Privacy Policy

Probably Cousins Privacy Policy

Last updated: 2 November 2026. Effective: 2 November 2026.

1. Who we are and what this covers

Probably Cousins LLC, a Delaware limited liability company (“we,” “us”), runs probablycousins.com and each family's site at <family>.probablycousins.com. This policy explains what information we collect, why, who can see it, how long we keep it, and what you can do about it. This policy also covers living people whose information is provided by someone else, whether or not they have an account. You may contact us about your information without joining the Service. It forms part of our Terms of Use. We offer the Service only in the United States, Canada, Australia and New Zealand.

2. The short version

• Family trees are access-restricted. Family owners manage access, and people with the family password may have access without an individual account. Section 6 explains access by members, guests, staff and authorized programs.
• Public features exclude living people except for the limited, consent-based certificate option described in section 6. A family's public reference person must currently be deceased.
• We do not sell your information or show advertising. We count page views on probablycousins.com with Vercel Web Analytics, which sets no cookies and receives only the page's address (section 8); we use no third-party analytics on family sites.
• Some content is processed by our AI provider, Anthropic, to answer questions, do research, and read a record you send to Prove a link.
• A tree file you grade on the report card is read on our servers for that request and not stored. If you buy a verified-line credential, we keep the line it certifies: deceased ancestors' names, birth years, grades and the kinds of record behind them; living people appear by relationship only (sections 3, 7 and 12).
• You can download your family's data subject to your access permissions, and anyone can ask to be removed from a tree.

3. What we collect

Information you give us:

• your name and email address, and a password if you set one (we store only a secure hash of it, through our sign-in provider);
• family tree files and everything in them: names, dates, places, relationships and notes about living and deceased people;
• photos, captions and the people you tag; stories; corrections you propose, with their sources; feedback;
• Help conversations, messages to hello@probablycousins.com, and removal requests;
• a tree file you upload to the report card (at /score) to be graded, and a record (a photo, scan or PDF of one record) you send to Prove a link, with the names of the link it should prove. Neither is stored: both are processed only for that request;
• if you buy a record search (“Prove this link”): for each link, until the search is done (and never more than seven days), what your tree file records about the child and the parent (their names, events, notes and sources in full, with the web addresses and media references it cites), the other parent's name, and the names and years of their close relatives who have died. A relative who may be living is left out, and the names of living relatives that we can detect in notes and sources are reduced to initials (a name written in an unusual way may not be detected). We first read the records your tree cites, then search for what they leave open. After the search we keep the amounts, each link's outcome, its receipt and the record's address, and, for the result we show you, a short list of what we searched, the record we suggest you obtain, and one line on what your tree already held (names of living people that we can detect reduced to initials);
• if you buy a verified-line credential: the line it certifies, from you back to one ancestor (each person's name and years of birth and death, each link's grade and the kinds of record behind it, in fixed words such as “a death certificate”). Anyone born within the last 100 years with no recorded death is stored by relationship only (“your father”), never by name or date. We also keep the email address checkout gives us, the payment's reference, and a keyed fingerprint of the tree's starting person (not their name) so that a later purchase for the same tree can be priced and reissued;
• for a starter tree: your email address and the names, approximate years and places of the ancestors you enter (or, when a family's owner starts the family's tree from one grandparent, that grandparent's details);
• if you use “Keep this tree” on Bring Your Cousins, the file you uploaded, held for 24 hours until you claim it;
• for a gift tree: the giver's name and note, and each recipient's first and last name;
• if you ask to hear when gifts open, your email address, kept only if you tick the consent box;
• a record that you ticked the box agreeing to the Terms of Use and this policy: your account (or, without one, a one-way hash of your email address), the step, the family site, the time and the version; for a guest, the same record without any identity, plus a cookie on their device (section 4);
• for a certificate, optionally, a Solana wallet address;
• a guest's typed-in name when a guest adds a photo or correction.

Information we create: evidence grades for facts and links; relationship probabilities; research job records (what was searched, what was found, each source's web address, and the cost); a credit ledger; and a log of changes to each family's tree.

We receive information from account holders, family members, guests and the public records and archives used for research. Uploaded notes, stories, photographs and relationships may contain sensitive information about living people. Do not upload DNA data, government identification numbers, financial account credentials, or sensitive health, religious, ethnic or intimate information about a living person.

Information collected automatically:

• Visit counts. Once per visitor per day we record a session using a one-way hash of the IP address, browser identifier and date. The IP address itself is not kept with the count. These identifiers are pseudonymous rather than necessarily anonymous. We use them for limited visit counting and protect them as personal information where applicable.
• Event counts. Plain records of what happened (a search and its confidence word, an invitation sent, a photo added, an email sent and its type), designed to carry no names, addresses or free text.
• Security and abuse limits. Short-lived counters that limit repeated attempts, for example wrong family passwords or repeated sign-ups. Some are keyed by IP address or email address. They are deleted within about two days. If someone repeatedly guesses a family's password, that family's owner sees the number of wrong tries and when they happened, but not who made them.
• Security-policy reports. When a browser blocks content under our security policy, it sends a report; we keep only the rule and the blocked address, with query strings removed.
• Server logs kept by our hosting providers, which ordinarily include IP addresses.

Payments. When a family buys research credit, the payment runs through Link, Stripe's checkout service, which is the seller of record for the payment. We never see your card number — you enter it only on Stripe's own page. We send Stripe your account email, the pack you chose, internal ids for your account, your family site and you, and your family site's address (so checkout can send you back to it); at checkout you give Stripe a billing address (for calculating sales tax). Stripe tells us back that the payment succeeded, the amount and any tax charged, ids for the payment and for its own customer record (so your receipts stay together for next time), and the name, email and billing address you gave at checkout. We keep the customer id Stripe gives us for your account. Link emails the receipt; we send our own short purchase confirmation to that email address; we don't store the name or the billing address.

Because Link sells the credit, Stripe also handles what you give at checkout under its own privacy policy for Link (link.com/privacy) — for example, if you choose to save your payment details in a Link account. Link emails your receipts and answers questions about the charge. You can ask Link to delete the information it holds from your purchases; that doesn't touch your family site, and deleting your account here doesn't delete Link's records — ask each of us separately.

What we do not collect: DNA; your card number (Stripe collects it directly); advertising identifiers.

Gift trees and Solana certificate anchoring are not currently available. The descriptions of these features apply if and when they are enabled.

4. Cookies and similar technology

We use cookies only to make the site work and to remember small preferences. We use no advertising or analytics cookies.

Your browser also keeps a few small items in its own storage on your device, such as the name a guest typed, so it need not be typed again. You can control cookies through your browser settings. Blocking required sign-in or family-access cookies may prevent those features from working.

5. How we use information

We use it to run each family's site; to estimate and show relationships; to grade evidence and route corrections; to run research a family asks and pays for; to answer Help questions; to send the email described in section 9; to take payment and keep accounts; to keep the Service secure and stop abuse; and to count use so we can tell whether the Service works. We do not use family data to target advertising, and we do not sell it.

6. Who can see what

Inside your family's site. Relatives signed in with their own accounts, and guests who have the family's password, can see the tree. A person with no death or burial record who was born within the last 110 years, or whose birth year is unknown, is treated as living. The family's owner chooses whether living relatives' full details or only their names are shown; when names only, the other details are removed on our server before anything is sent to the browser. Guests' downloads exclude living people. Photos are never public; each is shown through a private link that expires within minutes.

Across families. If a family's owner opts in, that family's deceased relatives can be matched with other opted-in families' deceased relatives. Living people are never included. Anyone — signed in or not — can then find those deceased relatives by name on Find and see each one's name, birth year, birthplace and family name, and a share card for them.

In public. Pages anyone can see, including Find a Cousin, share images and shared stories, show only people who have died, under the same test applied on our server: anyone with no death or burial record who was born within the last 110 years, or whose birth year is unknown, is treated as living and never shown. Families appear publicly by surname only. A story that mentions a living person can never be shared publicly. A family's public reference person must currently be deceased; naming a living person as a reference person is not currently offered. There is one exception: a living adult may choose to show their own name on their own certificate's public check page, only after we obtain and record their specific consent. We show them the information that will be public before they agree. They may withdraw consent by contacting us, and we will remove the information from public pages we control. We do not offer this option for living children.

Leaderboards. Joining the leaderboards is optional and needs an account. A player profile stores your account, the username you choose, the country and the state, province or region you choose to give (if any), one yes-or-no for whether you confirmed you are 18 or older and accepted a contest's Official Rules, your choices about what is shown, your points, and the decade in which your earliest proved ancestor was born. For each record you claim it stores one-way fingerprints of the record and of its receipt, an anonymous link key (the ids your file gives the two people, such as “I12>I40”), whether the record is about a father or a mother, the decade the record gives for the child's birth, and the day we read the record. While the leaderboards are on, a record you prove while signed in, or a search you buy while signed in, carries a one-way tag for your account, so that only you can claim it. Each tree is filed under an anonymous key made from a random value created for your account and the id your file gives you; patriot milestones are filed under that key and the ancestor's id in your file. We never store your tree, or any name or full date from it. Public boards show only your username, your points, the badges you switch on one by one, and the decade in which your earliest proved ancestor was born. If your family's owner puts the family on the family board and you choose to count for it, the label the owner chooses (the surname, unless changed) and the combined points are shown. Contest winners' usernames are published on the contest page.

Our staff. The site's operator and a short, named list of site-wide moderators can see a family's data when running the Service, answering support requests, or handling removal requests.

Research API. An owner may issue keys that let a program read their own family's data, subject to the family's living-person setting. A key never reaches another family. Exports and API access follow the permissions applicable to the requesting account or key. An authorized recipient may retain a copy outside the Service. Protect family passwords, invitations and API keys, and do not share them with unauthorized people.

7. AI processing

We use Anthropic's AI models to answer Help questions, to run research jobs, to grade some evidence, to draft stories when a family asks, and to process tree files you upload. What we send is limited to what the task needs. Research never targets a living person, and living people named in passing in material sent for research are reduced to initials first. Photos in a family site are not sent. A record you send to Prove a link is an exception to the rules in this paragraph: the image or PDF, unredacted, with the name and approximate birth year of the person whose parents it should show (who may be living, often you or a parent), is sent to Anthropic to be read twice, independently. We do not keep the record or the readings. Grading a tree file on the report card uses no AI; it runs on our own servers. The one exception is the Spanish report card: there, the sentences that describe your tree's sources, which may name people in it, are sent to Anthropic to be translated, used for that one response and not kept by us. We use Anthropic under its applicable commercial terms. Customer content is not used for model training by default under those terms. Anthropic may retain inputs and outputs under the terms and retention settings applicable to the features we use, including applicable security or legal exceptions. AI research searches only a fixed list of public archives and never signs in to subscription genealogy services.

8. Service providers and other disclosures

Services your browser contacts. Every page loads its typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so Google sees your IP address and browser when you visit. The forms on Join, Bring Your Cousins, Gift and Help, and the password-reset and starter-tree forms (the starter form appears on Find), and Prove a link, use Cloudflare Turnstile (challenges.cloudflare.com) to check that a person, not a bot, is sending them; Cloudflare sees your IP address, your browser and how you interact with that check. On probablycousins.com itself (never on a family's own site, and never on a page opened from a private link) we count page views with Vercel Web Analytics, run by Vercel, which already hosts the site. It sets no cookies, and we send it only the page's address, without any link codes.

We use service providers subject to contractual confidentiality, security and data-use restrictions appropriate to their roles. Our primary database is in the United States. Our providers may process information in other locations as described in their applicable terms. Messages to hello@probablycousins.com are also forwarded to the operator's Gmail account and processed by Google.

If you live in Canada, Australia or New Zealand, your information is transferred to and stored in the United States, where it may be accessible to U.S. courts and authorities under U.S. law. We protect it there under this policy and our contracts with our providers.

We may also disclose information when the law requires it, to protect people or the Service, or to a buyer or successor if Probably Cousins is sold or merged, subject to this policy. We do not sell personal information or share it for cross-context behavioural advertising.

9. Email

We send email only from hello@probablycousins.com, in plain text. Some messages you can stop: invitations, personal links an owner sends, digests, and similar family mail each carry an unsubscribe line that works without signing in. Essential account, security and transaction messages may continue while needed to provide the Service or respond to your requests. We do not include promotional content in messages treated as essential. These messages include sign-in links, password resets, purchase confirmations, decisions on your requests, and replies to messages you sent us. Receipts for purchases come from Link.

10. Your choices and rights

We offer the access, correction and deletion choices below to everyone. Applicable law may provide additional rights.

• See and download. Subject to their access permissions, members can download their family's tree as a standard GEDCOM file or a spreadsheet, and a whole-site archive with photos and stories. Ask us for anything else we hold about you.
• Correct. Use “Spotted a mistake?” on any person's page, or write to us.
• Delete. Ask us to close your account from your Account page or by writing to us. Anyone, including a living relative who has never signed up, or a parent or guardian on a child's behalf, may ask to be removed from a family's tree (section 11).
• Stop email you are allowed to stop, using the unsubscribe line.
• No discrimination. Using these rights does not change the price or quality of what you get.

We respond within the period required by applicable law and otherwise within 45 days. If an extension is permitted and needed, we will explain why and when to expect a response. We may request proportionate information to verify identity or authority. You may use an authorised agent where state law allows. You may appeal a denial by replying to our response. We will explain the review process and any available regulator complaint route.

Canada, Australia and New Zealand. You may ask to see and correct the personal information we hold about you, and ask how we use it, under Canada's Personal Information Protection and Electronic Documents Act (and provincial law where it applies), Australia's Privacy Act 1988 and the Australian Privacy Principles, or New Zealand's Privacy Act 2020. Write to hello@probablycousins.com. If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner, or the New Zealand Office of the Privacy Commissioner.

Some of what a family's records show is sensitive, such as the church, meeting or synagogue that kept a relative's baptism or burial. We show that only for relatives who have died, and only inside the family's own site.

11. Removal from a family's tree

Sign in and use the removal request on your Account page, or write to hello@probablycousins.com. A request about a person in a family's tree goes first to that family's owner, who looks after the tree; we step in if they don't act. A person handles each request by hand, usually within a few days. We assess your request across relevant copies under our control, including copies in other family trees, subject to applicable law. We will explain what we removed and any information we must retain. We cannot directly erase copies independently kept outside the Service. We share only the information reasonably needed to process your request with the family owner.

12. How long we keep information

Closed account identifiers. Deleted within 30 days after closure, except for necessary billing, security, request and legal records. Closing an individual account does not itself remove contributions from an active family tree; you may request removal under section 11.

Closed family sites and removed content. Removed from active systems within 30 days after site closure or an approved deletion request, or sooner where applicable law requires.

Request and consent records. Records that a request was handled, or that you agreed to these documents, are kept while we may need to show it, and longer only where justified by a legal obligation, dispute or security need.

Server logs. Kept on our hosting providers' own schedules, currently no longer than 90 days. Minimal suppression records are retained only while needed to honor removal requests or email opt-outs and are reviewed periodically.

Where information is retained for a legal obligation, dispute or security need, we limit access and use to that purpose and delete it when no longer needed.

13. Children

The Service is not directed to children, and you must be 18 or older to hold an account. Guest submissions and other interactive contributions are also intended for adults. If we learn that a child under 13 has directly provided personal information through the Service, we will assess and address that collection as required by law. Family trees may include living children, entered by adult relatives. Children are treated as living people under section 6: never shown on any public page. A parent or guardian may ask us to remove a child's details, and we will.

14. Security

We protect information with measures appropriate to it. Among them: database access rules that keep each family's data to that family; family passwords stored only as salted hashes; sign-in links and API keys stored only as hashes; photos in private storage, served through links that expire within minutes; signed cookies; verified webhooks; limits on repeated attempts; a browser security policy; two-factor sign-in on our hosting account; and daily database backups. No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.

15. Changes and contact

We may update this policy. The date at the top shows the current version. If a change materially affects how we use your information, we will say so on the Service and, where we hold your address, email you before it takes effect. Where applicable law requires consent to a new use, we will obtain it before that use begins. Questions or requests: hello@probablycousins.com, or the Help page, where a person reads every escalation. Probably Cousins LLC, 250 Indian Road, Palm Beach, FL 33480.

Copyright notices go to our designated agent: Copyright Agent, Probably Cousins LLC, 250 Indian Road, Palm Beach, FL 33480; hello@probablycousins.com (see clause 21 of the Terms of Use).