RootfablePrivacy Policy
Rootfable is a private home for family history, made by Edge Case Studios. This policy explains, in plain language, what information we handle and how. The short version: your family's data belongs to your family — we store it to show it to your members, and for no other purpose.
What we collect
Account information. When you sign in, our authentication provider (Clerk) verifies your email address (and, if you choose Google or Apple sign-in, your name from that provider). We use your email to know which families you belong to.
Family history content. The people, dates, places, relationships, stories, photos, documents, and video clips that you and your family members add. This is the product — it is stored so your family can see it.
Basic activity. Sign-in times and contribution history, shown to your family's administrators so they can manage the family space.
What we do NOT do
We do not sell your data. We do not show ads. We do not make family trees public or searchable. We do not share one family's data with another — each family's tree, stories, and submission history live in that family's own isolated database, while account-membership records and uploaded files live in shared systems that are scoped to your family.
Who can see your family's data
Private family spaces require signing in with a member email — visitors who aren't members of your family (even signed-in ones) are refused. The only exception is Edge Case Studios' own platform operators, who can access family spaces solely for support and troubleshooting. Membership is managed by your family's administrators, and contributions (new people, edits, photos) appear in your family's space only after an administrator approves them. Family spaces are never listed or made searchable by Rootfable.
Photos, documents, and video clips are stored under long, unguessable links. In private families they are served to signed-in members, or through signed links that expire within hours — note that a signed link works for anyone who holds it until it expires, so a photo link a member shares can be viewed by its recipient.
Services we rely on
Clerk handles sign-in and account security. Cloudflare provides the hosting, storage, and network infrastructure. If your family subscribes, Stripe processes the payment and holds the card details — we never see or store them, and we receive only what we need to know the subscription is live. If your family uses the optional WikiTree research tools, those lookups are sent to WikiTree; and when email notifications are enabled, they are delivered via Resend. Each processes data only as needed to run the service. Mosaicdeck gives us privacy-friendly site analytics — page views, referrers, countries, devices and a few product events such as "a family was created" — with nothing that identifies you or your family. Its script sets no cookies and stores nothing in your browser; Rootfable itself keeps one short-lived note in the tab you sign in from (which button you used), so a sign-in is counted once, and discards it straight after.
AI features. Anthropic's Claude models power the optional AI features: the tree assistant, the AI reader for uploaded records, and AI sweeps. Text and records a member sends to those features are processed by Anthropic to produce the answer. This is what each one sends:
- The tree assistant sends your messages, your name if you've marked a person "This is me", and the parts of the tree it looks up to answer you. When it researches, Anthropic also runs its web searches, limited to a short list of genealogy, archive and reference sites.
- The AI reader sends the document you upload: a PDF, a scan or photo, or a text file. GEDCOM files and spreadsheets are read without AI and aren't sent.
- An AI sweep sends each person's record, with their parents' records.
Before any part of the tree is sent, anyone who may be living is cut down to their name and relationships: no dates, places, notes or stories. An uploaded document is sent as it is. Anthropic, PBC processes these requests under its commercial terms: it does not use them to train its models, and keeps them for up to 30 days before deleting them, unless it needs to keep a record longer to enforce its usage policy.
The tree assistant and the AI reader reach Anthropic through Cloudflare AI Gateway, which relays each request. Its log records the model used, the size and cost of the request, whether it succeeded and how long it took, labelled with the app's name and nothing that identifies a family, a person or a member. It doesn't keep the text sent or the reply. AI sweeps go to Anthropic directly, so they leave no entry in that log. When a member asks for a draft transcript of a story clip, the clip's audio is transcribed on Cloudflare (Workers AI), also through the gateway, which keeps no log entry for it at all. The gateway keeps each log entry for seven days.
Cookies
We use only the cookies required to keep you signed in. No advertising or cross-site tracking cookies.
Deleting your data
Any member can export their family's tree at any time, and the owner can delete the family space from its admin page. Deletion takes effect immediately for all members; any paid subscription is cancelled at the same time. We keep the deleted data for approximately 30 days — so an accidental or contested deletion can be reversed on request — and then remove it permanently. For account questions, immediate permanent erasure, or restore requests, contact us at the address below and we will handle it promptly.
Changes
If this policy changes in a meaningful way, we will note the new date at the top of this page.
Contact
Edge Case Studios — edgecasestudios.ai