PRIVACY POLICY

Last Updated: October 27, 2026

1. Introduction

Rooted History ("Service") is operated by Rooted Security LLC, a Texas limited liability company. This Privacy Policy explains our data practices.

2. Data We Collect

  • FamilySearch user ID and the tree data you permit via OAuth
  • Email address (optional)
  • Generated biographies, their sources, reading versions, and audio narration files, plus usage metadata
  • Purchase records (handled by Stripe; we never see or store your card details)
  • Standard web logs (IP, browser, timestamps)
  • A session cookie (sign-in) and a language-preference cookie

We never receive or store your FamilySearch password.

3. How We Use Your Data

  • To authenticate you and generate biographies, Historical Perspectives, reading versions, and narration using the AI providers listed in Section 4
  • To enforce usage limits
  • To improve the Service and troubleshoot
  • To communicate with you

Legal bases (GDPR): contract performance, legitimate interests, and legal obligations.

3a. Quality Assurance and Content Review

We may review generated content, including biographies and investigation results, for quality assurance, service improvement, and linguistic accuracy verification. When sharing content with third-party reviewers or consultants, all user-identifying information (such as account details and email addresses) is removed. Information about deceased ancestors contained in generated content is not considered personal data under applicable privacy laws.

4. Data Sharing

We do not sell, rent, or share your personal data for marketing.

Data is shared only with these service providers, each solely to provide the Service:

  • FamilySearch: sign-in (OAuth) and the tree data you permit
  • Google Cloud: hosting, databases, and file storage; also runs the AI models we use through Vertex AI:
  • Anthropic's Claude writes and fact-checks biographies, Historical Perspectives, and reading versions, and answers your questions about your tree
  • Google's Gemini reviews the full text of biographies written in languages other than English for language quality
  • xAI: its Grok models check the historical statements in a biography against outside sources found on the web. Only general historical statements are sent, never your relatives' names or dates. xAI processes these requests under zero-data-retention terms: it keeps no copy of them and does not use them to train its models.
  • ElevenLabs: produces audio narration. The text of the biography version being narrated is sent to ElevenLabs.
  • Stripe: payment processing
  • SendGrid (Twilio): email delivery
  • Plausible Analytics: privacy-friendly, cookieless website analytics (aggregate page views; no personal profiles)

These providers are bound by contracts to use the data only to provide their service to us.

Google Maps is separate. The maps on the signed-in Explore and Games pages are provided by Google Maps. To load them, your browser connects to Google directly, so Google receives your IP address and the map requests. Google handles that information under its own terms, not as our service provider: see the Google Privacy Policy.

5. International Transfers

Data is stored and processed in the United States. For EEA/UK/Swiss users we rely on Standard Contractual Clauses and processor certifications.

GDPR Article 27 Representative

We currently determine that our volume of EEA/UK/Swiss data subjects does not require appointment of an EU representative. If this changes we will appoint and identify one.

6. Security & Retention

We use industry-standard encryption, access controls, and monitoring.

Generated biographies, their sources, reading versions, and narration files are kept until you delete them or your account; account data is deleted on request (within 30 days).

7. Your Rights

EEA/UK/Swiss residents have rights of access, rectification, erasure, restriction, portability, objection, and complaint.

California residents: We do not sell or share personal information as defined by CCPA/CPRA.

Exercise rights or ask questions: privacy@rootedsecurity.io

8. Cookies

We use a strictly necessary session cookie (`rooted_session`) and a `locale` cookie that remembers your chosen language. No advertising cookies. We measure site usage with Plausible Analytics, which uses no cookies and collects no personal data. When you're signed in, we also record how the app is used, linked to your account (see Section 2). Our Cookie Policy has the details.

9. Children

We rely on FamilySearch's age verification and parental-consent mechanisms. We do not knowingly collect additional data from children under 13.

10. California Residents

We do not sell or share personal information. You have rights to know, delete, and non-discrimination.

11. Changes

Material changes will be notified by email or prominent notice.

12. Contact

Rooted Security LLC

PO Box 7311, Spring, TX 77387

Email: privacy@rootedsecurity.io

Website: https://rootedhistory.io

Last Updated: October 27, 2026

For questions about this Privacy Policy, contact us at privacy@rootedsecurity.io