Privacy Policy

1. Who is responsible

Ancesvia is operated by a private individual: Mikail Mert Kopuz, Turkey. This person is the data controller under both the KVKK and the GDPR.

Enquiries concerning data protection: [E-MAIL]. Correspondence is possible in English, German and Turkish.

2. Information is not consent

Two matters are kept strictly separate:

• The clarification text: this page. It informs you about the processing. Neither reading it nor using the app constitutes consent.
• Explicit consent: asked separately in the cookie banner, and only for optional analytics. It is never pre-ticked, never bundled with registration, and can be withdrawn at any time. Consent is not a condition of use; if you decline, every feature remains available unchanged.

3. Which data we process

Depending on how you use Ancesvia, the following categories arise:

• Account data: your email address, your password (stored by our authentication provider as a cryptographic hash only), an optional username, an optional profile picture, your account status and the creation date.
• Content you create: the trees you build — names, birth and death dates, gender, occupation, notes, relationships, portraits you upload, and the position of each node on the canvas.
• Technical data: IP address, browser type, requested pages and timestamps, recorded in the server logs of our hosting and database providers for security and troubleshooting.
• Bot protection: when you log in or register, a Cloudflare Turnstile challenge is solved in your browser; Cloudflare receives the resulting token and technical data such as your IP address.
• Optional analytics (only after your consent): usage statistics such as pages viewed, clicks and device type, collected by PostHog on European servers.
• Aggregated visit counts: our host, Vercel, counts page views without cookies. Visits are distinguished by a technical value that cannot be traced back to you.
• Local data on your device: the selected theme and language and your cookie choice, which stay in your browser and are not transmitted to us, plus a working copy of your current tree so the editor starts instantly.

4. Why we process it, and on which legal basis

• To provide the app — creating your account, storing and loading your trees, syncing them across devices. Legal basis: performance of a contract, GDPR Art. 6(1)(b); KVKK Art. 5/2-c.
• To keep the service secure — blocking bots, abuse and automated attacks, keeping short-lived server logs. Legal basis: legitimate interest, GDPR Art. 6(1)(f); KVKK Art. 5/2-f.
• To understand how the app is used — optional analytics only. Legal basis: your explicit consent, GDPR Art. 6(1)(a); KVKK Art. 5/1. Withdrawable at any time.
• To meet legal obligations — for example answering a lawful request from a competent authority. Legal basis: GDPR Art. 6(1)(c); KVKK Art. 5/2-a.

5. Data about other people

A family tree is, by its nature, data about other people. When you enter information about relatives, friends or any other living person, you decide what is stored, and you are responsible for having the right to store it.

Enter only data you are entitled to enter, limit it to what is necessary, and exercise particular care with information that is sensitive by nature, such as health, religion or ethnic origin. Ancesvia does not request data of that kind.

You can correct or delete any entry at any time; when the account is deleted, all of it is removed. If someone contacts us because they appear in your tree, we will get in touch with you about it and, where the law requires it, act ourselves.

6. Who else sees the data

We do not sell data and we run no advertising. Data is passed only to the service providers that technically run Ancesvia, and only to the extent they need it (processors under GDPR Art. 28):

• Supabase — database, authentication and image storage. Our instance is hosted in Sydney, Australia.
• Vercel Inc. (USA) — hosting and content delivery of the website itself.
• Cloudflare, Inc. (USA) — bot protection (Turnstile) on the login and registration forms.
• PostHog (EU servers) — product analytics, loaded only if you consent.
• Authorities — only where we are legally obliged to disclose.

7. International transfers

Because of the providers listed above, your data is processed outside Turkey and outside the European Economic Area — in particular in Australia and the United States.

These transfers are covered by the standard data protection clauses of the respective providers (GDPR Art. 46(2)(c)) and, for the KVKK, by the transfer instruments foreseen in Art. 9 of the KVKK.

8. Cookies and local storage

• Strictly necessary: a session cookie set by our authentication provider that keeps you logged in. Without it there is no login. It requires no consent.
• Preferences: your theme, language and cookie decision, stored in your browser's local storage.
• Working copy: your current tree is cached locally so the editor starts instantly and survives a brief connection drop.
• Analytics (consent only): PostHog sets its own cookies and local storage entries once — and only once — you accept. Decline, and nothing is loaded and no request is sent.
• You can change or withdraw your decision at any time through the cookie settings in the page footer; the banner will then ask again.

9. How long we keep it

• Account and trees: for as long as your account exists. A deleted tree is gone; when the account is deleted, everything belonging to it is removed.
• Portraits you replace or remove are marked for deletion after 24 hours and taken out of storage by the daily cleanup run, so within two days at the latest.
• Database backups can still contain deleted content for a transitional period, until they expire.
• Server logs: kept short-term by our providers for security purposes.
• Demo phase: should Ancesvia be discontinued, we will announce it in advance and give you time to export your trees.

10. Your rights

Under Art. 11 KVKK and Art. 15–21 GDPR you have the right to:

• learn whether your personal data is processed, and request information about it;
• receive a copy of your data, and receive it in a portable format;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, and your account deleted;
• have processing restricted, and to object to processing based on legitimate interest;
• withdraw a consent you gave, without affecting what happened before;
• not be subject to a decision based solely on automated processing — we make no such decisions.

11. How to exercise them, and where to complain

You can delete your account yourself at any time in the user menu of the editor; that removes the account, every tree in it and all uploaded images.

For anything else, write to [E-MAIL] from the address your account uses. We answer within 30 days (KVKK) and at the latest within one month (GDPR).

If you are not satisfied, you may lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr) or, if you live in the EU or EEA, with the supervisory authority of your country of residence.

12. Security

Every connection runs over HTTPS. Passwords are only ever stored as hashes. Database access is restricted per user by row-level security, so one account cannot read another's trees. Uploaded portraits sit in a private bucket and are served through short-lived signed links rather than public URLs.

Should a breach affect your data, we will notify you and the competent authority within the periods prescribed by law.

13. Minimum age

Ancesvia is intended for adults. Registration requires you to be at least 18 years old. We do not knowingly create accounts for minors. If you become aware that a minor has registered, contact us and the account will be deleted.

14. Changes to this notice

We update this text when the app changes. The date at the top always shows the current version. For significant changes we will inform registered users by email or with a notice inside the app before the change takes effect.