Privacy

There is no public sign-up. Accounts are created only from an invitation, and every page and request that touches family data requires you to be signed in and to be a member of that particular family tree. Requests without both are refused outright rather than answered with anything.

Nothing your family enters is published, listed, or offered to search engines. Only this page, the front page, the sign-in page and the contact page are meant to be found by strangers.

Your account: your name, your email address, and your password — kept as a cryptographic hash, never as text anyone can read.

What your family enters: people, relationships, photographs, stories and events, and a record of who added or changed them. Dates are deliberately incomplete for living people: we keep the month of a birthday and never the day or the year.A full name, a date of birth and a mother’s maiden name are the three things a bank asks on the telephone — a family tree naturally holds the first and third, so we decline to hold the second. For people who have died we keep whole dates, because that is what an archive is for and it puts nobody at risk. Attribution is deliberate: in a shared archive, a family needs to be able to see who recorded what.

Invitations you send or accept, so a link can be single-use and expire.

Members of your family, according to the role they were given. Not visitors. Not us, casually — access to the database is limited to running the service and repairing it.

A person's entry can be created by a relative before that person ever joins. When they do join, they can claim their own entry and correct it themselves — that right is theirs and cannot be taken away by anyone else in the tree.

Families marry into each other, and the same person can belong to two of them. So two families can be connected — but only when the organisers of both agree to it, and never by anyone acting alone. Until that happens, nothing of your family is visible to any other family on this service.

When it does happen, two limits apply at once, and the lower of the two always wins:

• What your family agreed to. Your organisers choose what the other family may see — nothing, names only, names and photographs, or names, photographs and dates — and can change or withdraw it at any time. Dates travel only at that last level; and for anyone living, the only date that exists to travel is the month of their birthday.
• What you allow of yourself. On your own profile you set what other families may see of you, and nobody in your family can widen it. Set it to nothing and you are not shown outside your family at all — and no connection between two other people is allowed to run through you.

A family further along the chain learns less, not the same. If your family is connected to the Petrovs and the Petrovs are connected to the Volkovs, the Volkovs can at most learn the chain of names that connects two people — never faces, dates or stories. To see more than that they would have to shake hands with your family directly. Any family in the chain can refuse to be passed on at all.

Either side can end a connection at any time. When it ends, everything it showed stops being visible — nothing was ever copied into the other family's archive.

A member who has not been shown another family's records can still ask their own organisers to connect the two. Asking shows nothing and reveals nothing; it is a note to your organisers, who decide.

• We do not sell, rent, or share your family's records.
• We show no advertising, and nothing here is targeted using your data.
• We do not train artificial intelligence on your family's photographs, stories, or records.
• We run no analytics and nothing that follows you. There is no measurement service on this site — nothing follows you between pages, between visits, or off to another company.
• The one number we keep is a tally on the front page. Opening the home page adds one to a single running total. We do not store your address, set a cookie for it, or write down the time — there is no record of the visit at all, only a number that is now one higher. It counts openings, not people: we cannot tell a returning visitor from a new one, and we have chosen not to be able to.
• We never show one family's records to another family without a handshake between them — agreed by the organisers of both, limited to what each side chose, and never more of you than you allow on your own profile.
• We never ask for more than we need. We do not want your phone number, your address, or your contacts.

One cookie, to keep you signed in. There are no advertising or tracking cookies, because there is no advertising and nothing following you.

The front page also leaves one short note inside your own browser, so that reloading the page does not count you twice. It is erased when you close the tab, it is never sent to us, and no other website can read it.

Running a website means other companies handle some of it. We keep that list as short as we can:

• Railway — runs the application and the database (United States).
• Cloudflare — answers the domain's DNS.
• Brevo — delivers our email: invitations, password resets, reminders. They receive the address the message goes to.

None of them are permitted to use your family's records for their own purposes.

You may ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account. Once you have claimed your own entry you can correct most of it yourself, at any time, without asking anyone.

To make a request, write to us through the contact page, or reply to any email you have received from Moya7ya — a person reads both.

Moya7ya is in beta and this is an honest list, not a wish list:

• One-click export of everything your family has entered. We intend it to exist so that leaving is always possible; today an export has to be requested from us.
• An encrypted vault for the most sensitive documents, which not even we could read. It is planned. It does not exist yet, and we would rather say so than let the word "encrypted" do work it has not earned.
• Fine-grained visibility — choosing who sees an individual photograph or fact. Today, access is decided per family tree and per role.

If we change anything on this page that affects what happens to your family's records, we will say so plainly rather than quietly updating a date. Being trusted with a family's memory is the only thing this product has to offer.