GDPR Privacy Compliance

Privacy Policy

Last updated: October 19, 2026 • Compliant with Regulation (EU) 2016/679 (General Data Protection Regulation)

1. Data Controller Information

TiesOfTime acts as the Data Controller under Regulation (EU) 2016/679 (“GDPR”) for personal data collected through tiesoftime.com.

For any data protection inquiries, access requests, or privacy questions, please reach out via our contact section or email:
contact@tiesoftime.com

2. GDPR Scope: Living Relatives vs. Deceased Ancestors

Under Recital 27 of the GDPR, European data protection regulations apply strictly to living natural persons: “This Regulation does not apply to the personal data of deceased persons.”

Living Individuals: We maintain strict privacy defaults. Users may NOT publish identifiable data of living relatives without explicit consent. When living relatives are invited, they retain full statutory control over their node, visibility settings, and profile data.
Deceased Ancestors: Historical records of deceased individuals are maintained for cultural, genealogical, and archival purposes, and are handled with high respect for historical accuracy.

3. Categories of Personal Data We Process

Account & Authentication Data

Email address, display name, preferred interface language, and temporary one-time verification codes (OTP). If you use Google or Apple Sign-In, we receive your public OAuth identifier.

Genealogical Lineage Records

First name, last name, kinship relations, dates of birth/death, geographic locations, biographical memories, and family photographs you choose to upload.

4. Legal Bases for Processing (Article 6 GDPR)

Contractual Necessity (Art. 6(1)(b)): To provide, render, and synchronize your 3D family trees and manage your user account.
Legitimate Interests (Art. 6(1)(f)): Platform security, abuse prevention, genealogical record linkage, and debugging.
Explicit Consent (Art. 6(1)(a)): Required when claiming a profile node as a living relative, or when toggling your personal profile visibility into the global public record.

5. Granular Privacy Controls

Every user maintains granular control over their profile data in Account Settings:

Toggle whether your real first name is displayed in public trees.
Toggle whether your real last name is displayed in public trees.
Toggle whether your portrait photo is visible publicly.
Enable or disable direct messaging from other genealogical researchers.

6. Data Processors & Third Parties

We do NOT sell, rent, or trade your personal data. We utilize trusted European and GDPR-compliant technical service providers:

Database Hosting: Neon Cloud PostgreSQL (TLS encrypted in transit and at rest).
Transactional Email: Purelymail SMTP (TLS encrypted delivery for verification OTPs and invitations).
Authentication: NextAuth (Zero password storage; session tokens via secure JWT).

7. Your Statutory Rights Under GDPR (Articles 15–22)

As a resident of the European Economic Area (EEA), you enjoy statutory rights:

Right of Access (Art. 15)Request a complete copy of all personal data held about you.

Right to Rectification (Art. 16)Correct inaccurate or outdated genealogical information.

Right to Erasure (Art. 17)Request total deletion of your profile and account records.

Right to Data Portability (Art. 20)Export your family tree data in machine-readable JSON format.

You also have the right to lodge a complaint with your local EU Data Protection Authority (for Poland: Prezes Urzędu Ochrony Danych Osobowych — UODO).

8. Cookies & Local Storage

TiesOfTime uses strictly necessary cookies and local storage tokens solely for session authentication and user interface language preferences. We do NOT use invasive advertising tracking cookies or third-party pixel trackers.

2. GDPR Scope: Living Relatives vs. Deceased Ancestors

Under Recital 27 of the GDPR, European data protection regulations apply strictly to living natural persons: “This Regulation does not apply to the personal data of deceased persons.”

Living Individuals: We maintain strict privacy defaults. Users may NOT publish identifiable data of living relatives without explicit consent. When living relatives are invited, they retain full statutory control over their node, visibility settings, and profile data.

Deceased Ancestors: Historical records of deceased individuals are maintained for cultural, genealogical, and archival purposes, and are handled with high respect for historical accuracy.

3. Categories of Personal Data We Process

Account & Authentication Data

Email address, display name, preferred interface language, and temporary one-time verification codes (OTP). If you use Google or Apple Sign-In, we receive your public OAuth identifier.

Genealogical Lineage Records

First name, last name, kinship relations, dates of birth/death, geographic locations, biographical memories, and family photographs you choose to upload.

4. Legal Bases for Processing (Article 6 GDPR)

Contractual Necessity (Art. 6(1)(b)): To provide, render, and synchronize your 3D family trees and manage your user account.

Legitimate Interests (Art. 6(1)(f)): Platform security, abuse prevention, genealogical record linkage, and debugging.

Explicit Consent (Art. 6(1)(a)): Required when claiming a profile node as a living relative, or when toggling your personal profile visibility into the global public record.

5. Granular Privacy Controls

Every user maintains granular control over their profile data in Account Settings:

Toggle whether your real first name is displayed in public trees.

Toggle whether your real last name is displayed in public trees.

Toggle whether your portrait photo is visible publicly.

Enable or disable direct messaging from other genealogical researchers.