Skip to content
AskGenealogy

Privacy policy

On this page

Version 5. Last updated: Oct 18, 2026

This policy explains what personal data AskGenealogy processes, why, where it is stored, who receives it and how you can control it. It covers the website at askgenealogy.com, the connection that lets ChatGPT, Claude and other AI assistants use your account, the paid plans and Ask your tree, the chat in your account.

Who is responsible

The controller is Juan Gouvêa, operating as JUNO WOZ (CNPJ 58.515.433/0001-60) in Brazil (“we”). Contact for any question or request: inbox@askgenealogy.com.

What we process

Your account

  • Your email address, the display name if you set one, your language and the dates of creation and last sign-in.
  • Sign-in codes. We store only a hash of each code, with the email address it was requested for. A code expires after 10 minutes and allows 5 attempts. We delete the record of a code within 48 hours.
  • Your browser session. We store only a hash of the session token. The session lasts 30 days.
  • Onboarding email state: the time of your first approval of an assistant, the time of your first tool call, the time we sent the welcome email and the reminder, and whether you unsubscribed. This state is not sent to product analytics.
  • Your answers to the welcome questions, if you give them. After your first sign-in we may ask what you want to do (a goal), which countries your ancestors came from, whether you already have a tree and where, and how you heard about us. You can skip every question. We keep these choices as fixed words on your account, and use them to start a first research project and, in aggregate, to improve the service. If you type the name of an ancestor, it is saved only in that first project, like any other project text. It is not sent to product analytics and not written to logs.
  • We do not use passwords.

Your AI assistant connection

  • The apps you approved (for example ChatGPT or Claude), the permission you gave and the date.
  • The access and refresh tokens that let the app act for you. Access tokens last 1 hour. Refresh tokens last up to 60 days or until you revoke them.

Your family tree files

  • The GEDCOM file you upload, stored as you sent it.
  • The data we read from it: people, families, events, places, notes, sources and citations.
  • A tree can contain data about living people and sensitive data, such as religion, ordinance records, illness or cause of death, adoption and illegitimacy. See “Other people and sensitive data” below.

Your research workspace

  • Projects, their members and roles, and the trees added to each project.
  • Invite links. We store only a hash of the link token.
  • Research entries that you or your assistant save: questions, plans, search logs, notes, hypotheses, tasks, evidence, transcriptions, citations and conclusions.
  • An activity history of project changes: who did what, and when.

Your plan and payments

  • Your plan (Free, Plus or Pro), the status of a paid subscription, its renewal date and whether you asked to cancel.
  • The identifiers that link your account to your customer and subscription at Stripe. We also add our random internal account id to your customer record at Stripe (never your email address), so that a payment can be matched to an account. We keep a record of each payment event we processed for 35 days, so that we never process one twice.
  • We never see or store your card number. You enter payment details on a page run by Stripe. Stripe also collects the billing details it needs for receipts and tax, such as your name, your billing country and, for a business, a tax number.

Ask your tree

  • Ask your tree is a chat in your account. It is optional. We process data for it only when you send a question.
  • We store your conversations so that you can continue them: your questions and the answers. An answer can quote data from your trees, so a stored conversation can hold names, dates, places and notes.
  • We keep a count of your answers for each month and what each one cost us. The count holds no text.

Technical data

  • Cloudflare processes the IP address and the details of each request to deliver and protect the service. Its technical request logs are kept for 7 days.
  • Our own log entries contain only an event name, a code and a status. They do not contain emails, tokens, file content or names of people.
  • Short-lived counters limit how often a person can sign in or call the service. They use a hash of the email address or the IP address.
  • When enabled, Cloudflare Web Analytics counts visits to the public pages. It sets no cookies and does not follow people across sites.
  • Product analytics. With PostHog we record which actions happen in the service, for example a sign-up, a tree upload or a started checkout. Each event carries a random internal account id, the country of the request, which Cloudflare derives from the IP address, and basic details such as your language and plan. We also count visits to the public pages (home, pricing, privacy, terms, support and connect) and to the sign-in and getting-started pages. A visit count is not linked to an account, whether or not you are signed in. It carries a daily visitor id instead: a keyed hash of your IP address and your browser that changes every day, so it cannot follow you from one day to the next, and we never keep the IP address itself. It also carries the site you came from, the campaign tags of the address (utm_source, utm_medium and utm_campaign, when present) and the country. When you sign up, we keep how you arrived once on your account: the site you came from, the campaign tags and whether you started from Claude, ChatGPT or our website. A visit and a sign-up in the same 30 minutes share a random session id that we derive from the daily visitor id, and the tool calls of one assistant conversation share a random conversation id that we derive from your account and the day. We never keep the assistant’s conversation identifier itself. We also record, for each search of historical records, which source answered, whether it worked, how long it took and how many results came back, but not what you searched for. We also count the steps of signing in (the page opened, a code requested, a code that was wrong, the consent screen opened), with the daily visitor id before you have an account and with your account id after. For the welcome questions we send whether you answered or skipped, which of two versions of the screen your account was given, and your choices as fixed words (never the name of an ancestor). We do not count a visit, or set a session id, when your browser sends Global Privacy Control or Do Not Track. We do not send your IP address, email address, name, tree data, search terms, questions or the full address of a page. Our server sends the events. PostHog sets no cookie, and we run no PostHog script in your browser.
  • When enabled, Cloudflare Turnstile checks on the sign-in page that a request comes from a person before we send a code. Cloudflare processes technical data from your browser for that check.

Cookies

The service sets only functional cookies: the sign-in session cookie (30 days); a short-lived cookie (30 minutes) that ties a sign-in code to the browser that asked for it; a language cookie that remembers pt-BR or English (1 year, set only when you use the language switch); a theme cookie that remembers light or dark (1 year, set only when you use the theme switch); a short-lived cookie (10 minutes) that ties an app approval page to your browser; and, only if you connect FamilySearch, a short-lived cookie that protects that connection step. None is used for advertising or tracking. Analytics and billing add no cookie to this site. When you pay, Stripe runs the payment page on its own domain and can set its own cookies there. See Stripe’s privacy policy.

Why we process it

  • To create your account, sign you in and run the service you asked for. This includes answering your assistant when it calls our tools. The legal basis is the contract with you (LGPD art. 7, V; GDPR art. 6(1)(b)).
  • To sell and run paid plans: take payment, renew, cancel and refund. The legal basis is the contract with you (LGPD art. 7, V; GDPR art. 6(1)(b)). We also keep payment and tax records because the law requires it (LGPD art. 7, II; GDPR art. 6(1)(c)).
  • To answer your questions in Ask your tree. The legal basis is the contract with you.
  • To keep the service secure and prevent abuse. The legal basis is our legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
  • To send you at most two emails after you connect an assistant: a welcome email with three questions to try, and, if your account has made no tool call 24 to 72 hours later, one reminder. Then we send no more of these. The legal basis is our legitimate interest in helping you start (LGPD art. 7, IX; GDPR art. 6(1)(f)). Each email has a one-click unsubscribe link, and you can object any time by writing to inbox@askgenealogy.com. Emails you ask for, such as sign-in codes, are not affected. Neither email names a plan or a price.
  • To measure how the service is used, find faults and plan improvements, with the product analytics described above. The legal basis is our legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)). You can object by writing to inbox@askgenealogy.com.
  • To meet legal obligations (LGPD art. 7, II; GDPR art. 6(1)(c)).
  • For sensitive data in the files you upload, the legal basis is your consent, which you give when you upload the file and can withdraw by deleting the data (LGPD art. 11, I; GDPR art. 9(2)(a)).

We do not sell personal data. We do not show advertising. We do not use your data to train AI models. The only AI model service we call is Anthropic’s, and only when you use Ask your tree or order a research report. FamilySearch content never goes to it.

Other people and sensitive data

A family tree describes people other than you. You decide what to upload. You are responsible for having the right to upload it and to share it with the people you invite. For data about other people that you upload, we process it only to run the service for you.

When we read a GEDCOM file, we mark people who are probably living, using their dates. This mark is an estimate and can be wrong. Treat every person with recent dates as living.

If you use Ask your tree, the data that the tools return for your question goes to Anthropic. It can include sensitive data and data about living people in your own trees. Do not use the chat on a tree if you do not want that. A research report works the same way: the name you give, your question and what the searches of your trees and of open sources return go to Anthropic, and the report is saved as research entries in your project. A report is never written about a person marked as living.

If you appear in someone else’s tree and want your data removed, write to inbox@askgenealogy.com. We will act on a request that identifies the person and the tree.

Who receives your data

  • Cloudflare provides hosting, the database, file storage, key storage, email delivery and network protection.
  • Stripe, Inc. processes the payments for paid plans. It receives your email address, the plan you choose, the payment and billing details you enter and our random internal account id. We receive the status of your subscription. Stripe is our processor for payments, and it acts as an independent controller for its own fraud prevention and legal duties. Stripe’s privacy policy applies to that part.
  • PostHog provides product analytics. It receives the events described above, including the visit counts, and nothing else from us. We do not connect PostHog to Stripe, so it receives no payer email or name.
  • Anthropic provides the AI model behind Ask your tree and the research reports, and only when you use them. When you send a question or order a report, Anthropic receives it, the recent messages of that conversation and the data that the tools return from your trees and from open sources. Under Anthropic’s commercial terms it does not use this data to train its models. Anthropic keeps inputs and outputs for up to 30 days by default. It can keep them longer when the law requires it, or when a safety review flags a violation of its usage policy.
  • Your AI assistant provider. When you use a tool through ChatGPT (OpenAI) or Claude (Anthropic), the tool results become part of your conversation with that provider. Its terms and privacy policy apply to that conversation. We do not control it.
  • Open sources. When you ask the assistant, or Ask your tree, to search outside records, the search terms (names, places and years) go to the source: WikiTree, the Internet Archive, Open Archives, Wikidata, the UK National Archives (Discovery), the Swedish National Archives (Riksarkivet), Europeana, DigitalNZ and the Library of Congress (Chronicling America). We use each source only when it is turned on. Each source has its own privacy policy. Links to other sites, such as FamilySearch, Find a Grave or national archives, open in your browser, and your visit is between you and that site.
  • People you invite to a project. Members can read the trees and entries of the project according to their role.
  • Authorities, when the law requires it.

Where data is stored

Data is stored with Cloudflare in the Cloudflare Workers platform: a D1 database, R2 file storage and KV key storage. Cloudflare can process data in several countries, including outside Brazil and the European Economic Area. Stripe and Anthropic process data in the United States and can use other countries. PostHog runs on its United States or European Union cloud. For international transfers we rely on the safeguards that the LGPD and the GDPR allow.

How long we keep data

  • Sign-in codes expire after 10 minutes. We delete the record of a code, with the email address it was requested for, within 48 hours, even if you never sign in. Sessions end after 30 days. Invite links end when they expire or reach their use limit.
  • Onboarding email state stays with your account until you delete it. After you unsubscribe we keep only the fact that you did, so that we do not email you again.
  • Your answers to the welcome questions stay with your account until you delete it. The ancestor name stays in the first project until you delete the project or your account.
  • Trees, files, projects and entries stay until you delete them or delete your account.
  • You can delete a tree in the account area or by asking your assistant to use the delete tool. This removes the parsed data and the original file. It also deletes the Ask your tree conversations that read the tree, including conversations that members of a shared project had about it.
  • You can delete your account in the account area. This removes your profile, your trees and files, the projects you own and their entries, your Ask your tree conversations and your assistant connections. It also cancels any paid subscription.
  • Payments: we keep your plan and subscription records while your account exists. We delete the record of a processed payment event after 35 days. Stripe and our accounting keep invoices and payment records for as long as tax and accounting law requires, even after you delete your account.
  • Research reports: the order (your question, the name you gave and the country) is kept for 90 days after the report finishes, and then deleted. The research entries that the report wrote stay in your project until you delete them or the project. The count of your research credits (each grant, purchase and use, with a date) stays while your account exists.
  • Ask your tree: a conversation stays until you delete it, you ask us to delete it or you delete your account. We delete a conversation that has had no new message for 90 days. Anthropic keeps what we send it for up to 30 days, as described above.
  • Product analytics: PostHog keeps events for up to 12 months. An event holds only a random account id or, for a visit count, a daily visitor id. After you delete your account, the account id points to no account.
  • Entries you wrote in a project that belongs to another person stay in that project. Delete them first if you want them gone, or ask the owner.
  • The database keeps a point-in-time history for 30 days for disaster recovery. Deleted data can remain in that history for up to 30 days. If we restore the database from that history, we delete again what you had already asked us to delete. Uploaded files are removed when you delete them. We keep no longer-term copies of uploaded files.

Your rights

Under the LGPD (art. 18) and, where it applies, the GDPR, you can ask us to confirm that we process your data, to give you access, to correct it, to anonymize, block or delete it, to give you a copy in a portable format, to tell you with whom we share it, and to withdraw consent. You can also object to processing based on legitimate interest.

  • Self-service: in the account area, export your workspace data as JSON, download your original GEDCOM files, disconnect apps, manage or cancel your plan in the billing portal, and delete trees and your account.
  • By email: write to inbox@askgenealogy.com. We answer within 15 days.
  • Complaints: in Brazil, to the data protection authority (ANPD). In the European Union, to your national authority.

Children

The service is for people who are at least 16 years old. We do not knowingly collect data from younger people. If you think a child has an account, write to inbox@askgenealogy.com and we will delete it.

Security

All traffic uses HTTPS. Sign-in codes, sessions and invite tokens are stored as hashes. Each account can read only its own trees and the trees shared with it through a project. Cloudflare encrypts stored data at rest. No system is perfectly secure. To report a vulnerability, write to inbox@askgenealogy.com and do not include personal data.

FamilySearch

AskGenealogy has no connection to FamilySearch and does not receive FamilySearch data. FamilySearch support is planned. It stays off until FamilySearch gives written permission. If we ever turn it on, we will update this policy and ask for your permission before you connect an account.

Changes

When this policy changes, we update the version and the date above. For a material change we also notify account holders by email. The service was previously offered under another name; the provider and your rights are the same.

Contact

inbox@askgenealogy.com. For terms of use see the terms. For help see the support page.