Your family stays in your family

What is stored, and where

Everything you enter (names, dates, places, relationships, stories, life events and photos) is saved in your browser’s own storage on the device you’re using. Nothing needs an account, and until you choose a username there is no copy anywhere else.

Clearing your browser’s data for this site deletes the family from that browser. We can’t bring it back, because we never had it. That’s why the app offers a full backup file (in Settings, under Family data) and reminds you about photos that have no backup.

If you choose a username: your own devices, and your relatives

A username and password let your family open on your other devices, and let you share it with relatives you invite. Your family is locked on your device before it is sent, with a key made from your password. Our service passes the locked copy between devices and keeps a copy so a device that was switched off can catch up. It has no key to open it, because a key is never sent.

Your username isn’t stored either: the service keeps a one-way fingerprint of it. Your password never leaves your device; what’s sent is a value worked out from it that proves you know it and can’t be turned back into the password. No email, phone number or real name is asked for.

When you share, each relative you let in gets their own locked copy of the family’s key, and the list of who’s in is signed by an owner so every device can check it. An invitation’s secret sits after the “#” in the link, which browsers never send to a server.

What the service does know: that an account exists; the anonymous numbers that stand for the accounts in a shared family, so how many people share it, and whether each is an owner, co-owner, editor or viewer; how big each locked copy is, which hints at how big the family is; and when it last changed. It never sees a name, a date or a relationship. To stop someone guessing passwords, it also counts wrong attempts for up to an hour, by account and by internet address. The count is kept under a scrambled label that can’t be turned back into the address, and is deleted when the hour is up.

There is no password reset. Your password is the key. When you choose a username you get a recovery key, shown once, which is the only other way back in. If both are lost, the copy on our service can never be opened again, by you or by us. The family already on your devices isn’t affected.

The honest limit. The locking happens in the app’s code, which we serve to your browser. The guarantee rests on that code doing what it says, as it does for every service that locks things in a browser. It protects you if our service is broken into, if we are asked to hand over what we hold, and from anyone reading it on the way. It can’t protect against the app itself being changed, and nobody who locks things in a browser can honestly claim otherwise. Before anyone uses sign-in or sharing for real, an independent security review checks this.

You can remove your account and everything the service holds for it at any time: Settings, Your other devices, Remove from the service.

Photos never leave your device

Photos are kept only on the device you added them on, and they are never shared, even with relatives in your shared family. Each person adds the pictures they want on their own phone. The choice of someone’s profile photo is yours alone too.

A photo backup file, if you make one, is saved where you choose. We never see it.

What leaves your browser

Only these, and nothing else.

Map pictures, from OpenStreetMap. The detailed map loads its pictures from OpenStreetMap, which sees the area you’re looking at and your internet address. Nothing about your family goes with it. In Settings you can switch the map to Simple (offline), which loads nothing from anywhere. Searching for a place uses a list of towns the app downloads from this site the first time, so what you type isn’t sent anywhere.

Nothing for fonts. The app and these pages carry their own copies of their fonts, so fetching fonts doesn’t tell anyone else you were here.

A message, if you send one. If you use Contact us, your name, email address and message come to us by email so we can reply. Nothing from your family tree is attached.

What you send yourself. “Send wishes” and invitation links open WhatsApp, your email or your phone’s share menu with the words already written. What you send there is between you and that app.

Ordinary requests for the site. Opening any website means your device asks a server for it, and that request carries your internet address. The server that hosts this site keeps ordinary web-server logs.

Visit counting on the front page. See the next section.

The quick tools

The cousin calculator, the printable blank family tree and the GEDCOM viewer run in your browser, and what you pick or type in them isn’t sent anywhere. The calculator’s path and the blank tree’s settings (not the family name) go in the page’s address, so a link you share opens the same thing. A file you open in the GEDCOM viewer is read on your device, isn’t uploaded and isn’t kept: closing the page forgets it. The tools don’t count visits.

Counting visits

The front page counts visits with Google Analytics: how many people arrive and how they found us. Only the front page does this. The app, where your family tree is, never loads it, and neither does this page. The front page (familytree.manr.ai) and the app (tree.manr.ai) are at separate addresses on purpose: a browser keeps each address’s storage apart, so the counting tool on the front page can’t reach anything the app keeps. It is on for everyone unless you turn it off, as on our other sites.

While it’s on, Google receives the ordinary things a visit-counting tool receives: the page’s address without anything after it, roughly where you are in the world, and what kind of device and browser you’re using. Your internet address is shortened before it is stored. Advertising signals are refused for everyone.

Google Analytics sets its own cookies on the front page to recognise a returning visit. Turning it off removes the reason for them: none are set from then on, on this device.

What’s kept on your device besides the family

A few small things, readable only by this site, such as which person you are in the tree, light or dark, text size, whether you’ve seen a hint, and when you last backed up your photos, and whether you turned off visit counting. The app sets no cookies; the front page’s visit counting does, as described above.

Files you save

Backups and GEDCOM exports are written by your browser to a place you choose. They are not locked, and they contain everyone’s names, dates and places. Keep them somewhere you’d keep family papers.

Other people in your tree

A family tree is about other people too, including children and relatives who have passed away. Their details stay on your devices, and with the relatives you let in if you share. Please add only what your family is happy to have written down. Anyone can be edited or removed at any time.

Your rights

Data protection law gives you rights to see, correct, export and delete personal data an organisation holds about you. Your family tree is on your own device: you can see it, edit it, export it (backup or GEDCOM) and delete it whenever you like. If you chose a username, what our service holds is locked and can be removed from Settings in one step.

A message sent through Contact us arrives as an ordinary email. If you’d like it deleted, ask us.

Changes

If what the app does with data changes, this page changes with it. It describes what the app does today, not an intention.