Privacy policy

Draft for review · 2 November 2026

This notice describes the OpenFamilyTree desktop application and the browser application at openfamilytree.com. It covers the current application's behavior; separately hosted copies may have different website operators and hosting arrangements.

Your family tree stays on your device

When you import a GEDCOM or GEDZIP, OpenFamilyTree stores people, families, events, notes, citations, research records and imported media locally. These may include information about living people and sensitive records such as health and DNA information. Importing and editing a project does not upload it to the OpenFamilyTree website.

The desktop app uses its local application data directory. The browser app uses IndexedDB for the website's origin in your browser profile. Preferences, recently selected people and derived search indexes are also local. Browser data is specific to that browser profile; private browsing, browser cleanup, storage limits or eviction can remove it.

Project data is not encrypted by OpenFamilyTree as a whole. Access to your device, user account, browser profile, exports and backups affects who can read it. Signing in alone does not upload a project.

Optional accounts

Sign-in is optional. Choosing Google, Microsoft or an email sign-in link uses Firebase Authentication and the selected identity provider. The account service receives your Firebase user identifier, identity tenant when configured, name, email address, email verification status and sign-in provider. This does not upload or synchronize your genealogy projects, media, DNA kits or research cases.

AWS API Gateway and a Go Lambda service establish account sessions. DynamoDB stores session identity, hashed random session identifiers and expiry dates. Browser sessions use an essential HttpOnly cookie for up to seven days; desktop sessions last up to thirty days and their local token is encrypted in the application's private storage. A desktop sign-in opens your browser and returns a short-lived, single-use code to the app through a loopback address; proof-of-possession is required to redeem it. Signing out revokes that session and clears the client credential. Expired records are rejected immediately and removed asynchronously by DynamoDB TTL; point-in-time recovery can retain earlier database states for up to thirty-five days. Runtime logs are retained for fourteen days; authentication tokens and email-link codes are not intentionally logged.

The configured Firebase project manages account identities and email delivery. Deleting local projects or signing out does not delete a provider account or the Firebase identity. Account deletion and operator contact details still require the publication review below.

Optional cloud projects

Choosing Save to cloud uploads tree records, source GEDCOM/GEDZIP imports and attached media to private AWS storage. DNA kits, match results and research cases require the separate inclusion choice. Original source files may themselves contain sensitive data. Integration credentials and MCP access tokens are not included.

Cloud projects use the signed-in account identity. Binary files and revision manifests are stored in S3; project metadata, quota accounting and revision references are stored in DynamoDB. Transfers use TLS and stored cloud data uses AWS-managed encryption. This is not end-to-end encryption. Images download on demand into the local working cache.

Deleting a cloud project removes it from the library immediately. Revision recovery and unreferenced files are retained for thirty days; noncurrent S3 object versions may remain for a further thirty days, and database recovery copies for up to thirty-five days. Browser sign-out removes account project entries and private download caches. Unreferenced internal working-record bodies can remain in browser storage until workspace cleanup or Clear site data; sign-out is not a forensic erasure operation. Export local work before clearing site data.

Optional archive integrations

Desktop archive tools are available when you enable the relevant integration. Searches send the search terms and filters you or your connected MCP client supply, such as names, dates and places, to the chosen archive service. Record requests send archive and record identifiers. These requests also reveal ordinary connection information, including your IP address, to that service.

Saved integration settings and credentials use separate encrypted local storage and are excluded from project, GEDCOM and project-backup encoders. On macOS the encryption key is held in Keychain; on Windows it is protected by the operating system's user-bound encryption. On other desktop builds the key is a restricted local file. This protects stored settings, but does not prevent software running with access to your account from using them.

Disable an integration to stop exposing its tools. Disabling WieWasWie retains the saved account for later use; Forget account removes its saved username and password. Deleting an OpenFamilyTree project does not delete your archive account or copies retained by the archive service. Those providers control their own records and data-handling policies.

MCP and external assistants

MCP is optional and desktop-only. When enabled, OpenFamilyTree runs a token-protected service on the device's loopback address. A connected client can read the current project and selected person and use enabled archive tools. When Allow edits is on, it can also make validated changes that enter the application's undo history and saving workflow.

If you connect an assistant such as Codex or Claude, that client may send tool results, family records and archive findings to its AI provider according to its own settings and policies. OpenFamilyTree's local storage does not keep those results local after you give them to an external client. Choose clients and permissions carefully, and disable MCP to stop new access. Copies already received by a client are controlled by that client and provider.

Exports, links and other applications

Exports, reports, clipboard copies and project backups create copies under your control. The living-person and private-record settings affect supported reports and data exports; project backups retain the complete tree. Optional preparer details can include your name, email and postal address in exported material. Review the content before sharing it.

Opening an external archive or media link sends a request through your browser to that site's operator. Opening a managed media file in another application makes a temporary local preview copy; the app attempts to remove it after an hour. Other applications and operating-system backups may retain their own copies.

Website connections

The website delivers the application through AWS S3 and CloudFront; the deployment health endpoint uses API Gateway. Visiting the site transmits ordinary request information needed to deliver it, including an IP address and requested resource. The current application has no advertising, analytics or automatic telemetry upload, and sets no tracking cookies. It uses browser storage for application data. The deployed infrastructure's service/security processing and retention must be confirmed by the website operator before final publication.

Retention and deletion

Local projects remain until you delete them or clear the application's storage. Use project deletion to remove a project's managed local data. In the browser, clearing site data also removes local projects and preferences. Derived caches can be cleared in Storage settings. Export a backup before clearing data you want to keep.

Deleting a local project does not delete the original file you imported, exported files, clipboard history, operating-system backups, archive records or copies held by an external MCP client. Remove those separately where appropriate. Browser storage is not a backup, and the website operator cannot recover a tree stored only on your device.

Operator and privacy contact

Pending confirmation before final publication.