and you did not put yourself there, you still have rights over that information, and you do not need an account to exercise them. See "If You Appear in a Tree and Are Not a User" below.

Information you give us

• Account and identity — the email address you authenticate with, and your display name.
• Family tree records — names, maiden names, gender, dates and places of birth and death, relationships, nicknames, occupations, places lived, notes, stories, and tidbits, for you and for the relatives you record.
• Milestones and life events — marriages, divorces, engagements, and events such as baptism, graduation, military service, or immigration, with their dates and places.
• Archive media — photographs, videos, audio recordings, and documents you upload, together with titles, descriptions, dates, tags identifying who appears in them, and any location or capture metadata embedded in the file.
• Phone number — only if you choose to enable SMS notifications, along with the date and time you gave consent.
• Order information — recipient name, email, phone number, and full shipping address for keepsakes and printed products, plus the contents of your order.
• Communications — the content of support requests, access requests, help requests, addition requests, and nudge messages you send.
• Preferences — notification settings, favourites, follows, and similar choices.

Information collected automatically

• Authentication and security data handled by Cloudflare Zero Trust when you sign in.
• Standard server and edge logs, which may include IP address, user agent, requested URL, timestamp, and response status, kept for security, abuse prevention, and debugging.
• A small number of strictly necessary cookies, described in the Cookies section below.

Information from other people

Other family members may add information about you — your name, dates, photographs, relationships, and stories — and may tag you in media. Where a member record is later claimed by the person it describes, that information becomes associated with their account.

What we deliberately do not do

We do not use Google Analytics or any other analytics package, advertising pixels, tracking cookies, session recording, fingerprinting, or cross-site tracking of any kind. We do not use facial recognition or any other biometric analysis on your photographs, and we do not create biometric identifiers. We do not buy personal information from data brokers, and we do not run DNA or genetic testing of any kind.

We do not ask for sensitive personal information and we do not need it to run the Service. But free-text fields — stories, notes, tidbits, and document scans — can contain it: health or medical history, religious affiliation, racial or ethnic origin, or details of military or immigration history. Where you choose to record such information, we process it only to display it to the authorised family members of that tree, and never to infer characteristics about you or to target you.

Please do not upload government identification numbers, financial account numbers, or medical records for living people. If you find such material in a tree, tell us and we will remove it.

We use only strictly necessary cookies. We do not use advertising, analytics, or tracking cookies, so there is no consent banner and nothing to opt out of.

• CF_Authorization — set by Cloudflare Zero Trust. This is your sign-in session; without it you cannot access any tree. Expires according to Cloudflare Access policy.
• tc_impersonate — set only when an administrator has started a support session viewing the app as a specific user, as described below. Signed, HttpOnly, and expires after 60 minutes.
• Cloudflare security cookies — set by our infrastructure provider to detect bots and malicious traffic and to keep the site available.

We also use your browser's local storage to hold interface preferences and to make the app faster. Family member records are deliberately excluded from persistent browser storage so that data from one family tree cannot leak into another when you switch trees on a shared device.

We use personal information to:

• authenticate you and determine which family trees you may access;
• display the family tree, archive, milestones, and journey map to authorised members;
• store, back up, resize, and deliver the media you upload;
• generate narrative stories and heritage summaries where you use those features;
• send the email notifications you have chosen — digests, nudges, and account and order messages;
• send SMS notifications where you have separately opted in;
• take payment for, produce, and ship keepsakes, and handle returns and support;
• respond to your support, access, and addition requests;
• keep the Service secure, prevent abuse, investigate suspected violations, and debug faults; and
• comply with our legal obligations and enforce our Terms.

Legal bases (where GDPR or UK GDPR applies)

• Performance of a contract — providing the Service you signed up for, and fulfilling keepsake orders.
• Consent — SMS notifications, and any optional feature we describe as opt-in. You may withdraw consent at any time without affecting processing already carried out.
• Legitimate interests — securing the Service, preventing fraud and abuse, maintaining backups, debugging, and communicating essential service information, balanced against your rights.
• Legal obligation — tax and business records for orders, and responding to lawful requests.

We do not use your information for automated decision-making that produces legal or similarly significant effects about you.

When you use a feature that generates a story, a name meaning, a namesake suggestion, or a heritage summary, we send the relevant family details already in your tree — such as names, dates, places, relationships, and any notes attached to that person — to Anthropic's Claude API to produce the text.

• Only the data needed for that specific request is sent. We do not send your whole tree, your archive media, your email address, or your phone number.
• Anthropic processes the request on our behalf as a service provider and does not use the content to train its models.
• The generated text is stored in your tree so it can be shown again without regenerating it.
• These features are optional. You can decline to use them, and you can edit or delete anything they produce.

One AI feature searches the public web. When we look up the meaning of a name and no established etymology is found, we run a second lookup in which Claude searches the web for that name. This is the only AI feature that sends anything outside Anthropic's systems, and it is worth being precise about what it sends:

• Only the name itself is searched — a single first, middle, last, or maiden name. Nothing else about the person goes with it: not their other names, not birth or death dates, not places, not relatives, not photographs, and not any note you have written.
• The search runs on Anthropic's infrastructure, and the name appears to the search provider and to the websites consulted the same way it would if you typed it into a search engine yourself.
• It only runs for uncommon names. A name with a documented origin is answered from the model's own knowledge and is never searched.
• The result is saved to your tree, so a given name is searched once rather than on every visit.

A surname on its own is not by itself identifying, but we treat it as your information regardless. If you would rather no name of yours be searched this way, do not use the heritage features, or contact us and we will disable them for your account.

AI-generated text may be inaccurate. Treat it as a starting point for family storytelling, not as a verified genealogical source.

We do not sell personal information, and we do not share it for advertising or marketing purposes.

With your family

The core purpose of Treechival is to show family information to authorised members of the same tree. Anyone with access to a tree can see the member records, media, stories, and milestones in it, subject to their permission level. Media may additionally be shared into another tree only where a member explicitly chooses to share it; it is never shared across trees automatically.

Service providers

We use the following providers, each receiving only what it needs for its function:

• Cloudflare — hosting, content delivery, Zero Trust authentication, the D1 database, R2 media storage, and Stream video delivery. Cloudflare holds essentially all of the data described in this policy, as our infrastructure provider.
• Anthropic — AI story, name, and heritage generation. Receives only the specific family details needed for a request. For uncommon names it also searches the public web, sending the name alone and nothing else about the person.
• Resend — transactional email delivery. Receives recipient email address, name, and message content.
• Twilio — SMS delivery, only if you opt in. Receives your phone number and message content.
• Stripe — payment processing. Receives your payment details, billing information, and order amount directly; we never receive your full card number.
• Lumaprints and Lulu — printing and production of keepsakes and books. Receive the image or content to be printed, the product specification, and the recipient name and shipping address.
• Shippo — shipping labels and delivery tracking. Receives recipient name and shipping address.
• Library of Congress (Chronicling America), the Digital Public Library of America, and the National Archives — public historical archives searched from the Records page. They receive the search terms you type, such as a family name, place, and year range. Searches of the Digital Public Library of America and the National Archives are made by our servers, which cache the results for up to 24 hours to reduce load on those archives; that cache holds only the search terms and the results returned, is not linked to your account, and expires automatically. The Chronicling America newspaper search is made directly from your browser, which means the Library of Congress receives your IP address. We send no account information, and we keep no other record of these searches unless you choose to save a citation to a family member.

These providers are bound to use the information only to provide their service to us. None of them receives your complete family tree.

Legal and safety

We may disclose information where we reasonably believe it is required by law, subpoena, or court order, or where necessary to investigate fraud or abuse, enforce our Terms, or protect the rights, safety, or property of any person. Where we are permitted to notify you of such a request, we will.

Business transfers

If Innovation Dynamics, LLC is involved in a merger, acquisition, financing, or sale of assets, personal information may transfer as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy, and any acquirer will remain bound by this policy for information collected under it.

We believe you should know exactly who at Treechival can see your data, so we disclose this even though most services do not.

Platform administrators can access the underlying database and media storage in order to operate, support, and repair the Service. In addition, an administrator can start a time-limited support session that renders the app exactly as a specified user sees it, in order to reproduce and fix a reported problem. The safeguards on that feature are:

• it can only be started by a verified platform administrator, and the administrator’s real identity is re-verified on every request;
• the session expires automatically after 60 minutes;
• sending email or SMS, and placing or paying for orders, are blocked for the duration of the session;
• a banner is displayed throughout so the session is never invisible to anyone using the screen; and
• every session start and stop is written to a permanent audit log.

We use this capability for support and debugging, not for browsing family data out of curiosity. You may ask us at treechival@gmail.com whether any support session has been run against your account.

• All connections are encrypted in transit over HTTPS.
• Authentication runs through Cloudflare Zero Trust; we never store or see your password.
• Media is held in private storage buckets that are not publicly listable and are served only to authenticated users.
• Each family tree is isolated, and every query for members, media, and relationships is scoped to the trees your account is entitled to see.
• Administrative actions and email sends are logged, and support sessions are audited.
• We run dependency vulnerability audits and periodic adversarial security reviews of our own system.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law, and without undue delay.

We keep personal information for as long as needed for the purpose it was collected, and then delete or anonymise it. In practice:

• Family tree records and archive media — kept for as long as the tree is active, because a family archive is intended to be permanent. Deleted on request, subject to the shared-data limits described below.
• Account and preference data — kept while your account is active, and deleted within 90 days of account closure.
• Phone number and SMS consent record — deleted promptly when you disable SMS or remove the number; we retain a minimal record that consent was given and withdrawn, and when, because messaging law requires it.
• Email send logs — retained to prevent duplicate sends and to prove consent and delivery, typically for 24 months.
• Order, payment, and shipping records — retained for at least 7 years, as tax and business law requires.
• Security, access, and audit logs — typically retained for 12 months, longer where an investigation is open.
• Encrypted backups — retained on a rolling basis and overwritten within 90 days, so deleted content can persist briefly in backups before it is cycled out.

Wherever you live, you may ask us to:

• confirm whether we hold personal information about you, and give you a copy;
• correct information that is inaccurate or incomplete;
• delete information about you;
• export your data in a portable format;
• restrict or object to particular processing; and
• stop sending you any category of notification.

You can update your own details and change every notification setting yourself in Account Settings at treechival.com/account. For anything else, email treechival@gmail.com.

We respond within 45 days, and will tell you if we need a further 45 days. We will ask you to verify your identity — normally by replying from the email address on the account — before acting on a request about a specific person's data. Exercising these rights is free and we will never treat you worse for doing so. An authorised agent may act for you with written permission.

The limit on deletion in a shared tree

A family tree is a shared structure. Removing a person can break the relationship links that other families' records depend on. Where deleting your record entirely would corrupt the tree for other people, we will offer alternatives — removing your personal details, photographs, stories, and dates while retaining only the minimal structural link, or hiding the record from view. We will always explain what we can and cannot delete and why, and we will honour a full deletion where law requires it.

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have the rights described above. We extend them to every user regardless of where they live, rather than gate them by state.

California (CCPA/CPRA)

• Categories of personal information we have collected in the last 12 months: identifiers (name, email, phone, IP address); customer records (shipping address, order history); protected classification characteristics (gender, age, and where a family member has recorded them, potentially ethnicity or religion); commercial information (purchases); internet activity (server logs only); geolocation limited to places recorded in family history or embedded in uploaded photographs; audio, visual, and electronic information (uploaded media); and inferences — none, we draw none.
• Sources: you, other family members of your tree, and our service providers.
• Purposes: as set out in "How and Why We Use Information" above.
• We have not sold or shared personal information for cross-context behavioural advertising in the preceding 12 months, and we do not do so. We have never knowingly sold or shared the personal information of anyone under 16.
• We do not use or disclose sensitive personal information for any purpose other than those permitted without a right to limit.
• You have the rights to know, access, correct, delete, and to non-discrimination for exercising them.

Appeals

If we decline your request, you may appeal by replying to our decision with the word "appeal." We will review and respond in writing within 45 days with our reasoning. If your appeal is denied, you may contact your state Attorney General.

Global Privacy Control

Because we do not sell or share personal information and do not perform targeted advertising, there is nothing for an opt-out preference signal to disable. We honour such signals by continuing not to do those things. We do not respond to Do Not Track signals, as there is no agreed standard for them.

Treechival is operated from the United States and is directed to users in the United States. Where the GDPR or UK GDPR nonetheless applies to you, we honour its rights: access, rectification, erasure, restriction, portability, objection, and the withdrawal of consent at any time.

The legal bases we rely on are set out in "How and Why We Use Information" above. Where we rely on legitimate interests, you may object and we will stop unless we have compelling grounds that override your rights.

International transfers

Personal information is stored and processed in the United States, and our infrastructure provider operates a global network that may cache or route content through servers in other countries. Where we transfer personal information out of the EEA or UK, we rely on Standard Contractual Clauses or another lawful transfer mechanism in our agreements with our providers.

Complaints

Please contact us first at treechival@gmail.com — we would rather fix a problem than have you escalate it. You also have the right to lodge a complaint with your national supervisory authority, or with the UK Information Commissioner's Office.

A family tree naturally includes children. We treat information about minors with particular care, and our approach is to over-comply rather than to do the minimum.

We do not collect from children directly

Treechival is not directed to children under 13, and we do not knowingly permit a child under 13 to create an account, sign in, upload content, subscribe to notifications, or place an order. Accounts require a person aged 18 or over. Any information about a child in a tree has been entered by an adult family member.

What parents and guardians can do

• Ask us what information about your child is held, and where it appears.
• Ask us to correct it.
• Ask us to delete it, or to hide it from view, without needing the agreement of the family member who entered it.
• Ask us to refuse any further collection or use of it.

Email treechival@gmail.com and we will act promptly. We will not require you to give us more information about your child than we need to find the record and verify that you are their parent or guardian.

If we learn we hold a child’s information improperly

If we discover that a child under 13 has created an account or provided information to us directly, we will delete it as quickly as we reasonably can.

Future features for children

We are considering features intended to be used by children, such as a family messaging app limited to approved relatives. No such feature is live today. Before any feature that collects information directly from a child under 13 is released, we will obtain verifiable parental consent as COPPA requires, publish a specific notice describing exactly what is collected and why, collect no more than is strictly necessary, and give parents ongoing review and deletion control. We will not condition a child's participation on disclosing more than is reasonably necessary.

Much of a family archive concerns people who have died. Privacy law generally does not apply to the deceased, but we still handle their records respectfully. A close relative, executor, or personal representative may contact us to correct or request removal of a deceased person's information, and we will consider the request alongside the interests of other family members who share that ancestor.

You do not need an account and you do not need the permission of the relative who added you. Email treechival@gmail.com with your name, any names your relatives might have recorded you under, and enough detail for us to identify the right record. You can ask us to:

• tell you what information about you is held and which family is holding it;
• correct anything inaccurate;
• remove specific details, photographs, or stories;
• hide your record from view; or
• delete your information entirely, subject to the shared-tree limits described above.

We will verify your identity proportionately before acting, and we will not disclose other family members' personal information to you in the process. We may notify the tree administrator that a removal has occurred, without necessarily identifying you.

We may update this policy as the Service changes. The effective date at the top shows when the current version took effect. For material changes — a new category of information, a new purpose, or a new recipient — we will give notice by email, by an in-app notice, or through the What's New section of your account dashboard before the change takes effect, and we will obtain your consent where the law requires it.

Innovation Dynamics, LLC, a North Carolina limited liability company, operating Treechival at treechival.com.

Privacy enquiries and rights requests: treechival@gmail.com

General enquiries: treechival@gmail.com

If you need a postal address in order to send us a formal notice, ask by email and we will provide one.

If you are contacting us to exercise a right, please say so in the subject line so we can route it correctly and meet our response deadline.