Privacy Policy

1. Data we collect

• Account information: your full name, email address and (when you register with email) your password. Passwords are stored only as a secure hash, never in plain text.
• Social sign-in: if you sign in with Google, Apple or Facebook, we receive from that provider your name, your email address, the unique identifier issued by the provider and (if available) your profile photo. Your password at the provider is never passed on to us. If you use Apple’s “Hide My Email” option, we receive the relay address. We display your profile photo by downloading it once and saving it to our own storage, rather than by connecting to the provider’s servers. When you delete your account we immediately remove that photo from your profile so it is no longer shown anywhere on the Platform; the stored image file is erased from our media storage within 30 days. It is used only as your own avatar.
• Contributed content: the people you add to the family tree, family relationships, dates, photos and the texts you write.
• Private messages: one-to-one chats and the groups you create are end-to-end encrypted — the content is encrypted on your device, reaches our servers only in encrypted form and is stored there encrypted; the keys that open it stay on your devices. We also state the limits of this promise plainly:
  • Auıl (community) chat is not end-to-end encrypted. Its membership is derived automatically from lineage and it is an announcement board of hundreds of people; the content of those messages is stored in plain form on our servers and can in principle be accessed by our administrators — we do so only to investigate a report of abuse or where the law requires it. Which chat is encrypted is stated at the top of every conversation in the app.
  • The history backup has two tiers. In the default tier your backup is wrapped with our key; that key is kept outside the database and every use is written to an audit log — but let us be honest: in this tier we can technically open your backup. If you switch on the “advanced” tier under Settings → Security and password, only the recovery code that stays with you can open the backup; we do not store that code anywhere. When you delete your account, your backup is deleted in full.
  • Metadata stays in the clear even in an encrypted chat. Who you write to and when, the sender name, group membership, the group name and picture, and the number and size of attachments are visible on our servers; what is encrypted is the content of the message. For that reason, do not put anything sensitive in a group name.
  • A structural limit of the browser. On the website the encryption code is delivered to you by our own server every time you open the page; if our server were compromised, it could serve code that leaks your key and you would not notice. In the mobile app this risk is narrower: the app is installed as a signed package and goes through store review. This is not a shortcoming peculiar to us but the nature of the browser; it applies to every end-to-end encrypted product that runs in one.
  • Key verification is now available. The chat info panel shows a safety number; comparing it with the other person over a different channel (in person or by phone) confirms that the connection really is between the two of you. If the number later changes in a chat you verified, a warning appears at the top of the conversation. The number also changes when the other person adds a new device; that alone does not mean an attack — to tell the difference, compare the number again.
  • If you report a message, that message's text is sent along with the report. Our servers still cannot read your encrypted messages — that has not changed. What changed is that when you report, the decrypted copy on your own device is sent with your report to the moderation team; you start this, we cannot take it on our own. A report without evidence cannot be assessed; WhatsApp and Messenger do the same for the same reason.
  • Retention. Your messages are kept until you or the recipient delete them; we apply no other time limit, because your chat history is content you may need to restore when you move to a new device. Deletion works in four ways: ① you delete a message only for yourself — the other side still sees it ② you unsend a message you sent — the text, the encrypted body and the attachments are deleted from our servers immediately, only a “this message was unsent” marker remains, and that marker is fully deleted after 30 days ③ you delete a conversation from your own list — it remains for the other side; once every participant has deleted it, the conversation, its messages and its encryption state are fully deleted within 30 days ④ if every participant has deleted the same message for themselves, that message is deleted outright. When you delete your account, your encrypted history backup and your device keys are deleted, your chats leave your own list, and your name becomes “Deleted user” in whatever remains. The messages you wrote stay in the other person’s chat — without your name. This is deliberate: a conversation is not one person’s document, and pulling your messages out would leave unanswered gaps in the other person’s thread. If there are specific messages you want gone, remove them with “unsend for everyone” before deleting your account. An Auıl chat cannot be deleted — its membership derives from kinship, so it is switched off from the Auıl settings instead.
• Technical data: IP address, browser/device information and session records — solely for security, debugging and preventing abuse.

2. Purposes of use

We process your data only for the following purposes:

• to create your account, verify your identity and let you sign in;
• to publish your contributions and display the family tree and profiles;
• for content moderation, quality and dispute resolution;
• for security, fraud/abuse prevention and legal obligations.

We do not sell your personal data for advertising purposes and do not share it with third parties for marketing.

Legal bases (GDPR Art. 6): we process your account and profile data to perform our contract with you (Art. 6(1)(b)); your genealogical contributions and visibility choices on the basis of your consent (Art. 6(1)(a)), which you may withdraw at any time; technical, log and security data on the basis of our legitimate interest in keeping the Platform secure and preventing abuse (Art. 6(1)(f)); and other data where we must comply with a legal obligation (Art. 6(1)(c)). Withdrawing consent does not affect processing carried out before the withdrawal.

Ethnic origin (GDPR Art. 9): because Shejire records Kazakh lineage (jüz, taipa, ru, ata), the information you provide can reveal ethnic origin, which is a special category of personal data. We process it only on the basis of your explicit consent, which you give when you create or edit a family record, and you may withdraw that consent at any time by deleting the record or your account.

3. Where your data is stored

Shejire runs as a single platform in a data centre in Sweden (European Union); the server is rented from the cloud provider Microsoft Azure and is operated by us. Your account information and the contributions you make to the family tree are kept in our own database on that server. The photos and videos you upload are stored in Cloudflare R2 object storage so that they reach you faster; that storage is also located within the European Union. We do not pass your data on to other platforms, data brokers or advertising networks.

Service providers and third parties: we do not sell your data. A small number of providers process data on our behalf: Cloudflare, Inc. proxies our traffic and runs the Turnstile anti-bot check on our sign-up, sign-in and password-reset forms, and therefore receives your IP address and basic browser signals. It also stores the photos and videos you upload on our behalf, and runs a cookie-free counter that measures how fast our pages load (Cloudflare Web Analytics — it creates no identifier and does not track you across sites). Some pages load resources directly from third parties, which means those parties receive your IP address: Google Fonts (typefaces), OpenStreetMap (map tiles), YouTube in no-cookie mode (only on pages that embed a video), and the sign-in script of Google, Apple or Facebook on our sign-in page. Microsoft (Azure) hosts the server our application runs on. Outgoing email is sent from our own mail server.

Shejire brings together Kazakhs from all over the world in one single family tree — our members live in Kazakhstan, Türkiye, Europe and many other countries. That is why we use a single, shared place of record for everyone. Wherever you live, the same protection applies to your data: passwords are stored only as an irreversible hash, connections are encrypted, and access to data is limited to those who are authorized.

This means that your personal data is transferred outside the country in which you live and processed there. By creating an account, you consent to this transfer. Your data is kept within the European Union — our server is in Sweden and your media storage is within the EU — and is subject to European Union data protection law (the GDPR); competent EU authorities and courts may request access through legal channels. If our hosting arrangement changes in the future, we will update this policy and notify you at your registered email address before the change takes effect.

Data is retained for as long as your account remains open. When you delete your account, your personal data (name, email, etc.) is anonymized; your contributions may remain in anonymized form for the integrity of the family tree. Chat messages are an exception to this — see the “Private messages” item above.

4. Cookies and analytics

The minimum technical data needed to keep your session going (a session token), together with your theme/language preference, is stored in your browser. These are required for the service to work and need no separate consent.

In addition, to understand how you use the site, we use analytics cookies from Google Analytics. These cookies are set only if you explicitly give your consent. If you do not consent, no analytics cookie is created and no data is sent to Google; the site keeps working exactly the same.

When you consent, technical data about your visit (your IP address, browser/device information, the pages you view) is transferred to Google LLC and processed in the United States of America. This means your data is transferred outside the country you live in.

You can change your decision at any time: simply turn off the “Analytics cookies” option under Settings → Privacy & Visibility. Once you turn it off, measurement stops and the analytics cookies currently in your browser are deleted.

We do not use cookies for advertising or profiling, and we do not share your data with ad networks.

6. Third-party data sources and attribution

For place names (place of birth, residence and burial) we use the GeoNames geographical database. This data is distributed under the Creative Commons Attribution 4.0 (CC BY 4.0) license and has been adapted by us: the data has been filtered down to populated places only, converted into our own data schema and stored on our own servers. Your searches are not sent to GeoNames — queries run against our own database.

The text of some history and biography articles is adapted from open sources such as the Kazakh Wikipedia. Such texts are distributed under the Creative Commons Attribution-ShareAlike (CC BY-SA) licence: we cite the source and licence beneath each article, state plainly that it is an adaptation, and share the derived text under the same licence. Machine-generated or machine-translated text is additionally marked with a badge.

9. Changes to this policy

We may update this policy from time to time. As the Platform develops, as new features are added or as legal requirements change, it is normal for the text to change. The current version is always published on this page; the version number and last update date at the top of the page show which text is in force.

If we make a change that materially affects your rights or the way your data is processed, we will notify you at your registered email address before it takes effect. Minor corrections (typos, clarifications of wording) may be published without separate notice. Continuing to use the Platform after a change means that you accept the current policy; if you do not accept it, you may delete your account.

10. Contact

The legal entity operating the Platform is Shejire LLC (Massachusetts, Amerika Birleşik Devletleri). For privacy-related questions and requests: [email protected]