Privacy policy

Last updated: 27 August 2026

Stemma (stemma.link) is a family tree editor run as a free, non-commercial hobby project by one person. Questions, corrections, deletion requests — all to admin@stemma.link.

What is stored

Your Google account email address. You sign in with Google; we verify the identity token it issues and keep only the email address from it, as your account identifier. No password, and no access to Gmail, Drive, Contacts or any other Google service.
What you type into a tree — names, dates, biographies, photos, and the family links between people.
A session record so you stay signed in.
Ordinary server logs kept by our hosting provider (IP, time, path, user agent) for security and debugging.

No advertising, no analytics, no tracking, no profiling, no selling of data. All of it is hosted on Amazon Web Services in the eu-central-1 (Frankfurt) region, over HTTPS, encrypted at rest.

Google sign-in

Stemma's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The email address from Google sign-in identifies your account and lets people address invitations to you. Nothing else. You can revoke access at myaccount.google.com/permissions.

Cookies

One cookie, stemma_session, holding a random session id and nothing else. It is HttpOnly, expires after 30 days, and exists only to keep you signed in. No advertising or analytics cookies.

Who else can see it

People you invite. An invitation link grants access to whoever holds it, so treat links as secrets.
AI assistants you connect yourself. If you add Stemma's MCP connector to an AI client, that client can read and edit your trees, under that vendor's own privacy terms. It only exists if you set it up.

Data about other people

A family tree is information about other people. When you enter details about a living relative, that is on you. If you are in someone's tree and want out, email admin@stemma.link and it will be removed.

Deleting things

Delete a person, a family or a whole tree in the app and its record is gone from the database. For anything else — your account, uploaded photos, a copy of what is stored about you — email admin@stemma.link and it will be handled by hand. Sessions expire on their own after 30 days.

Changes

The date at the top is the current version.