Privacy Policy

Effective 2 November 2026

1. Who we are
2. What we collect
3. Information about relatives
4. How we use it
5. Who can see it
6. Service providers
7. Where it is stored
8. How long we keep it
9. Your choices and rights
10. Children
11. Security
12. Changes and contact

1. Who we are

RootsAcross (“we”, “us”) is a private family-tree website at rootsacross.com, run by an individual as a non-commercial hobby project. It lets families and friends create separate, private hubs, each with its own family tree, photos, recordings and plans.

For the information described in this policy, we are the data controller. Within each hub, the hub’s admins also decide who may join and can remove content, so they share responsibility for how that hub is used.

2. What we collect

Information you give us

• Your account: your name, email address and password. We store the password only as a one-way scrambled hash (scrypt), so nobody, including us, can read it. We also record when you agreed to these terms.
• Family tree details that you add about yourself or relatives, such as names, other names, gender, dates and places of birth and death, the city and country where someone lives, contact details, a short biography, and relationships between people.
• Photos and voice recordings, with captions, dates, languages, notes and the people tagged in them.
• Plans and replies, such as visits, get-togethers and RSVPs.
• Settings and requests: your privacy choices, people you’ve hidden your details from, requests to link or merge relatives, and hub settings.

Information created when you use the site

• Map positions and time zones. We work out approximate coordinates and a time zone from the city and country entered for each person, unless they set an exact location themselves.
• Sign-in records. When you sign in, your device keeps a random sign-in key in the browser’s local storage. The key lasts 30 days, and we store only a scrambled copy of it. We don’t use cookies for tracking or advertising.
• Technical data. Like any website, our servers see your IP address, browser type and the pages you request. We use the IP address briefly to slow down repeated wrong-password attempts. Our hosting provider, Cloudflare, keeps short-term logs for security and troubleshooting.

We don’t use analytics or advertising trackers. We don’t do facial recognition, and we don’t use your information to train AI models.

3. Information about relatives

A family tree is, by nature, information about other people, some of whom may never use RootsAcross. If you add information about someone else, you are responsible for making sure you’re allowed to share it. In particular:

• Share living relatives’ contact details, photos and recordings only with their permission (or a parent’s or guardian’s, for children).
• Respect a relative who asks not to be included, or wants details removed.
• When a relative joins and claims their own profile, they take control of its privacy settings.

If you find information about yourself in a hub and want it changed or removed, ask the member who added it or a hub admin. If that doesn’t work, email us and we’ll help.

4. How we use your information

We use it only to run RootsAcross for you and your family:

• to provide the hub’s features, such as the tree, “how are we related”, distances, local times, photos, stories, plans, reports and exports;
• to sign you in and keep accounts and hubs secure, including preventing abuse;
• to answer your messages and requests;
• to meet legal obligations.

Where privacy laws ask for a legal basis (for example the GDPR in Europe and the UK), we rely on providing the service you asked for (contract), our legitimate interest in keeping the site secure and working, and, for sensitive choices you make yourself, your consent. Family-tree information can sometimes reveal sensitive details, such as ethnicity, religion or health. Please share these only if you and the people concerned are comfortable doing so.

We will never sell or rent your information, show you ads, or share it with anyone for their marketing.

5. Who can see your information

We may disclose information if required by law, or to protect someone’s safety. Where the law allows, we’ll tell the affected hub first.

6. Service providers

Each place is looked up once and then remembered by the hub. These providers process the information under their own privacy policies.

7. Where your information is stored

Cloudflare runs a global network, so your information may be stored and processed in countries other than your own, including the United States. Cloudflare provides contractual safeguards for international transfers, such as the EU Standard Contractual Clauses.

8. How long we keep it

• Hub content stays until a member deletes it, an admin removes it, or the hub is deleted.
• When you delete your account, your account details and sign-ins are deleted straight away. The relatives you added stay in the tree for the rest of the family. You can choose to remove your own profile as well, and otherwise your contact details are cleared from it.
• When a hub is deleted, its database, photos and recordings are deleted straight away.
• Our hosting keeps automatic recovery copies of databases for up to 30 days, after which deleted data is gone for good. Cloudflare’s security logs are kept for a short period under its own policy.
• Sign-in keys expire after 30 days, and password reset links after 3 days.

9. Your choices and rights

You can do most things yourself in the app:

• See and correct your profile and anything you added.
• Download the family tree (GEDCOM or spreadsheet) from Members & settings.
• Limit who sees your contact details and location, or hide your details from a particular member.
• Delete your account (and optionally your profile) from Members & settings → Leave or delete. Admins can delete the whole hub there.

Depending on where you live, privacy law may give you further rights. These can include the right to access, correct, delete, restrict or object to the use of your information, to receive a copy in a portable format, and to withdraw consent. Examples are the GDPR and UK GDPR, Canada’s PIPEDA and Quebec’s Law 25, California’s CCPA, Australia’s Privacy Act and India’s DPDP Act. To use any of these rights, email hello@rootsacross.com. We’ll reply within 30 days. We may need to confirm it’s you, usually by asking you to write from your account’s email address.

We don’t sell or “share” personal information as California law defines those words. If you’re unhappy with how we handled your information, you can also complain to your local data-protection authority.

10. Children

You must be at least 13 to create an account, or older if the law in your country requires a higher age for this kind of service without a parent’s consent. Children often appear in family trees added by their parents or relatives. In that case, the adult who added them is responsible for what is shared, and should share a child’s details only with the agreement of the child’s parent or guardian. If you believe a child’s information was added without that agreement, contact a hub admin or email us and we’ll remove it.

11. Security

We protect your information with HTTPS encryption, scrambled (hashed) passwords and sign-in keys, private photo and recording links that work only for signed-in members, strict separation between hubs, and protection against repeated sign-in attempts. No website can be completely secure, so please use a password you don’t use elsewhere, and invite only people you trust. If a breach affects your information, we will tell affected hubs promptly and, where required, notify the relevant authorities.

12. Changes and contact

If we change this policy, we’ll update the date at the top. For important changes, we’ll also give notice on the site before they take effect.

Contact: hello@rootsacross.com