Privacy Policy

1. Introduction

This Privacy Policy explains how TreeLinker ("we," "us," or "our") collects, uses, stores, and protects your information when you use the TreeLinker mobile application. Where required by law, we will ask for your consent before accessing information such as your contacts or sending notifications.

This policy applies to the TreeLinker mobile application only — not to third-party services linked from within the app.

2. Our Core Philosophy: Local-First & User-Owned

TreeLinker is built with a local-first architecture:

• On-device storage is primary. Your family tree, contacts, memories, and photos are stored in a local database on your device. Every read operation hits local storage first, and the app remains fully usable while offline — anything you create while disconnected is saved locally and sent when a connection returns.
• Your data is saved to your account. The family connections, tags, memories, timeline entries, group membership and favourites you create are stored in our cloud database, so they can be restored if you reinstall the app or sign in on another device. There is currently no setting that turns this off. If you would prefer we did not hold your data, you can delete your account, which erases it.
• Your data is private to you. What you store is kept under your own account and is not visible to other users, unless you choose to share it — by adding a memory to a group, by inviting someone to one, or by sending a family tree or a tag to another user.
• You own your data. You can delete your data at any time. Account deletion permanently erases all of your information from both local storage and our remote servers.

3. Information We Collect

We collect only what is necessary to provide the app's features.

Account & Profile Information
When you register, we collect your first name, last name, email address, phone number, and country code. Optionally, you may add a biography, location, and profile photo. Your password is hashed using the bcrypt algorithm before storage — we never retain your password in readable form.

Device Contacts
With your permission, TreeLinker securely processes your device contacts to help identify people you already know who use the app. Only normalized phone numbers are transmitted to our cloud database for matching. Contact notes, addresses, email addresses, photos, and other contact information remain on your device and are never uploaded.

Address Book Backup, Restore and Duplicates
You can back up your device address book, restore it from a backup, and find and merge duplicate contacts. A backup is a single file containing the contacts on your device — names, phone numbers, email addresses and the other fields your address book holds. It is created on your device and saved wherever you choose, which may include a cloud storage service you use; TreeLinker never uploads it to our servers and cannot read it afterwards. Backup files are not encrypted by the app, so keep them somewhere you trust.

Restoring a backup or merging duplicates adds, updates or deletes contacts in your device address book. This happens only when you start it, and the app shows you what will change first. Before any restore or merge changes your contacts, TreeLinker automatically keeps a safety copy in the app's private storage on your device so the change can be undone; these copies are removed after a limited time and are never uploaded.

Names of People in Your Family Tree
When you add someone to your family tree, the name you have saved for that person is stored in your account alongside the relationship itself. This is what allows their name to come back if you reinstall the app or sign in on another device — without it, people who are no longer in your address book would reappear unnamed. This applies only to people you have placed in your tree, never to your address book as a whole. The name is private to your account: it is stored against your own record of that person, it is never shown to another user, and no other account can read it. You can remove it by removing the person from your tree, or by deleting your account.

Relationship Graph & Memories
We store the family connections you create, their relationship types, and the structure of your tree. We also store memories you associate with contacts or groups: text content, key dates, locations, and photos.

Photos
Photos are stored securely on your device. If cloud synchronization is enabled, photos are securely transmitted over encrypted connections and stored in our cloud database to keep your memories available across your devices.

Family Member Information
TreeLinker allows you to create family profiles for relatives and other individuals. You are responsible for ensuring that you have the right to store and share information about these individuals. Information about family members and other people in your contacts is only shared when you explicitly choose to invite other users, share a group, or send a family tree or a tag to another user.

Caller Identification (Android only)
If you turn on Caller Identification in Settings, TreeLinker requests two Android permissions: call screening, so it can see an incoming call's number before you answer, and display over other apps, so it can show a card over your call screen. Both are optional, requested only when you enable the feature, and can be revoked at any time in your device's settings.

Matching happens entirely on your device: the incoming number is compared against your own saved contacts, and is never sent to our servers to identify who is calling. When it matches a contact you already hold, a card appears showing how you know them — a short phrase we suggest (for example "your cousin" or "Safa's sister") or one you have written yourself, any groups or tags you have given them, their birthday, and your most recent note about them. Because that note can appear on the ringing screen, anyone near your phone at that moment can read it. A caller who does not match a contact you already hold gets no card, and nothing about them is looked up, stored, or sent anywhere.

If you write your own phrase for how a contact appears (their "Caller Name"), it is stored on your account the same as any other note, so it is restored if you reinstall the app or sign in elsewhere. The phrases TreeLinker suggests for you are computed on your device and are not stored anywhere unless you keep one by editing it. Every identified call is also recorded as an entry on that contact's timeline, kept on your account like the rest of your timeline. None of this — the card, the Caller Name, or the call record — is ever visible to the caller or to any other TreeLinker user.

Push Notification Tokens
To send you real-time alerts about group invitations and shared memories, we collect your device's Firebase Cloud Messaging (FCM) token. You can disable push notifications at any time in your device's system settings or in TreeLinker's Settings screen.

Notification Preferences
We store your per-category notification preferences so your choices persist across sessions and devices.

Technical & Session Data
When you log in, we store a session identifier and last-activity timestamp in the secure keychain on your device. Sessions expire automatically after 30 days of inactivity.

4. App Permissions

TreeLinker requests access only to the permissions necessary to provide its features. You can grant or revoke these permissions at any time through your device settings.

5. How We Use Your Information

Your information is used exclusively to provide and improve TreeLinker:

• To create and maintain your account and authenticate your sessions.
• To build, display, and navigate your family relationship graph.
• To synchronise your data across your devices when remote sync is enabled.
• To identify which of your contacts are registered TreeLinker users.
• To send push notifications about group invitations and new memories, when enabled.
• To allow you to share memories and group memberships with users you explicitly invite.
• To support password recovery when you request a reset code.
• To delete all of your data when you choose to close your account.

We do not use your information for advertising, profiling, or marketing purposes.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information.

With Other Users — Only When You Choose
When you invite someone to a group, your display name is shared with them via push notification. Memories added to a shared group become visible to other members of that group. You control all invitations and group membership at all times.

Sharing a Family Tree
You can send another TreeLinker user the family relationships you have recorded around one of your contacts. This is always something you start deliberately, and you choose exactly who receives it.

When you do, the following is sent to the people you chose, and to nobody else:

• the family relationships themselves — who is related to whom, and how;
• for each person in that tree, the name and phone number you have saved for them.

The name and number are included so the person receiving the tree can recognise who is in it, and can add someone to their own contacts if they choose. They are used only for that. They are never added to our records of the people concerned, are never shown to anyone outside the share you sent, and never replace a name the recipient has saved themselves — the recipient always sees people under the names in their own address book.

Nothing else about those people travels: no photo, notes, addresses, email addresses, events, organisations, memories or timeline entries. Someone with no phone number saved cannot be included in a shared tree at all.

Please be aware that this means information you have saved about other people — including their phone numbers — is disclosed to the person you share with. Share only with people you would be comfortable giving that information to directly.

Sharing a Tag
You can send another TreeLinker user one of your tags. This is always something you start deliberately, and you choose exactly who receives it.

When you do, the following is sent to the people you chose, and to nobody else:

• the tag's name, colour and icon. The tag's name also appears in the notification the recipient receives (for example, "Ahmed has sent you a Work tag");
• for each person you have given that tag, the name and phone number you have saved for them.

The people in a tag do not have to be family. A shared family tree only ever contains people in that family, but a tag can hold colleagues, neighbours, or anyone else in your address book. Sharing a tag therefore discloses the names and phone numbers you have saved for people who are not part of any family tree you have recorded, and the fact that you grouped them together under that tag.

When the recipient chooses to save the tag, their app adds everyone in it to the recipient's own device address book, creating a new contact, under the name and number you saved, for anyone the recipient does not already have. It then gives the tag to all of them. People the recipient already has are not duplicated and keep the recipient's own names. The names and numbers you sent are not added to our records of the people concerned. Nothing else about those people travels: no photo, notes, addresses, email addresses, events, memories or timeline entries. Someone with no phone number saved cannot be included in a shared tag, and the app tells you how many people were left out.

Please be aware that this discloses information you have saved about other people — including their phone numbers — to the person you share with, and that it can end up in that person's address book. Share only with people you would be comfortable giving that information to directly.

Legal Requirements
We may disclose your information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of TreeLinker, our users, or the public.

Business Transfers
In the event of a merger or acquisition, your information may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

7. Third-Party Services

TreeLinker uses trusted third-party providers to operate certain features. These providers act only on our instructions and are not permitted to use your data for their own purposes.

8. Children's Privacy

TreeLinker is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided personal information without your consent, please contact us at treelinkerapp@gmail.com.

If we learn we have inadvertently collected personal information from a child under 13, we will delete that information as quickly as possible. If you are located in the European Economic Area, the age threshold may be 16 in some member states.

9. Data Retention

We retain your information for as long as your account is active or as needed to provide the service:

• Local data — retained on your device until you delete the app, reset your device, or delete your account.
• Remote graph data — retained while your account is active. Permanently deleted when you delete your account.
• Password reset codes — automatically deleted after use, or after 24 hours if unused.
• Push tokens — removed from our systems when you log out or delete your account.
• Group invitation records — retained for as long as the associated group exists.
• Shared family trees — the names and phone numbers included in a shared tree are held for 30 days from the moment you send it, and are then permanently deleted, whether or not the recipient ever opened it. After that the share can no longer be opened. Relationships the recipient has already saved become part of their own records and remain, as any relationship they entered themselves would.
• Shared tags — the tag's name, and the names and phone numbers included in a shared tag, are held for 30 days from the moment you send it, and are then permanently deleted, whether or not the recipient ever opened it. After that the share can no longer be saved. Contacts and tags the recipient has already saved become part of their own address book and records, and remain.

If cloud synchronization is enabled, encrypted backup copies of synchronized data may temporarily exist as part of our disaster recovery procedures. These backups are retained only as long as necessary to ensure service reliability and are automatically removed according to our retention policies.

You can initiate complete deletion of all your data at any time through Settings → Delete Account in the app.

10. Your Rights and Data Control

You have meaningful control over your data:

California Residents (CCPA)
You have the right to know what personal information we collect and whether it is sold or disclosed (it is not sold). You also have the right to request deletion of your personal information and to non-discrimination for exercising your rights. Contact us at treelinkerapp@gmail.com.

EEA & UK Residents (GDPR)
Your personal data is processed on the legal basis of contractual necessity (to provide the service you signed up for) and, where applicable, your consent. You have the right to lodge a complaint with your local data protection authority at any time.

International Transfers
Depending on your location, your information may be processed or stored in countries other than your own. Where required by applicable law, we implement appropriate safeguards to protect personal information during international transfers.

11. Security and Protection

We implement the following protections to keep your data secure:

• Passwords are securely hashed using bcrypt before storage. We never hold your password in readable form.
• All communication with cloud services is encrypted using HTTPS/TLS.
• Session tokens are securely stored using the platform's secure storage mechanism (Android Keystore).
• Access to cloud infrastructure is restricted to authorized personnel only.
• Password reset codes automatically expire after 24 hours and become invalid after repeated failed attempts.
• Sessions expire automatically after 30 days of inactivity.

No method of electronic transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at treelinkerapp@gmail.com.

12. Analytics and Cookies

TreeLinker does not use cookies. As a native mobile application, it does not operate in a browser context and does not set or read browser cookies.

We use Firebase Analytics to understand how TreeLinker is used and to improve it. The app records which screens are opened and when certain actions happen — for example signing in, creating a group, adding a relationship, backing up contacts, or finishing a Feature Tour topic. Some events include a type or a count (such as the kind of relationship added or how many contacts a backup held) or an internal record identifier. Events never include names, phone numbers, email addresses, or the content of your memories, notes, timeline or contacts. Firebase also automatically collects standard technical information such as an app-instance identifier, device model, operating system, app version, and approximate region.

We use Firebase Crashlytics to receive crash and error reports, as described in Third-Party Services above.

We do not use this information for advertising, we do not sell it, and we do not combine it with information from other companies to track you across apps or websites.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. For significant changes, we will notify you through a prominent notice in the app or by email before the changes take effect.

Your continued use of TreeLinker after any change constitutes your acceptance of the updated policy.

14. Contact Us

For any privacy-related questions or requests, please reach out to us by email. We aim to respond to all enquiries within 14 days.

For account deletion, you can also initiate the process directly in-app through Settings → Delete Account, which immediately begins erasing your data without any waiting period.