Your Family Tree

Your family. Your records. Your rules.

A family tree is one of the most personal things you'll ever build online. This page is our security knowledge base — written in plain English, no fine print, no jargon.

Our promise in one line: We never sell your data, we never claim to "find" ancestors that don't exist, and you can take everything with you and delete your account at any time.

Part 1

How we protect your data

The technical safeguards working quietly in the background.

Everything is encrypted

All data — names, dates, photos, notes — is encrypted in transit (TLS 1.2+) and at rest on managed Postgres. Photos live in a private storage bucket with random unguessable filenames, and the app serves them through short-lived signed URLs (one-hour expiry) — there's no public link anyone can hot-link or share.

Row-Level Security on every table

Our database enforces that you can only ever read or change rows tagged with your user ID. Even if a bug in our app code asked for "all family members," the database itself would refuse to return anyone else's records. This is a hard wall, not a polite suggestion.

Passwords you don't have to invent

We use Lovable Cloud authentication with bcrypt-hashed passwords (we never see the plaintext) plus optional Google sign-in. New passwords are screened against the Have I Been Pwned database, so a password leaked in another breach can't be reused here.

Server-side input validation

Every form submission is re-validated on our servers using strict schemas — surnames, birth years, place names, and notes all have length limits and character rules. This blocks injection attacks even if a browser is compromised.

Payments handled by Stripe

Card numbers never touch our servers. Checkout is hosted by Stripe (PCI-DSS Level 1). We only store your subscription status and a customer reference — no card data, no CVV, nothing reusable if our database were ever breached.

No tracking pixels, no ad networks

We use one cookie: the one that keeps you signed in. No Facebook pixel, no Google Ads remarketing, no third-party analytics that profile you across the web.

Part 2

Privacy by design

The defaults are the safest setting. You opt in to everything else.

Cousin matching is opt-in only

Your tree is private by default. The only way another user can see overlapping ancestors is if you flip the "share for matching" switch in your profile. Even then, only ancestor names + birth years/places are exposed — never your living relatives, photos, notes, or contact info.

No DNA, no SSNs, no fabricated facts

We don't ask for, store, or sell DNA. We don't ask for Social Security numbers. Our AI explains general history and research strategy — it never claims to have "found" a specific ancestor, and it never invents records, census entries, or birthdays.

Living relatives are treated differently

We strongly recommend marking living people as "living" in their notes. Anything tagged this way is automatically hidden from cousin-matching exports, even if you later turn matching on.

Export or delete anytime

You own your tree. Download a full GEDCOM file (the universal genealogy format accepted by every other family-history app) on demand, or ask us to permanently delete your account and we'll wipe everything within 30 days.

Part 3

Habits that keep your tree safe

The strongest lock in the world won't help if you tape the key to the door.

Account hygiene

  • • Use a unique password. A password manager (1Password, Bitwarden, iCloud Keychain) makes this effortless and free.
  • • Enable Google sign-in if you'd rather not manage a password at all — it inherits your Google account's two-factor protection automatically.
  • • Sign out on shared devices (library, hotel, family computer). Anyone with your open session can read your whole tree.
  • • Don't share screenshots that reveal living relatives' birth dates, addresses, or phone numbers — those are gold to identity thieves.

What to put in (and what to leave out)

  • • Safe to add: names, birth/death years, hometowns, photos, family stories, occupations, immigration details.
  • • Think twice before adding: medical history, adoption details, estrangements, mental health notes, financial details. Once it's typed, it's stored — and family dynamics change.
  • • Never add: Social Security numbers, passport numbers, bank details, current home addresses of living people, or anything you wouldn't want a future descendant to read aloud at Thanksgiving.

Sharing your tree responsibly

  • • Ask permission before adding details about living relatives — especially anything they haven't shared publicly themselves.
  • • Leave cousin matching off until you're emotionally ready to be contacted by previously unknown relatives. The conversations can be wonderful, but they can also be heavy.
  • • If you export a GEDCOM to share, open it in a text editor first and remove any living-person details you don't want circulating.

Part 4

Your rights at a glance

Everything you can ask for, and how to get it.

Right to access

Ask us for a copy of everything we hold about you. We'll send a JSON or CSV bundle within 7 days, free of charge.

Right to portability

Download a standard GEDCOM file from your tree page anytime. It works in Ancestry, FamilySearch, MyHeritage, RootsMagic, and dozens of other apps.

Right to erasure

Email us and we'll delete your account and all associated data within 30 days. We'll confirm in writing when it's done.

Right to correct

All your data is editable inside the app — names, dates, notes, photos, the matching opt-in. Nothing is locked.

Reporting a security issue

If you spot something that looks wrong — a way to see another user's data, a strange email pretending to be us, anything at all — please tell us right away. We'd rather hear ten false alarms than miss one real bug.

Email security@lineage-dig.lovable.app with steps to reproduce. We respond within two business days and we won't pursue legal action against good-faith researchers who follow responsible disclosure.

Please don't test on other users' accounts. If you need to demonstrate an issue, use a second account of your own.

Last updated April 2026. Questions? Read our about page or just reply to any email — a real human will answer.