Privacy Policy

Last updated: 20 August 2026

This Privacy Policy explains what personal data The Register ("we", "us") collects, why, and how it's handled, in line with Kenya's Data Protection Act, 2019.

1. Data we collect

Account data. Your name, phone number, optional email address, and password (stored as an irreversible hash — we never see or store your password itself).

Family tree content. The people, relationships, dates, places, biographies, life events, and family stories you add — including information about relatives who are not themselves account holders, and photos, videos, or documents you attach to them.

Payment data. When you subscribe to a paid plan, we record the amount, billing period, your phone number, the M-Pesa method used, and the M-Pesa transaction/receipt number confirming payment. We do not collect or store your M-Pesa PIN or full card details — we don't process card payments at all.

Communications data. SMS messages we send you (verification codes, notifications) and, where available, whether they were delivered.

Technical data. Standard web request information (such as IP address and browser user agent) collected automatically as part of running the Service securely, and session cookies needed to keep you signed in.

2. How we use it

• To create and secure your account, including verifying your phone number by SMS one-time code before you can use the Service, and for phone-based password resets.
• To provide the core Service: storing and displaying your family trees, stories, and attached media, and sharing them with collaborators you've invited.
• To process subscription payments via M-Pesa and apply the correct plan limits to your account.
• To communicate with you about your account, transactions, or changes to the Service.
• To maintain the security and integrity of the Service, including detecting misuse.

We do not use your data for advertising, and we do not sell your personal data to third parties.

3. Who we share data with

We share data only where necessary to run the Service:

• Safaricom, to process M-Pesa STK push and paybill payments. Safaricom receives the phone number and amount needed to process a transaction.
• niText, our SMS provider, to deliver verification codes and account notifications. niText receives the phone number and message content needed to send the SMS.
• Collaborators you invite to a family tree see the tree content according to the role (viewer or editor) you assign them.
• Super administrators of the Service have account-level oversight (for support, billing reconciliation, and abuse prevention) and can view tree content, but do not edit or delete trees they don't own.

We don't share your data with anyone else except where required by law.

4. Family members who aren't account holders

A family tree necessarily includes information about people other than the account holder — parents, children, spouses, and other relatives, some of whom may be living and some deceased. This information is added by the account holder or a collaborator they've invited, who is responsible for having an appropriate basis to record and share it. If you are named in someone else's family tree and have concerns about how you're represented, please contact us using the details below.

5. Data retention

We keep your account and family tree data for as long as your account is active. If you ask us to delete your account (see Section 7), we will delete or anonymise your personal data within a reasonable period, except where we need to retain certain records (such as payment records) to meet legal or accounting obligations.

6. Security

We take reasonable technical and organisational measures to protect your data, including hashing passwords and OTP codes, and restricting administrative access to what's needed to operate the Service. No system is completely secure, and we encourage you to use a strong, unique password.

7. Your rights

Under the Data Protection Act, 2019, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data, subject to the retention needs described in Section 5;
• Object to or restrict certain processing of your data.

To exercise any of these rights, contact us at support@familyroots.co.ke. If you're not satisfied with our response, you may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

8. Cookies

We use only the cookies necessary to keep you signed in and to protect your account (session and CSRF-protection cookies). We do not use third-party advertising or tracking cookies.

9. Changes to this policy

We may update this Privacy Policy from time to time. We'll post the updated version here with a new "Last updated" date.

10. Contact

Questions about this policy, or a request relating to your data? Contact us at support@familyroots.co.ke.