Privacy Notice

Effective date: 2026-09-19

Famistry.org stores account data, desktop release telemetry, download accounting events and plugin catalog activity required to operate Famistry Desktop and future paid plugins.

Desktop update checks do not send genealogy project files, people names, photos, document paths or local project content.

If you use the Family Book Studio beta and explicitly request a PDF preview or download, your browser sends the reviewed book snapshot to Famistry.org. It contains selected names, dates, places, full notes, family relationships and any portrait images you choose. The book renderer processes this data in memory to return a PDF. The application does not save uploaded book data, images or generated PDFs to a database or filesystem. An in-memory IP-based rate limit expires after one minute. No book data is sent to OpenAI or another AI provider. The preview is watermarked; the clean PDF is free during the public beta.

Famistry.org keeps a privacy-safe operational record of PDF generation for up to 90 days. It contains only the request time, preview/final mode, success or bounded failure code, duration, page and output sizes, print-issue count and document format version. It does not contain the submitted family data, snapshot hash, names, stories, photographs, IP address or account identifier. The backend removes older render events automatically.

Famistry.org also records first-party plugin lifecycle events such as opening a plugin, importing a project, completing a preview, starting checkout and completing payment. These events use a random identifier created for the current page only. The server stores only a one-way hash of that identifier, the plugin and event names, and bounded product dimensions such as interface language, source and render mode. It does not store family content, names, stories, photographs, email addresses, account identifiers, IP addresses or a persistent browser identifier in this product analytics journal. Automated clients are excluded. Retention is configured per plugin between 30 and 365 days and is shown in the protected administrator panel.

The book editor excludes project contacts, documents, credentials and unrelated project metadata. Selecting a whole Desktop project folder does not upload the folder: only the reviewed book fields and selected images are sent when you request rendering. Without local recovery enabled, the browser keeps the working book only in the current tab until you close or reload it.

If you explicitly enable a local recovery copy, the editor stores the current book snapshot, including full notes and selected images, in IndexedDB in your browser profile on this device. This copy is not encrypted by Famistry and is not uploaded as a stored project. It remains until you turn local recovery off, choose Delete local copy, or clear this site's browser storage; browser storage can also be evicted. A saved copy is never opened and sent to Famistry.org automatically: restoring it requires reviewing its data and giving fresh consent before PDF rendering. For a durable backup, download the book project file and keep it securely.

Desktop update checks may send a random installation id, app version, platform, CPU architecture, operating system version, locale and trigger type. Download accounting may store source, version, referrer host, country header when provided by the edge, user agent classification and a daily visitor hash. Raw IP addresses are not stored in the application data files.

Account registration stores email address, password hash, roles, a session-version

counter, session events and timestamps. Email verification and password recovery

use random one-time links. Famistry.org stores only each token's SHA-256 digest

and issue time; verification links expire after one hour and reset links after

30 minutes. A successful password reset invalidates earlier sessions. When email

delivery is configured, the mail operator receives the destination address and

the transactional message needed to deliver that link. The selected provider

and retention terms will be disclosed before paid sales open.

Session security events contain the event type, time, account identifier and an

IP-derived one-way hash. They are retained for at most 180 days; automatic

daily pruning also removes events whose account no longer exists. Raw IP

addresses are not stored. The customer JSON export includes only each retained

event's time and type.

You can permanently delete a non-administrator account from the account dialog

after confirming its password. Famistry.org removes the email, password hash,

verification/recovery tokens and session history, and invalidates every session.

The local family-book project remains on your device because it is not account

storage. Existing order and transaction records may be retained under an

unlinked internal identifier where legal, accounting, refund or fraud duties

require them; the email-to-identifier link is removed with the account.

While signed in, you can also download a machine-readable JSON copy of the

account data held by Famistry.org. The versioned export contains the account

profile, sign-in event times and types without IP-derived hashes, and a limited

order summary. It excludes password hashes, one-time token digests, session

tokens, internal security and idempotency hashes, payment-provider identifiers,

renderer paths and renderer/snapshot hashes. It does not contain the local

family project, names, stories, photographs or generated books because those

items are not stored as account data.

If an authenticated user explicitly creates a Family Book order, the order journal stores the account identifier, server-controlled offer version, amount and currency, order status and timestamps, SHA-256 identifiers of the approved book snapshot and renderer, and private server paths needed to retain that renderer release. Those paths are not returned by customer or administrator APIs. The journal does not store the book title, names, stories, relationships, photographs, uploaded snapshot or generated PDF. Repeating the same order request is deduplicated using a one-way hash of its idempotency key. Beta orders cost zero and are optional; the public editor does not create one automatically.

We use this data to provide releases, security updates, account access, download statistics, fraud prevention, billing records and plugin delivery.

Contact for privacy requests: privacy@famistry.org.