Privacy notice
The family stays in control of the family record.
Version privacy-2026-07-30. Last reviewed 17 September 2026. This notice describes the current private beta. It is intentionally specific about what exists today, but it is not a substitute for the jurisdiction-reviewed policy required before a public commercial launch.
Account setup
The public setup journey is an interactive explanation and does not collect archive details. Account sign-in uses a verified email code inside the private application. After verification, an account holder may create one isolated family space or accept an invitation to an existing one. A GEDCOM, photograph or information about living people should be added only after entering that authenticated family space.
Information in a family space
A family record may contain names, relationships, dates, places, notes, stories, photographs, GEDCOM source files, import provenance, contribution history and member-access history. Sign-in records include a verified email address and security events needed to operate the service.
Why information is used
Information is used to provide the private family-tree experience, calculate relationships, review suggested changes, manage member access, maintain security and create steward-requested exports.
Where information is handled
The beta uses Supabase-managed authentication and PostgreSQL in Singapore, with Cloudflare handling protected application delivery, private object storage and network controls. Family records are not placed in public search pages.
Optional public-site analytics
Cookie Settings on public kinonicle.com lets you accept both approved optional tools, accept necessary storage only, or choose each separately. Audience analytics uses Google Analytics 4 through Cloudflare Zaraz for public-page visits, reading milestones and account-journey starts, with opaque content labels and coarse time or scroll buckets. Performance measurement uses Cloudflare Web Analytics for page visits and loading performance; its cookieless beacon is still optional. Acceptance lasts only in the current open page, including navigation within it. A new tab or full reload starts with optional analytics off until another explicit choice. Necessary storage remembers refusals and supports security and delivery; it cannot automatically restore an earlier acceptance. Closing or ignoring the controls is not consent. The private application, staging and internal hostnames are excluded. Names, emails, search text, free-text content, query strings and external referrers are not sent; analytics is not joined to an account or family record or used for advertising. Use Cookie Settings anytime to withdraw consent. We remove accessible optional GA identifiers where feasible; successfully saving a performance withdrawal reloads the public page to unload its beacon. If saving fails, collection stays off on that page and a warning is shown. A request already in flight cannot be recalled.
Necessary public-site preferences
Refused cookie choices are remembered in this browser. An acceptance is kept only in the current page’s memory; its saved marker cannot enable tracking in another page. A public-site service worker enforces performance consent for pages it controls. It stores no identifiers, page content or measurement payloads, and does not control the separate private application. Performance measurement remains off when this protection is unavailable. The public setup preview keeps only its current step number in tab-local session storage, so a consent-related reload does not lose your place. This contains no name, account or family information and is not used for analytics. If browser storage is blocked, the preview still works but cannot remember its step after a reload.
Who can see it
Members see only the family space allowed by their active database membership, whether they created it or joined by invitation. Stewards have additional review, export and access-management permissions. Kinonicle does not sell family data or use it for advertising.
Security and history
Email codes establish individual accounts, sensitive steward actions require an authenticator, and changes such as invitations, imports, exports and approvals are recorded in an append-only family audit history.
Your choices during beta
Members can propose corrections and ask a steward to suspend their access. Stewards can export the family record. Photograph removal is available now; complete family-space deletion remains a managed operation until a reviewed self-service workflow is released.
Retention and international use
The public setup journey stores no submitted archive information. Authentication and family-space records follow the retention controls described for the private beta. Exact production retention periods, subprocessors, cross-border safeguards and regional request procedures are not yet final. They must be published and jurisdiction-reviewed before public commercial availability.