Square brackets mark decisions still open for legal review.
Last updated: [DATE]
lineaige ("we", "us") is a genealogy research service operated by [LEGAL NAME / BUSINESS ENTITY, JURISDICTION]. This policy explains what we collect, why, and what control you have.
Account information. Your username, email address, and a hashed password (we never store the password itself). If you change your email, we keep a pending-change record until you confirm it.
Your research. The family-tree data you enter or upload: names, dates, places, relationships, notes, assumptions, and scanned or photographed records. Genealogical data is personal by nature and may describe living people — you are responsible for having the right to record information about living family members, and for deciding who you share your tree with.
Conversations with the research assistant. Messages you exchange with the built-in AI assistant, and the changes it proposes, are stored as part of your workspace so your research history is preserved.
Usage and billing metadata. We record the computational cost of your AI-assistant usage (token counts and dollar cost per request) to operate the monthly usage allowance. We never see or store your card number. We retain Stripe's webhook notifications, which can include details Stripe shares such as card brand, last four digits, and billing email, along with your Stripe customer reference and subscription status.
Sign-in history. Recent sign-ins — time, IP address, browser user-agent, and the username used — are retained for security auditing. These records are never deleted, including after you delete your account: the record stays, with the link to your account removed.
Bug reports. If you file a bug report (from the feedback dialog or by asking the assistant to file one), we store what you wrote, the page you were on, an optional screenshot you attach, and basic browser context. Bug reports are volunteered directly to the developer and are retained after account deletion — they are not part of the account-deletion sweep described under Your controls below.
[If you request an invite, we keep the email address (and any note) you submit, to send the invitation and for no other purpose.]
What we do NOT collect: no advertising cookies, no cross-site tracking of any kind. The only cookies are the session cookie that keeps you signed in and the security (CSRF) cookie.
[PENDING COUNSEL — NOT YET ACTIVE: this paragraph documents a feature that ships INERT, switched off until the founder sets a credential. Kept here so the policy is accurate the moment it IS switched on.]
Product analytics. When enabled, we record product-usage events — which features are used, and when — with a third-party analytics processor (PostHog), keyed pseudonymously by your account number, never by name, email, or username. No advertising, no cross-site tracking, no analytics cookies, and no tree data (names, dates, relationships, record content) is ever included in an event.
Only the processors needed to run the service: Fly.io (hosting, United States), Anthropic (AI processing), Stripe (payments), Amazon Web Services (email delivery), and, [when product analytics is switched on — PENDING COUNSEL], PostHog (product analytics). We do not sell or rent personal information to anyone. [CONFIRM: data-processing terms in place with each.]
Your tree is private to you unless you invite someone. Members you invite see the tree according to the role you give them. If you delete your account, trees you share with others survive for those members; trees only you can see are deleted.
Your data is kept while your account exists. Backups are retained for [N days — CONFIRM against the backup pipeline's actual rotation]. Sign-in history and bug reports are retained indefinitely, as described under What we collect above — this is a deliberate security-audit and developer-facing design, not an oversight, so there is nothing here for counsel to confirm a number for. Deleted-account data other than those two categories leaves the live database immediately and ages out of backups on the same schedule.
Servers are operated by Fly.io in the United States. [COUNSEL: add any required cross-border-transfer language for the target jurisdiction — e.g. PIPEDA if operating from Canada.]
lineaige is not directed at children and requires account holders to be at least [16/18 — COUNSEL'S CALL]. Genealogical data ABOUT children may be entered by the account holder as part of their family research, and is the account holder's responsibility.
We will post changes here and update the date above. Material changes will be announced by email to account holders.
support@lineaige.com, or [POSTAL ADDRESS if counsel advises one is required].