Shejire

Privacy Policy

Last updated: 2026-07-26 · Version: v1.2

Data controller
Shejire LLC — Massachusetts, United States of America
Contact
[email protected]

This policy explains how your personal data is collected, used, stored and protected on Shejire (the “Platform”), operated by Shejire LLC. Shejire is a community platform on which the Kazakh family tree is built together.

1. Data we collect

  • Account information: your full name, email address and (when you register with email) your password. Passwords are stored only as a secure hash, never in plain text.
  • Social sign-in: if you sign in with Google, Apple or Facebook, we receive from that provider your name, your email address, the unique identifier issued by the provider and (if available) your profile photo. Your password at the provider is never passed on to us. If you use Apple’s “Hide My Email” option, we receive the relay address. We display your profile photo by downloading it once and saving it to our own storage, rather than by connecting to the provider’s servers. When you delete your account we immediately remove that photo from your profile so it is no longer shown anywhere on the Platform; the stored image file is erased from our media storage within 30 days. It is used only as your own avatar.
  • Contributed content: the people you add to the family tree, family relationships, dates, photos and the texts you write.
  • Private messages: if you use the messaging feature, we store the content of your messages so they can be delivered to and displayed for you and your recipient. Messages are not end-to-end encrypted: they are stored on our servers and can in principle be accessed by our administrators, but we do so only to investigate a report of abuse or where the law requires it. Messages are kept until you or your recipient delete them, or until your account is deleted.
  • Technical data: IP address, browser/device information and session records — solely for security, debugging and preventing abuse.

2. Purposes of use

We process your data only for the following purposes:

  • to create your account, verify your identity and let you sign in;
  • to publish your contributions and display the family tree and profiles;
  • for content moderation, quality and dispute resolution;
  • for security, fraud/abuse prevention and legal obligations.

We do not sell your personal data for advertising purposes and do not share it with third parties for marketing.

Legal bases (GDPR Art. 6): we process your account and profile data to perform our contract with you (Art. 6(1)(b)); your genealogical contributions and visibility choices on the basis of your consent (Art. 6(1)(a)), which you may withdraw at any time; technical, log and security data on the basis of our legitimate interest in keeping the Platform secure and preventing abuse (Art. 6(1)(f)); and other data where we must comply with a legal obligation (Art. 6(1)(c)). Withdrawing consent does not affect processing carried out before the withdrawal.

Ethnic origin (GDPR Art. 9): because Shejire records Kazakh lineage (jüz, taipa, ru, ata), the information you provide can reveal ethnic origin, which is a special category of personal data. We process it only on the basis of your explicit consent, which you give when you create or edit a family record, and you may withdraw that consent at any time by deleting the record or your account.

3. Where your data is stored

Shejire runs as a single platform on our own servers located in a data center in Canada. Your account information, the contributions you make to the family tree and the photos you upload are kept in our own database and our own file storage on that server; we do not replicate user data to any third-party cloud service.

Service providers and third parties: we do not sell your data. A small number of providers process data on our behalf: Cloudflare, Inc. proxies our traffic and runs the Turnstile anti-bot check on our sign-up, sign-in and password-reset forms, and therefore receives your IP address and basic browser signals. Some pages load resources directly from third parties, which means those parties receive your IP address: Google Fonts (typefaces), OpenStreetMap (map tiles), YouTube in no-cookie mode (only on pages that embed a video), and the sign-in script of Google, Apple or Facebook on our sign-in page. Outgoing email is sent from our own mail server.

Shejire brings together Kazakhs from all over the world in one single family tree — our members live in Kazakhstan, Türkiye, Europe and many other countries. That is why we use a single, shared place of record for everyone. Wherever you live, the same protection applies to your data: passwords are stored only as an irreversible hash, connections are encrypted, and access to data is limited to those who are authorized.

This means that your personal data is transferred outside the country in which you live and processed there. By creating an account, you consent to this transfer. For as long as your data is located in Canada it is subject to Canadian law; competent Canadian courts and law enforcement authorities may request access through legal channels. If our hosting arrangement changes in the future, we will update this policy and notify you at your registered email address before the change takes effect.

Data is retained for as long as your account remains open. When you delete your account, your personal data (name, email, etc.) is anonymized; your contributions may remain in anonymized form for the integrity of the family tree.

4. Cookies and analytics

The minimum technical data needed to keep your session going (a session token), together with your theme/language preference, is stored in your browser. We do not use tracking or advertising cookies and we do not share your data with ad networks; for this reason we do not display a cookie consent banner. If we collect usage statistics in the future, we will do so by a cookieless method and will update this policy.

5. Your rights and privacy

  • the right to access, correct and delete your personal data (account deletion → anonymization);
  • the right to object to processing and to request a copy of your data;
  • Data of living people: records of living people on the family tree are currently visible to anyone who visits the Platform, including their name and the years shown. You control who can see the more sensitive location fields — place of birth, current residence and burial place — and for living people these are limited to signed-in members by default. Your account bio can be set to public, members-only or private. Anyone recorded on the Platform can ask us to hide or remove their record using the contact address below. We are developing per-person visibility controls that will let each individual decide whether their name is shown publicly.
  • Entering data about other people: on Shejire, users can add not only their own data but also the names, dates and photos of their relatives (some of whom are living people). When you add such a record, you declare that you have the right to share that information. Responsibility does not lie with the contributor alone: a living person who is the subject of a record may, even without having an account, request via the contact address below that the record be removed or hidden; we review such requests and act on them where they are justified.
  • Age limit: you must be at least 18 years old to join the Platform. By registering, you declare that you meet this requirement.

You can submit these requests from your account settings or via the contact address below.

6. Third-party data sources and attribution

For place names (place of birth, residence and burial) we use the GeoNames geographical database. This data is distributed under the Creative Commons Attribution 4.0 (CC BY 4.0) license and has been adapted by us: the data has been filtered down to populated places only, converted into our own data schema and stored on our own servers. Your searches are not sent to GeoNames — queries run against our own database.

7. Changes to this policy

We may update this policy from time to time. As the Platform develops, as new features are added or as legal requirements change, it is normal for the text to change. The current version is always published on this page; the version number and last update date at the top of the page show which text is in force.

If we make a change that materially affects your rights or the way your data is processed, we will notify you at your registered email address before it takes effect. Minor corrections (typos, clarifications of wording) may be published without separate notice. Continuing to use the Platform after a change means that you accept the current policy; if you do not accept it, you may delete your account.

8. Contact

The legal entity operating the Platform is Shejire LLC (Massachusetts, Amerika Birleşik Devletleri). For privacy-related questions and requests: [email protected]

This policy was drawn up in Turkish and has been translated into other languages. In the event of any discrepancy between a translation and the Turkish text, the Turkish text prevails.

Privacy Policy · Shejire