Privacy Policy

Kinderhof ("we", "us") helps families explore their family history together. This policy explains what information we collect, why, who we share it with and the choices you have. We have tried to write it plainly. If anything is unclear, contact us at hello@kinderhof.org.

1. Information we collect

Account information. Your email address and, if you give one, a display name. We use your email address to sign you in and to send you messages about your account.
Family information. The name of your family, the people who belong to it, their roles, and invitations you send (the invitee's email address and role).
Tree data. When you upload a GEDCOM file, we keep what we read from it: for people we treat as deceased, their names, sexes, dates and places of life events, occupations and notes; for everyone, how people are related. We also keep the file's name, a few counts (people, families, events) and any warnings from reading it. Photos in the file are not kept. People who may be living are handled differently: see Family trees and living people below. If we later offer a FamilySearch connection, what we receive is described in the FamilySearch section.
Child profiles. A first name or nickname and, optionally, a birth year, entered by a parent or guardian. See Children below.
Security and usage records. Sign-in time, the browser type reported when you sign in, IP address as needed to prevent abuse (for example, rate-limiting sign-in attempts), and a log of administrative actions in a family, such as inviting or removing a member. These log entries can include the email address of a person invited and the names of families and members. We keep them for up to 12 months.
Messages. If you email us, we keep the message and our reply.

We do not collect payment information at this time. If we introduce paid plans, we will update this policy and use a payment processor so that we never store full card numbers.

2. How we use information

To sign you in, keep you signed in, and run your family account.
To build your family's calendar and games from the tree data you provide.
To send sign-in links, invitations and essential account messages. We do not send marketing email without asking you first.
To protect the service from abuse, fix problems and keep it secure.
To meet legal obligations.

We do not sell your information. We do not share it for advertising, we do not show advertising, and we do not use your family's tree data to train machine-learning models.

3. Family trees and living people

The file is not kept. When you upload a GEDCOM file, we read it once to pick out the people and how they are related, and then the file itself is discarded. We keep only what we read from it, as described above.

Living people. Family trees often include people who are still alive. We treat a person as possibly living unless the file shows they have died. That means they have a death, burial or cremation record, or the file shows they were born more than 110 years ago. We work that out from their own dates, and from the dates of their children and marriages, and we add a safety margin when a date is only approximate (for example "about 1912"). If we cannot tell, we treat the person as living.

For anyone who may be living, we store no name and no details. We do not keep their name, sex, dates, places, occupation or notes, or the events of any marriage they are part of. We keep only their place in the tree, so that the family lines still connect. In your family's tree they appear as "Living person", to every member. They are not listed, and they are not used in games or on the calendar.

If someone has died but looks living. An owner or admin can mark a person as deceased. Because we never stored that person's details, we keep only the person's id from your file, a fingerprint of the file's structure, who marked them and when. The fingerprint is a short code made from the ids, relationships and birth years in the file. It is not the file. The mark is used the next time the same file is uploaded, and then the person's details are read from it. Marks are removed when a different file replaces the tree or the tree is deleted.

Notes, places and occupations are stored as written. We cannot read the meaning of free text. If a note about someone who has died mentions living relatives (for example "survived by her daughter Jane"), that sentence is stored and shown to your family, and the same goes for place names and occupations. Please check notes in your file before you upload it.

Who can see the tree. Only the members of that family (owners, admins and members) can see it. It is not public, it is not searchable from outside, and it is never shared with other families. Only owners and admins can upload, replace or delete it.

4. Children

Kinderhof is designed to be used by families together, but we do not knowingly collect personal information directly from children.

Children do not create accounts. A parent or guardian adds a child profile. A child profile has no email address and no login.
A child profile holds only a first name or nickname and, optionally, a birth year. We do not ask for a child's photo, address, phone number or precise birth date.
The adult who creates a profile must tick a box confirming that they are the child's parent or legal guardian, or have the parent's permission, and we record that confirmation. The adult managing the profile can edit or delete it at any time.
We do not show advertising to anyone, do not build advertising profiles, and do not sell or share children's information.
A parent or guardian can ask to see or delete a child's information by emailing hello@kinderhof.org. If you believe a child has given us personal information without a parent's consent, please tell us and we will delete it.

These practices are designed with the U.S. Children's Online Privacy Protection Act (COPPA) in mind. Residents of other countries may have additional rights, described below.

5. FamilySearch data

If we offer a FamilySearch connection and you choose to use it, you will approve access on FamilySearch's own permission screen. Then:

We use FamilySearch data only to provide Kinderhof's features to your family: the calendar and the games.
We read, but never change, data in FamilySearch.
We refresh the data when needed rather than keeping a permanent copy, and we keep only the fields needed for these features.
We never sell FamilySearch data, never use it for advertising, and never make it available to anyone outside your family account.
When you disconnect FamilySearch, or delete your family account, we delete the data we received from it.

Kinderhof is not affiliated with FamilySearch. Information held by FamilySearch is governed by FamilySearch's own policies.

Your family's information is visible to the members of your family according to their role. We do not share it with other families or the public. We use these service providers (processors), who handle information only to provide their service to us:

Cloudflare, Inc. hosts the website, stores our database, delivers pages and provides bot protection on the sign-in form (Cloudflare Turnstile).
Resend (our email delivery provider) sends sign-in links, invitations and account messages.

We may disclose information if required by law, to protect people's safety, or to enforce our Terms. If Kinderhof is ever involved in a merger or sale, we will tell you and this policy will continue to apply to your information unless you agree otherwise.

Our providers may process information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for international transfers.

7. Cookies

We use one cookie, a session cookie that keeps you signed in. It is HttpOnly (not readable by scripts), is sent only over HTTPS and only to our site, and lasts up to 30 days if you keep using the site. We do not use advertising or tracking cookies and we do not use third-party analytics. Our pages load fonts from Google Fonts, and the sign-in form loads Cloudflare Turnstile, which may receive your IP address and browser information so that those services can work.

8. Retention and deletion

Sign-in links expire after 15 minutes and can be used only once. Expired links are deleted automatically within a day or two, and expired sessions are deleted automatically each day.
Sessions end when you log out, when you choose "Sign out everywhere" on your account page, or after 30 days without use.
Family data is kept while your family account is active. You can remove people or delete the family account at any time. Deleted data is removed from our live database promptly and from backups within 35 days.
Your family tree is kept until you remove it. An owner or admin can delete it at any time, and it is removed from our live database immediately, together with any "marked as deceased" entries, and from backups within 35 days. Uploading a new file replaces the old tree, and the old one is removed. Deleting the family or the account that holds the tree removes it too. Leftovers from an upload that was interrupted are cleared automatically within two days. We keep a simple record of each upload attempt (the family and the time, no names) for up to two days, to limit how often a family can upload. The file you uploaded was never stored, so there is nothing else to delete.
Your account. You can delete your account from your account page at any time. This removes your login, your place in every family, pending sign-in links and invitations to or from your address, and the identifying details in administrative log entries. If a family has other owners, the family continues without you. A family where you are the only owner and other people remain must be transferred or deleted first.
Administrative log entries are deleted after 12 months. Entries about trees record the action, the file name and counts, and, for a deceased mark, the person's id. They never contain the names of people in the tree. After you delete your account, the entries that remain no longer name you. Records that we must keep for legal reasons or to prevent abuse are kept only as long as needed.

9. Security

We protect information with encryption in transit (HTTPS), single-use sign-in links whose tokens are stored only as hashes, short-lived sessions, access limited to what each family role needs, rate limiting and bot protection. No online service can be perfectly secure. If a breach affects your information we will notify you as required by law.

10. Your choices and rights

You can view and correct your name, your family details and child profiles, and delete your account, families and child profiles, from within your family account. You can ask us by email for a copy of the personal information we hold about you. Depending on where you live (for example, in the European Economic Area, the United Kingdom or California) you may also have the right to request access to, correction, deletion or portability of your personal information, to object to or restrict certain processing, and to complain to your data protection authority. To exercise these rights, contact us at hello@kinderhof.org. We may need to confirm your identity first.

Where the law requires a legal basis, we process information to perform our contract with you (running your account), for our legitimate interests (security and improving the service), to meet legal obligations, and with your consent where we ask for it, such as when you upload a tree or connect FamilySearch.

11. Changes and contact

We may update this policy. If we make a significant change we will tell you by email or on the site before it takes effect. The effective date is at the top.

Kinderhof
Email: hello@kinderhof.org