Privacy Policy

At treeshy.com, we respect the privacy of account holders and the sensitivity of family information processed through our design forms and editor. This policy explains what we store, why, who we share it with, and how long we keep it. The controller of your data is [TODO: confirm legal name and address of the operator]. You can reach us through the contact form.

1. Account and project information

• Account data: We store your normalized email address, password hash (if you set a password), email verification and password reset records, and revocable authentication sessions. If you sign in with Google, we receive and store your Google account identifier and email address.
• Design form data: When you fill in a design form, we store your email address, the one-time codes we send you (as hashes), your answers, including family details, people you add one by one or a GEDCOM file you upload, and any description you type, together with the campaign or link that brought you to the form and the version of the form you were shown.
• Project data: Project names, template choices, family-tree details such as names, dates and places, and editor settings are stored in our PostgreSQL database until you delete the project or your account.
• Uploaded and generated images: Photos and reference images you upload, and artwork generated for your designs, are stored in private Azure storage and are counted against your plan's storage.
• Generated files: Requested PDF exports and free watermarked pictures are stored in Azure storage. PDF exports are available for up to 24 hours through temporary shareable links.
• Purchases and subscriptions: We store your purchases, subscriptions, payments, refunds, AI credit balance and how it was used, the prices you paid, the buyer and billing details Stripe returns to us (such as your name, email address, phone number, billing address and, for a business, its legal name and tax number), and the Stripe customer identifier.
• Print orders: When you order a printed poster, we store the order, the price paid, a copy of the design as it was at checkout, the print file made from it, and your email address for order updates. After payment we also store the name, shipping address and phone number you entered in Stripe Checkout, and the carrier and tracking details.
• Etsy orders: If you use a prepaid link for an Etsy order, we store the link, our note about the Etsy order it was made for, when it was first opened, and which account used it.
• Contact and technical data: We process messages you send us through the contact form and limited technical data, such as logs and error reports, needed to operate and secure the service. Optional analytics and marketing are enabled by default unless you turn them off in Cookie settings.

We use this information to provide the service you ask for: to make previews, designs, exports and posters, to take payments, to send you emails about your account, designs, exports and orders, to prevent abuse, and, where you allow it, to measure and improve our website and advertising. We do not sell your personal data. We send only service emails, not newsletters. [TODO: confirm the legal bases relied on for each purpose, if required in your jurisdiction.]

2. Authentication and cookies

The browser keeps the short-lived access token in memory. A secure, HttpOnly authentication cookie is used to refresh your session and is not available to browser scripts. Signing out or resetting your password revokes the relevant sessions.

Treeshy uses the following cookies and browser storage:

• Necessary authentication: treeshy_refresh_token maintains your signed-in session for up to 30 days. treeshy_google_oauth temporarily protects the Google sign-in flow. These secure, HttpOnly cookies are necessary for features you request.
• Necessary design forms: treeshy_onboarding_* lets you continue a design form you started, and treeshy_etsy_link_* remembers a prepaid Etsy link you opened. Both are secure, HttpOnly cookies kept for up to 30 days. The browser's session and local storage also keep your place in a form and unsent drafts on your device.
• Consent preference: treeshy_cookie_consent_v1 is a first-party cookie that remembers which optional categories you accepted or rejected. Treeshy's server can read it, so measurement sent by our server follows the same choice. It is kept for one year from when you last saved your choice, unless you clear site data or Treeshy replaces it with a newer consent version. If you saved a choice earlier in browser storage, Treeshy carries it over to this cookie.
• Analytics, optional: Google Analytics may set _ga and _ga_* cookies to distinguish visitors and sessions for up to two years. We disable Google signals and advertising personalization. PostHog, hosted in the EU, may store an identifier in first-party cookies and browser storage (names starting with ph_) and records how pages are used, including session replays. Replays mask all text and form inputs, hide photos and file pickers, and leave out console output; secret link parameters are masked. When you sign in, PostHog links your visits to your account ID, never to your email address.
• Marketing measurement, optional: Meta Pixel may set _fbp and _fbc cookies and receive browser, page-view, registration, checkout, subscription, and purchase-event information to measure advertising results. Unless you turn Marketing off, Treeshy's server also sends Meta events for leads, registrations, subscriptions, and purchases, including the purchase value. These events include your email address and a customer identifier, both hashed before they are sent, your IP address, your browser user agent, and the Meta cookie identifiers or the Meta click identifier from an ad link you followed.

Google Analytics, PostHog and Meta Pixel load by default on public pages unless you have turned off the corresponding optional category. Your saved choices take priority. You can turn either category off or on at any time through Cookie settings. Turning a category off stops future tracking, removes its optional first-party cookies that Treeshy can access, and reloads the current page without that service.

Separately from these settings, our server sends PostHog business events, such as sign-ups, design form steps, finished generations and exports, payments, refunds, subscription changes and shipped posters. These events contain only identifiers, categories, counts and amounts, never your email address, names, family details or text you typed. We also count visits to our design forms by campaign, without storing any visitor identifier, IP address or email address.

For more information about provider processing, see the Google Privacy Policy, PostHog Privacy Policy and Meta Privacy Policy.

3. AI generation

Artwork for previews and designs is generated by third-party AI models that we access through OpenRouter, which passes requests to the model provider we have selected (currently models from providers such as Google and ByteDance). For a generation, we send the design choices you made, the description and instructions you typed, and any reference images you selected. If you turn on family-place accents, up to five place names from your family details are also sent. We do not send your GEDCOM file or the names and dates on your family cards, which Treeshy adds to the design itself, but anything you type into a description is sent as written, so do not include personal details there. Requests are labelled with your account ID so that we can track their cost. [TODO: confirm whether OpenRouter's broadcast of AI requests to PostHog includes the prompt and image content, and the retention and training settings in place with OpenRouter and the model providers.]

4. Billing and service providers

Stripe processes subscription payments, one-time payments for design files, AI credit packs and printed posters, refunds, and the billing portal, and is the source of subscription status. Stripe collects your payment details, and for a print order your shipping address and phone number. We store the Stripe customer identifier but do not store payment-card details.

We share personal data only with these providers, and only as needed for the purposes described:

• Stripe: payments, billing, promotion codes and fraud prevention.
• Prodigi: prints and ships posters for us as our processor. For each paid print order, Prodigi receives your name, shipping address and phone number, and the print file. We do not send Prodigi your email address.
• OpenRouter and the AI model providers it routes to: AI generation, as described above.
• Microsoft Azure: file storage and email delivery (Azure Communication Services).
• Database and application hosting: PostgreSQL hosting and servers that run Treeshy [TODO: confirm hosting provider and region].
• Google: Google sign-in, if you use it, and Google Analytics, if allowed.
• PostHog: product analytics and session replays, as described above.
• Meta: Meta Pixel and the Meta Conversions API, if Marketing is allowed.

Some of these providers process data outside your country, including in the United States. [TODO: confirm the safeguards used for international transfers, such as Standard Contractual Clauses.] We may also disclose data where the law requires it.

5. Retention and deletion

Project snapshots and uploaded images remain available in your library until you delete them or delete your account. Export files and their shareable download links expire after 24 hours. A free preview that is not paid for is deleted, with its AI artwork, 3 months after it was made. Answers you gave in a design form are kept [TODO: confirm retention period for design form sessions, including emails and GEDCOM answers of visitors who never paid].

Account deletion removes the account, projects, uploaded and generated images, sessions, and associated exports, and cancels any active subscription. We keep purchase, subscription, payment and refund records after account deletion, no longer linked to your account, as financial records we must keep by law [TODO: confirm retention period], subject also to limited backups.

For a print order, we delete the print file and the copy of the design 60 days after the order has shipped, or later if a damage claim is still open. We remove the name, shipping address, phone number and email address from the order 12 months after it has shipped. For an order that is cancelled or cannot be fulfilled, both periods start when that happens. We keep the order itself, its status and the amounts paid. If you leave checkout without paying, we delete the copy of the design within a few days and remove your email address from the unpaid order 12 months later. If you delete your account, we delete the print file and the copy of the design as soon as the order has shipped or ended, unless a damage claim is still open; the order itself and its shipping details follow the periods above. Stripe, Prodigi and other providers keep their own records under their own privacy policies.

6. Family data, children and uploaded content

Family trees can contain names, dates, places and photos of other people, including living relatives and children. When you enter family details or upload media, you confirm that you have an appropriate right or consent to process that information. Do not add information that you are not entitled to use, and consider leaving out details of living people you do not need on the design. We use this information only to make your designs, exports and posters, and our staff access it only when needed to support you or operate the service.

Treeshy is not directed to children, and you must be at least [TODO: confirm minimum age] years old to create an account. If you believe a child has given us personal data, contact us and we will delete it.

7. Security and your choices

We use access controls and private storage intended to protect your data. You can delete individual projects, cancel or manage billing through Stripe, sign out, change your cookie choices, or permanently delete your account from your profile. No internet service can guarantee absolute security.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict its processing, and to withdraw consent at any time. To use these rights, contact us through the contact form. You may also complain to your local data protection authority.

8. Changes to this policy

We may update this policy as the service changes. We will show the date of the latest update above and, for significant changes, tell account holders by email or in the app.