Privacy policy

This Privacy Policy explains how Dearest Forever ("we," "us," "our") collects, uses, and shares information when you use our family tree design application and related services (the "Service").

1. Information we collect

Information you provide

• Account information — email address and authentication-related identifiers, and, if you sign in with Google, the name and profile picture on your Google account
• Project/family tree data — names, relationships, dates, places, notes, photos, and obituaries you choose to provide
• Order information — shipping address and details needed to fulfill physical print orders
• Support communications — information you share when contacting us

Information about other people

A family tree is mostly information about other people, and most of them will never use this service. When you add a relative you may record their name, their relationships, dates and places connected to them, notes, and photographs of them. We hold that information because you asked us to, in order to build and print the tree you are making.

We do not use it to build profiles, we do not combine trees from different accounts to make a larger record of anyone, and we do not make it searchable. Within one tree, the page opened from the code on a printed tree lets the people allowed to see that page search that tree by name; nothing is searchable across trees or across accounts. A tree is visible to the account that made it, to the people it is shared with (including family approved after asking from a printed tree), to anyone holding a link that account has shared, and to anyone holding a print whose code its owner has opened to anyone. If you believe you appear on a tree and you want that changed, see “If you appear on someone else’s tree” below.

Faces in your photos

If you choose a photo layout, where each person’s photo fills their place on the chart, the designer looks for the faces in your photos so it can frame each person well. This happens in your browser. It finds where a face is, never whose face it is, and it creates no face template or other biometric identifier. The face positions it finds stay on your device. What you choose for each photo, such as where it sits and how far it is zoomed, is saved with your tree like your other design choices.

Information collected automatically

• Basic technical data — device and browser information, IP address, and diagnostic logs (primarily for security and reliability)

Payment information

Payments are processed by Stripe. We do not store your full payment card number. Stripe may collect and process payment information under its own privacy policy.

2. How we use information

We use information to:

• Provide, operate, secure, and maintain the Service
• Create and render your family tree designs and previews
• Read an obituary you add and suggest facts from it for you to review
• Process transactions and fulfill physical print orders you request
• Provide customer support and communicate with you about your account or orders
• Prevent fraud, abuse, and security incidents
• Comply with legal obligations

3. How we share information

We do not sell your personal information.

We share information only in limited circumstances:

Service providers

We use a small number of companies to run the service. They may only use what they receive to do work for us, and they must protect it. Where a company works behind the scenes we describe it by what it does; where you deal with a company directly, or it sets cookies in your browser, we name it. You can ask us for the names of any of them at any time.

• A database, sign-in and file storage provider. Family tree content is encrypted at rest.
• A website hosting and delivery provider, which also runs the challenge that protects our forms from bots.
• A hosting provider for two programs of ours: the one that writes the short biographies described under “The page behind the code on a print,” and the one that reads an obituary you add, described under “Obituaries you add.” Each reads a tree only while it works and deletes its working copy when it finishes.
• An AI service provider, only if you choose “Read it for me” when you add an obituary, to suggest facts from its text as described under “Obituaries you add.” We use only a provider that is barred by contract from training its models on what we send, and that deletes it within 30 days unless it must keep it longer to prevent misuse or to comply with the law.
• An email delivery provider, for messages such as order confirmations and account emails.
• A shipping provider, for shipping labels and delivery tracking.
• Stripe — payments (see below)
• Google — sign-in, if you choose to continue with Google, which gives us your name, email address and profile picture; a private spreadsheet we use internally to manage orders; and address suggestions (Google Maps Places), which receives the shipping address text you type at checkout and your IP address
• PostHog and HubSpot — analytics and live chat, described in section 6
• FamilySearch — only if you choose to connect it, and only to read the tree you authorise

Some pages embed video from Vimeo or YouTube. Playing one lets that provider see your IP address under its own privacy policy.

Where information is processed

We are based in the United States and our providers process information in the United States and other countries. If you are in the United Kingdom, the European Economic Area, or Switzerland, this means your information is transferred outside your country. Where that transfer needs a legal basis, we rely on our providers’ standard contractual clauses and equivalent safeguards.

Order fulfillment

If needed to produce and deliver your physical prints, we may share limited information (such as your shipping address and order details) with printing, framing, or shipping providers. We share only what is reasonably necessary to fulfill your request.

The page behind the code on a print

If the person who ordered a print chose it, the print carries a small code. Scanning it opens a page about the tree, and the tree’s owner chooses who can see it.

By default the page shows the tree only to people signed in to an account with access to that tree: the people it is shared with, and family approved after they ask. Anyone else sees the tree’s name and a way to ask. Approved family see the tree the way a shared link shows it, living relatives included, along with anything the family has written on a person’s About tab. Asking shows the tree’s owner and editors your name, your email address, and any note you add.

The owner can instead let anyone holding the print open the page without signing in, and that includes anyone who scans the code from a photo of the print. The page then cuts a living relative’s birth date to the year and leaves out their birthplace, their notes and their About tab.

For people who have died, the page may also show short biographies we compose from the names, dates and places entered on the tree, from what the family has written on a person’s About tab (including facts they confirmed from an obituary), and from the general history of those places and times, using our own software and no outside writing or AI service. The owner can turn the page off at any time; a page someone already opened can stay viewable for up to two hours.

Obituaries you add

You can add a person’s obituary to their About tab. We keep its text with the tree, and our software reads it to suggest facts for the book and the biographies: dates, parents, marriages, work, service and the like. You then review every suggestion, untick or correct anything wrong, and answer any question where the obituary and the tree disagree. If you leave the review part way, the suggestions that were already ticked are kept, and you can change them later. The obituary’s list of surviving relatives is used only to check who was living, and is never printed.

When you add an obituary you choose how it is read. With “Only the basics,” our own software reads the dates, the family and the service details, leaves the rest unread, and nothing is sent outside our service. With “Read it for me,” our software reads those parts first, then sends the rest of the obituary to an AI service to suggest the other facts it mentions. Before anything is sent, we remove the sentences that list surviving and deceased relatives and the funeral, viewing and burial details. What is sent still names the person who died, and may name other people the obituary mentions elsewhere, such as their parents or spouse; we also send the person’s name and, if you gave it, the newspaper. The AI service is not given your family tree. We keep its answer, so an obituary with the same text is never sent twice.

With your authorization

We may share information when you direct us to do so (for example, if you request a feature that sends information to a third party).

Legal and safety

We may disclose information if required by law or if we believe disclosure is necessary to comply with legal process, protect rights and safety, or prevent fraud and abuse.

Business transfers

If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

4. Your choices and controls

Project storage is optional

The Service may store your projects so you can return later. If you choose to keep your project data stored with us, you do so voluntarily. We use reasonable safeguards, but no system can guarantee absolute security.

Deleting a tree or your whole account

You can delete an individual family tree at any time from inside the designer, and you can delete your entire account from Account settings. Deleting the account removes your trees, their photos, and your sign-in. It takes effect straight away and does not need to go through us.

If you cannot sign in, email [email protected] from the address on the account and we will do it for you. We may ask you to verify your identity first.

We may retain certain information as required by law or for legitimate business purposes (e.g., transaction records, dispute resolution, and security logs). Backups may persist for a limited period.

Your rights over your information

Wherever you live, you may ask us for a copy of the information we hold about you, ask us to correct it, ask us to delete it, or object to a particular use. Email [email protected] and we will respond within the time your local law allows. We will not treat you differently for asking.

If you are in the United Kingdom, the European Economic Area, or Switzerland, you also have the right to receive your information in a portable form, to withdraw consent where we rely on it, and to complain to your national data protection authority. If you are in California, we do not sell or share your personal information as those terms are defined by the CCPA, and we have not done so in the past twelve months.

If you appear on someone else’s tree

You can ask us to remove information about you from a tree you did not create. Email [email protected] and tell us as much as you can: the link you saw, the name shown, and who you believe entered it. If you saw it on a page opened from a printed tree, send the address your phone opened, or a photo of the print; either lets us find the tree.

We ask for that detail for a reason worth stating plainly. Tree contents are encrypted, and we deliberately keep no searchable index of the people inside them, so we cannot look someone up by name across the service. Building that ability would mean creating exactly the searchable record of living people we do not want to hold. Given a link or an account we can act quickly; without one we may need to ask you for more before we can find the right record.

Email preferences

If you opt in to emails about future updates, you can opt out at any time by contacting us or using the unsubscribe link if one is provided.

5. Data retention

We retain information for as long as needed to provide the Service, fulfill orders, and meet legal and security obligations. You may request deletion as described above.

When a tree or an account is deleted, its photographs and any scans you uploaded are moved to private storage that only we can reach and are permanently destroyed 30 days later. That window exists so an accidental deletion can be undone; after it passes the files are gone and cannot be recovered by anyone, including us. Database backups are kept on a rolling basis for disaster recovery and age out on their own.

An obituary you remove from a person can be restored until its tree is deleted, and deleting the tree deletes its obituaries. The answers the AI service gave us for an obituary, which never include the parts we removed before sending it, are kept apart from any one tree so the same text is never sent twice; we delete them on request.

6. Analytics and cookies

Essential cookies. Some cookies are required for the Service to work at all: they keep you signed in, protect forms from abuse, and remember the analytics choice described below. These are always set, because without them the Service cannot function.

Analytics. We use PostHog to understand how the site is used. It records pages viewed, how long a visit lasts, basic device and browser information, page performance, and a small number of events we define ourselves, such as completing an order. We do not use its automatic click tracking. Requests are sent through our own domain rather than directly to PostHog, and PostHog sets a cookie so repeat visits are recognised as the same person.

Session recordings and click maps. Only if you actively say yes on the banner (or in Account settings), PostHog also records how you move through our pages, such as scrolling, mouse movement and clicks, and builds maps of where people click, including clicks that go nowhere or are repeated in frustration. We use this to find what is confusing. Every typed field and every piece of text on the page is masked in your browser before anything is sent, so recordings do not contain what you type or the names and dates in your tree. We never record the sign-in, checkout, payment, redemption, account or contact pages. Simply visiting never starts a recording, even where analytics runs by default, and saying no or switching Analytics off stops it at once.

Live chat. We use HubSpot to run the chat widget so you can reach us. It sets its own cookies. It does not appear during checkout, and it does not appear on pages reached through a private link.

Purchases. When an order completes, our server sends PostHog a record of the sale so we can see revenue accurately even if your browser blocked the page script. That record includes your email address, the amount, the currency, the product, and the payment reference. It does not include your name, your postal address, your payment details, or anything from your family tree.

Your choice. If you are in the UK, the EU or the European Economic Area, or in Switzerland, nothing above is loaded until you agree. Everywhere else, analytics and chat start when you arrive and you can switch them off at any time. In both cases the choice is offered on a banner the first time you visit, and it is remembered for a year.

Do Not Track and Global Privacy Control. If your browser sends either signal, we treat it as a request not to be measured, we do not show you the banner, and we do not ask again. If you have an account, that choice is recorded on our side too, so it applies to the purchase records described above and not only to your browser.

Changing your mind. If you have an account, open Account settings and turn Analytics off or on. The change takes effect straight away, and applies to your account as well as this browser. Otherwise, clear this site's cookies to be asked again, or email [email protected] and we will switch analytics off for you.

Pages reached by a private link. A shared tree, the page opened from the code on a printed tree, an order status page, a gift link and a family calendar each carry a token in their address. We load no analytics and no chat on those pages at all, so the link itself is never sent to an analytics or chat provider.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. Family tree contents are encrypted where they are stored. However, no online service can guarantee absolute security.

If we discover a breach affecting your personal information, we will notify you and the relevant regulators where the law requires it, without undue delay, and tell you what we know and what we are doing about it.

8. Children's privacy

The Service is not intended for use by children under 13, and we do not knowingly let a child under 13 create an account. If you believe a child under 13 has created one or provided personal information directly, contact us and we will take appropriate steps.

This is separate from the children who appear on a family tree. An adult building a tree will often record their own children and grandchildren, and that information is handled the same way as the rest of the tree described in section 1: held because the account holder entered it, never made searchable, and removable on request.

9. Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify you (for example, via an in-app notice). Continued use after changes means you accept the revised policy.

10. Contact

Privacy questions or requests:
[email protected]

Dearest Forever