Privacy
Last updated: Date – to come
The short version
- My Whole Family Tree is a private, invite-only home for family trees. Trees are never public and never shown to search engines.
- We only keep what we need to run your family's tree. We don't sell anything, we don't advertise, we don't use tracking cookies, and we never use your family's pictures or words to train AI. We only count visits to our website, with Cloudflare Web Analytics – no cookies at all.
- Family trees naturally include people who never signed up — grandparents, cousins, children. If that's you and you'd rather not be on a tree, you can ask us to remove you (see "If you're on a tree but don't have a login").
- You need to be 16 or over to have a login.
- We keep a web-sized copy of every picture to show on your tree – your originals stay safely with you.
- Your tree is backed up every night in the EU. Backups exist purely to protect the data in the live working tree. Anyone who has asked not to be on a tree will never show in any tree.
1. Who we are
My Whole Family Tree (mywholefamilytree.com and app.mywholefamilytree.com) is run by Premier Selection Ltd, registered in England and Wales, company number 14539350, registered office 13 Holmes Drive, Ketton, Stamford, Lincs., PE9 3YB. We are responsible for your information (the "controller"). We're registered with the UK Information Commissioner's Office, number ZB658098.
Contact us about anything on this page: support@mywholefamilytree.com (put "Privacy" in the subject).
Our representative in the EU: EU representative – to come.
2. What we hold, and why
| What | Examples | Why we need it | The legal reason |
|---|---|---|---|
| Your login | email address, your name, a scrambled one-way version of your password, your date of birth | to sign you in, keep your account safe, check you're 16 or over | to provide the service you signed up for (contract); legal duties on age |
| What your family adds to the tree | names, dates and places, relationships, pictures, life stories, coats of arms, pets | it's the family tree — the reason the service exists | contract with the person adding it; for people without a login, our legitimate interest in letting families record their history, balanced by the right to be removed To be confirmed |
| The Family Wall and Gallery | posts, comments, pictures, likes | to share them with your tree | contract |
| Private messages | messages, subjects, your private nicknames for people | to deliver your chats | contract |
| "On now" and visits | when you were last on the tree, and each time you open it | so family can see who's around: a green dot by your name for 5 minutes in "Message someone…"; the tree's owner and super users also see who's online now, who visited each hour today and who opened the tree today | contract |
| Billing | your plan, what you paid and in which currency (£, $ or €), when it renews; money in your own pot and the tree's family pot (Chip in, gift cards), and credit from referral or gift codes (card and PayPal details stay with Stripe and PayPal — we never see them; the free trial needs no card). Refunds go back to the card or payment method you used, within 14 days. For buyers in the EU, Stripe (through its Link service) is the seller and handles the VAT, so it holds that sale's details as its own | to run paid plans, pots and codes, and charge the right tax | contract; tax law |
| After a refund or lost card dispute | your name, email, the payment reference and the date (never card numbers) | so that a second refund within 12 months is the legal minimum (your money back less the days used) rather than a full refund, and so a lost card dispute or misuse can close the tree. An ordinary refund simply returns the tree to the free plan | legitimate interests (preventing misuse) |
| A free trial used | the email address that started a free trial, and when | so each person gets one free trial | legitimate interests (fair use of the trial) How long – to come |
| Asking to look after a tree | who asked, when, and the emails we sent the owner | to give a quiet owner time to say no before someone else looks after the tree | legitimate interests (keeping the family's tree going) |
| A trusted person | who the owner has named to look after the tree if they're ever away, and when | so that person can step in straight away after a long absence, as the owner chose | contract (the owner asked us to) |
| Voice recordings | "This is me" recordings on a person's card; voice messages left for someone; voice notes on the Family Wall | so the family can hear each other — "This is me" for those the person (or whoever looks after a child's card) chooses; a voice message only for the person it was left for; Wall voice notes for everyone on the tree | contract |
| My origins | your tree's own estimate of where your family came from (worked out from your direct ancestors' places of birth), and any heritage results you choose to add | so you can see where you came from. If you choose to add your own heritage results in My origins, they're just for you – hidden from everyone else unless you tick to share them with your family. You can remove them at any time. | your own choice (your consent, given by adding them and by the share tick) To be confirmed |
| Emails we send you | that an email was sent, when, and what kind | to send sign-in links, receipts and message alerts, and to show we did | contract |
| Invitations | the email address a family member typed in to invite you, and when | to send the invitation — once. We don't send reminders. | legitimate interests (your family asked us to invite you) To be confirmed |
| "Please don't invite me again" | the email address that pressed the link, and when | so no family tree can invite that address again | your own request; we keep it until you lift it |
| Safety records | reports made with Report this, removal requests, reminders we've sent | to keep the tree safe and show we acted | legal duties; legitimate interests |
| Security records | sign-in attempts (when, the email typed, whether it worked, the internet address it came from), error logs | to stop break-ins and fix faults | legitimate interests; legal duty to keep data secure |
We don't collect: DNA, health records, government ID numbers, bank details, your contacts list or your location. We don't track you around the internet.
Sensitive details about living people. Our rules ask everyone not to add health, religion, ethnicity, sexuality, politics or similar details about a living person unless that person has said yes to it being on the tree. Reminder and report – to come
3. If you're on a tree but don't have a login
Family trees are built by families, so your name may be on a relative's tree even if you've never visited. It's only seen by the people that tree's owner has invited.
Where your details came from, and why we hold them: a relative on the tree added them — usually your name, dates and places, how you're related, and sometimes pictures or stories. We hold them so families can record their history privately (our "legitimate interest"), and you can object or ask to be removed at any time, as below.
Invited but don't want to join? We send an invitation once — no reminders. It has a "Please don't invite me again" link: press it once and no family tree can invite your email address again. Only you can lift it.
If you'd rather not be on a tree at all, use our Remove me form Link – to come. So that we remove the right person, we'll ask some questions about who you are — there may be people with similar names and dates, so we need you to be specific, just this once. Those answers are deleted once we're done. We'll ask the tree's owner to confirm we've found the right person, then clear your details. Your card will read "Private [your surname]" so the family's lines aren't broken. Your family can't change it back, and it stays that way even if the tree is ever restored from a backup. We aim to finish within one month.
More removal choices – to come
4. Children
You need to be 16 or over to have a login or to own a tree. We ask your date of birth when you join, and don't make logins for anyone under 16.
Younger children can appear on the tree as a card their family adds and looks after. Children's cards and pictures stay private to the tree and are never public.
Each login is for one person aged 16 or over. Children are always welcome to explore the tree together with a grown-up. If we're told a younger family member is using someone's login, we'll sign that login out and ask its owner to reset the password; anything reported as posted by the child goes to the Recycle bin for the owner to look at. The tree stays exactly as it is.
If we learn that someone under 16 made their own login by giving a different date of birth, we'll close that login kindly and email them. Their card stays on the family's tree, and anything they posted goes to the Recycle bin for the tree's owner to look at.
5. Who helps us run the service
We use a small number of trusted companies. Each only gets what it needs to do its job.
| Company | What they do for us | Where | Data agreement – to come |
|---|---|---|---|
| DigitalOcean | the server the tree runs on | London, UK Region – to come | |
| Cloudflare | protects the site and carries traffic to it; stores the nightly backups | backups held in the EU (Cloudflare's EU storage setting); protection worldwide | |
| Cloudflare Web Analytics | counts visits to our website – which pages are read, how visitors found us and which country they're in; no cookies, and nothing that follows you around the internet | worldwide (Cloudflare's network) | |
| Postmark (ActiveCampaign) | sends our emails | USA To be confirmed | |
| UptimeRobot | checks the site is up (it doesn't see your data) | To be confirmed | |
| Stripe | takes payments for paid plans; for buyers in the EU, Stripe (Link) is the seller and handles VAT | UK / EU / USA | |
| PayPal | an extra way to pay for buyers in the UK and US (through Stripe) | UK / USA To be confirmed | |
| OpenFreeMap | supplies the map pictures on the tree's maps; like any website, it sees your device's internet address when a map loads – no cookies, no account | EU (servers rented from Hetzner, a German company), delivered through Cloudflare | |
| OpenStreetMap (its place search, Nominatim) | finds where the towns on your tree are, so they can go on the map; our server asks it, not your device, and only ever sends the town (never a street or house number) – each place once, for the whole site | UK (OpenStreetMap Foundation, a UK charity); its servers may be elsewhere in Europe – only our server asks it, and only for town names |
Where any of them handle information outside the UK or EU, we rely on the legal safeguards the law provides for that (such as approved contract clauses). To be confirmed
We don't sell, rent or trade your information, and we don't share it with advertisers. We'd only hand anything to the police or a court if the law required us to.
6. How long we keep things
| What | How long |
|---|---|
| Your login | while you have it; removed when you delete your login To be confirmed |
| A family tree | as long as the tree exists. A deleted tree goes into a bin for 90 days so it can be rescued, then it's gone |
| Your tree's own history | the newest 50 versions plus one a month, so the owner can put the tree back to an earlier day |
| Off-site backups (EU) | each night's copy for 30 days; one a month for 12 months; then deleted To be confirmed |
| Pictures in the Recycle bin | 60 days, then gone |
| A deleted message | can be put back for 30 days by the person who deleted it |
| Remove me requests | the answers you gave are deleted when we've finished; unconfirmed requests after 30 days. We keep only a short record (which tree, which card, the date, a reference) so the lock can never be undone by accident |
| Billing records | as long as tax law requires To be confirmed |
| The record after a refund or lost card dispute | 12 months, then deleted |
| A paid tree whose membership has ended | the owner and the 199 people closest stay open on the free plan; the rest of the tree is kept safely for 12 months so renewing can bring it back, then deleted |
| Before that hidden part is deleted | 30-day warning email – to come The tree's owner can download the whole tree at any time — paid, free or after a membership ends |
| Voice notes on the Family Wall | 30 days, unless someone presses Keep (it then becomes one of their saved messages) |
| Voice recordings on a card | until the person (or whoever looks after a child's card) deletes them. If a paid membership ends, they're kept safely but can't be played until it's renewed |
| Heritage results in My origins | until you remove them |
| A free tree nobody signs in to | 90 days after the last sign-in (we email at 60 and 80 days), then deleted |
| Money in a pot, and gift card value once added | kept for the tree or person until it's used — it doesn't expire. A gift card code must be used within 2 years |
| Sign-in tries and tree visits | 90 days, then deleted |
| Error logs | To be confirmed |
| An invitation | until it's used or runs out (7 days); the line saying it was sent stays with the tree's email record |
| "Please don't invite me again" | until you lift it yourself |
Backups and privacy. Backups exist purely to protect the data in the live working tree. Every "Private [surname]" lock is recorded in a separate privacy ledger that isn't part of the backups, and it's re-applied automatically whenever anything is restored — before anyone can see the tree. Anyone who has asked not to be on a tree will never show in any tree.
7. Keeping it safe
- Every tree is behind a sign-in, and each person only sees and does what the tree's owner allows.
- Passwords are never stored — only a scrambled one-way version.
- All traffic is encrypted (https) and passes through Cloudflare's protection before reaching our server.
- Pictures are made smaller and saved fresh when uploaded, which removes hidden details such as where a photo was taken. To be confirmed
- We only keep the web-sized copy. The original picture — and any family-tree file or zip you bring in — is never kept by us; your originals stay with you.
- Private messages can't be read by the tree's owner. We don't read them either, unless someone reports a message to us.
- If something ever goes wrong, we'll tell the regulator within 72 hours where the law requires, and tell you if your information is at risk.
8. Cookies
We only use what's needed to sign you in, keep the site safe, and remember choices you made yourself — so there's no cookie banner. Details: the Cookies page.
9. Your rights
Wherever you live, you can ask us to:
- see what we hold about you;
- download your information. Anyone on a tree can download a copy of it (unless the owner keeps the copy private — then you can ask them). Every copy is the tree and its pictures only: no logins, email addresses, messages or chats, and anyone who asked not to be on the tree stays private in every copy. Anyone on a tree may copy what's shared there for their own family use, including starting a tree of their own; making a picture public needs the say-so of the person who added it;
- correct something that's wrong;
- remove you — "Delete my login" removes your sign-in; "Take me off this tree" makes your card Private; people without a login can use Remove me;
- limit or object to how we use your information.
Email support@mywholefamilytree.com. We'll reply within one month. We may ask a question or two to make sure it's really you.
If you're unhappy with how we've handled something, please tell us first. You can also complain to the Information Commissioner's Office (ico.org.uk) in the UK, or the data protection authority where you live in the EU.
US residents: we don't sell or share personal information for advertising. If your state gives you further privacy rights, email us and we'll help.
If someone has died: a relative can tell us and ask us to close that person's login. Their card stays on the family's tree as part of its history.
If the business moves: if My Whole Family Tree ever moves to another company, your information moves with it under the same promises in this policy. We'll tell you before it happens.
10. Changes to this policy
If we change this page in a way that matters, we'll email everyone with a login and show the change next time you sign in. The date at the top always shows the latest version.
Questions? support@mywholefamilytree.com