Privacy policy

Translation for convenience. The German version is legally binding.

1. Controller

[LEGAL_NAME missing]
[LEGAL_STREET missing]
[LEGAL_ZIP_CITY missing]
Germany
E-mail: [LEGAL_EMAIL missing]

We have not appointed a data protection officer because we are not legally required to.

2. In short

• We use no analytics or advertising trackers and no third-party cookies. Fonts and map libraries are served from our own server.
• Your maps are private until you share a link yourself.
• We do not sell data and do not use your content to train AI models.
• You can download your data at any time from the account menu and delete your account with all maps.

3. Hosting and server logs

The website runs on Cloudflare Pages; the database (D1) and functions are also operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit, Cloudflare processes technically necessary data (IP address, time, requested address, browser identifier) to deliver the site and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR (secure, stable operation). We have a data processing agreement with Cloudflare; Cloudflare is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition.

To prevent abuse we count requests per hour (for example sign-in attempts). For this we store only a salted hash of the IP address, at most for the length of the time window (up to one hour).

4. Account

For an account we store your e-mail address, optionally your name, your password as a PBKDF2 hash, your plan, the time and version of your acceptance of the terms and your confirmation that you are at least 16. After sign-in we set a session cookie (mh_session, 30 days, HttpOnly); the database holds only its hash. Legal basis: Art. 6(1)(b) GDPR (contract). The data is deleted when you delete your account.

5. Your maps and conversations

We store what you enter into or import into a map: names and life dates of people, places, years, notes, the conversation with the assistant and the design. Legal basis: Art. 6(1)(b) GDPR. Maps are private; only when you turn on the link under “Share” can anyone with the link see the map. You can turn it off at any time.

Family histories often contain information about other people, sometimes about origin, religion or health (Art. 9 GDPR). Please enter information about living people only if you are entitled to, and share such maps with care. For you, processing for purely personal or household purposes falls under Art. 2(2)(c) GDPR.

6. AI assistant

When you write in the chat, your message, the previous conversation and the current content of the map are sent to Cloudflare Workers AI (Cloudflare, Inc., see section 3). The language model runs on Cloudflare’s infrastructure; inputs are not used for training. Legal basis: Art. 6(1)(b) GDPR. The chat is optional; you can build maps by hand or by GEDCOM import.

7. Place search

To find a place on the map, our server sends only the place name (e.g. “Vitebsk, Belarus”) to the Nominatim service of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Names of people and your IP address are not sent. The EU Commission has issued an adequacy decision for the United Kingdom. Results are kept in a cache that contains no personal data.

9. E-mails

We send e-mails only when needed: password reset and confirmation of a print request. We use the delivery service Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor; the recipient address and the message content are transmitted. The transfer is based on the EU-US Data Privacy Framework or standard contractual clauses. We do not send newsletters.

10. Print orders

For a print request we process the print file of your map, format and finish, name, delivery address, e-mail address, optionally your phone number and your message. The print file is stored in Cloudflare R2. We pass the file and the delivery address to the print shop and the carrier as far as needed to fulfil the order. Legal basis: Art. 6(1)(b) GDPR; for invoices Art. 6(1)(c) GDPR with § 147 AO and § 257 HGB (statutory retention periods of up to ten years). We delete the print file no later than 90 days after delivery.

11. Cookies and local storage

We only use technically necessary cookies (mh_session). In your browser’s local storage we remember the chosen language and the last map you opened. This is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG), so no consent is required.

12. Retention and your rights

We keep account and map content until you delete it. Deleted data is removed from the database immediately; Cloudflare backups expire after 30 days at the latest.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can get a copy of all your data at any time with “Download my data” in the account menu. You may also lodge a complaint with a supervisory authority, for example the one where you live or the one responsible for us (Art. 77 GDPR).

13. Minimum age

Only people aged 16 or over may create an account. You confirm your age when you sign up.

14. Changes

When our service changes we update this policy. The current version is always on this page.

Last updated: October 2026