Privacy

In force from 7 October 2026

This says what SukuTree knows about you and your relatives, why, who else handles it, how long it is kept, and what you can do about it. The controller is AJ-Group, business ID 1891345-7 (VAT FI18913457), Lohja, Finland. Write to contact@aj-group.net about anything here.

1. What we hold

We hold only what the service needs: to show and share your trees, to keep your account safe, to take payments and to keep the records the law requires. Nothing here is gathered to watch you or your relatives, and we do not sell it, show advertising or build profiles from it.

Your account: your email address or phone number, the name you chose to show, your language, when you last signed in, when you accepted the terms of use, your passkeys (their public half only), and the sessions that keep you signed in.

Your trees: the people you add, how they are related, dates, places, notes, portraits and gallery pictures, a phone number, street address and email address where you typed one on a person's card, and who you shared each tree with. For every person and picture we also keep which member added it. Much of this is about other people, living or not; you decide what goes in.

A tree's public page, if its owner makes one: its address, what it shows, the people hidden further on it, and when the owner confirmed they have the consent of the living people it shows.

Payments: what you bought, when, the amount, Stripe's fee and Stripe's reference numbers. Never a card number: that stays with Stripe. For 30 days after a Family print is made, a note of when and in which tree, so that a withdrawal can tell a plan that was used from one that was not.

Codes from leaflets: which code you used, when, and the free time it gave or the payment it moved, kept with your account and deleted with it. How often a code's page is opened is counted, with nothing about who opened it.

Voice: how many seconds of speech were used each month. The recording itself is not stored; see section 3.

Security records: the network address a sign-in code was asked from, kept with the code to slow down guessing, and a hashed form of the addresses invitations were sent to, to cap unwanted mail.

Email: when news about a tree was last sent, and, if you stop those emails, that you did. The emails we send are listed in section 2.

Cookies in the app: one that keeps you signed in, one for your language, one for the theme and one for the tree you have open; and, for at most two hours, one that remembers a plan you chose on the website until the plan screen has shown it. None for advertising or for following you around, and no analytics service. A tree's public page sets no cookies. Two more keep signing in safe: while you sign in, one ties the code to the browser that asked for it (an hour at most), and one remembers, as keys nobody can read, which addresses have signed in on this browser before, so that other people's wrong codes never hold you up there (a year).

The website (sukutree.fi): if you send the access request or the contact form, your name, your email address, your message, the language of the page and the time. Access requests are deleted after 12 months. Messages you send us, from the website or from the app, reach us by email and are kept for as long as the matter needs and at most 36 months after your last message. Either is deleted at once if you ask. To stop junk, the forms count submissions per network address using a salted hash that cannot be reversed, held in memory for at most an hour; the address itself is not stored. The website loads nothing from other servers and sets no cookies, except that while it is still behind a password one cookie remembers that the password was entered. Your choice of theme is kept in your own browser.

The demo on the website: what is typed into its invented family (names, dates, towns) is seen by the others in the same room, up to five other visitors, and is kept only in the server's memory, never stored: it is gone when the room starts over, every 30 minutes at most, or when nobody has been in it for two minutes. It has no account and sets no cookies; the page holds a random key for the visit and forgets it on closing. To stop abuse it counts how often a network address opens it, as a salted hash that cannot be reversed, kept in memory for about ten minutes. Please do not type anything about real people into it. The ground is our legitimate interest in showing how the service works.

Like every web server, ours handles technical data (network address, time, the page asked for, the browser) to deliver pages, keep them secure and find faults. These logs are kept for a limited time.

2. Why, and on what ground

To provide the service you asked for: your account, your trees, sharing, payments, and answering an access request (performance of a contract, and steps taken at your request before one).

Email that belongs to the service: sign-in codes, an invitation when somebody shares a tree with you, notices about your plan, your pictures or your account before anything changes, the code that confirms deleting your account, the code that confirms it is you before passkeys or an email address are changed or all your data is downloaded, a notice when a passkey is added to your account or removed from it, and a notice when wrong sign-in codes have been typed for your address (performance of a contract).

If you own a tree: an email when somebody other than you changes who can see it, for example when an editor invites somebody or an invitation link is used. It is about who can read your family's data, so it has no off switch (our legitimate interest, and yours, in you staying in control of your tree).

If you are on a shared tree: news about it when other members have added a lot (5 people or 10 pictures), at most once every 7 days per tree, never about what you added yourself, and only after you have signed in and accepted the terms. Every such email has a link that stops them, for that tree or for all trees, without signing in (our legitimate interest in the members of a shared tree hearing that it has grown; you can object at any time with that link).

A tree's public page: shown because its owner chose to publish it; for the living people on it, the ground is their consent, which the owner confirmed they have before making it. Anybody shown on it can object; see section 5.

When an account is created, the people who run SukuTree get an email with its address or number and how it arrived (sign-up or invitation), to know who uses the service and to notice abuse (our legitimate interest).

To answer a message you sent us (our legitimate interest in replying to people who write to us).

To keep it safe and honest: throttles, the check before a sign-in code is mailed, the cap on invitation mail (our legitimate interest in a service that works and is not abused).

Because the law says so: payment records for bookkeeping (legal obligation).

We do not sell data, show advertising, or build profiles. What is in your trees is used to show your trees, and for nothing else.

3. Who else handles it

Servers: everything is stored on our server in Hetzner Online GmbH's data centre in Helsinki, Finland. Email is sent from our own mail server. What you send with the website's forms stays there and is not transferred outside the European Economic Area.

Stripe handles payments (Stripe Payments Europe, Ireland). Stripe may process data in the United States under the European Commission's standard contractual clauses and the EU–US Data Privacy Framework.

AI services handle voice, pasted text and one lookup of places, and all of them are European companies: Mistral AI (Paris, France) reads what was said or pasted, and the place names; Scaleway (Paris, France) turns speech into text in its Paris data centres. If one of them is unavailable, the same task goes to the other, or to OVHcloud (Roubaix, France). When you use the microphone, the recording is sent together with what is needed to understand you: the names, dates and places of the people in that tree whom it may mean. Separately, when you open Print, the place names typed under "Lives in" are sent, without any names, to find which country each is in, so that the pages of people can be grouped by country; each answer is kept on our server, so the same place is not sent twice. Reading a pasted family history works the same way: the text you paste is sent together with the names and dates of the people in that tree whom the text names, and what comes back is a proposal you confirm. The app says so before your first paste. Nothing else is sent: no pictures, no phone numbers, addresses or email addresses, and no recording unless you press the microphone. The first time you press it, the app says so before it starts. None of these services uses what it receives to train AI models. Mistral AI hosts it in the European Union and keeps it for up to 30 days to watch for abuse; Scaleway keeps none of it, except for up to 14 days when a request disturbs its service and has to be looked into; OVHcloud keeps only what billing needs.

The people you share a tree with see what is in that tree, and your name and the email address or phone number you sign in with, as its owner or member.

If a tree's owner makes a public link for it, anyone who has the link, and the visitors of any website it is put on, see the tree as the owner chose: names, and where the owner allows it, dates and portraits. Phone numbers, addresses, email addresses, places, notes and gallery pictures are never shown there, and nobody's card can be opened. The owner can hide single people and stop the link at any time.

Nobody else, unless a court or an authority requires it by law.

4. How long

Your account and trees: until you delete them, or until the account is deleted as unused.

A Free account nobody has used for 24 months is deleted with its trees, after 6 warnings by email. An account on a paid plan is never deleted for that reason.

Gallery pictures: removed 30 days after the notice that follows the end of a paid plan. A person or a gallery picture you remove yourself is kept for 30 days so that it can be brought back, and is then deleted for good, files included.

Sign-in codes: ten minutes; the record that one was asked for (when, from which network address, and how many wrong tries it had) a week longer, to stop guessing. Sessions: 30 days; a year for an account opened with a phone number or through an invite link, which has no mailbox to let itself back in with. A session not kept on the device (the choice at sign-in) ends after 30 minutes without use, and after 12 hours at most.

Payment records: at least six years after the end of the financial year, as the Finnish Accounting Act requires. They are kept even if you delete your account, because the law requires it. Our own records then hold only an internal number, the amount and the dates, not your name or email address; Stripe keeps the invoices it issued, which do name you, for the same reason.

5. Your rights

A copy: download everything in the trees you own from the account menu, as files other programs can read, pictures included.

Correction: change anything in your trees and your account yourself.

Deletion: delete your account in Plan and billing. It is immediate.

You may also ask us what we hold, ask us to limit or stop a use, or object to one.

If you are in somebody's tree and do not want to be, ask the person who added you; if that does not settle it, write to us and we look into it.

If you are shown on a tree's public page and did not agree to it, ask its owner, or write to us: we hide you on that page while the matter is settled.

You may complain to the Data Protection Ombudsman in Finland (tietosuoja.fi), or to the authority of your own country.

6. Children

Accounts are for people of 13 and over. Children may of course appear in a family's tree; their parents decide what is written there.

7. Security

Connections are encrypted. Codes and session keys are stored only as hashes. Passkeys never leave your device. Deleting an account needs a code from its mailbox, so a device left signed in is not enough. Adding or removing a passkey, adding an email address and downloading all your data need a sign-in from the last 10 minutes or a confirmation, with a passkey or a code from the mailbox; the mailbox is told whenever a passkey is added or removed. A sign-in code works only in the browser that asked for it. After 10 wrong codes for one address within 7 days, its new codes are 10 digits long until those days have passed, except in a browser that has signed in with it before; nobody is kept out, and the mailbox is told.

8. Changes

We tell you by email at least 30 days before a change of substance to this text takes effect.