Privacy Policy

FaceAncestry ("we", "us", "our") operates the website and service at faceancestry.com. If you have questions about this policy, contact us at info@faceancestry.com.

We collect only what is necessary to provide the service:

• ·Photos you upload — processed to generate your ancestry report and stored in our secure cloud storage.
• ·Account information — email address and password (hashed) if you create an account, or OAuth tokens if you sign in with Google.
• ·Report data — the AI-generated output associated with your uploaded photo, stored in our database.
• ·Usage data — pages visited, actions taken, timestamps, and browser/device type for analytics and debugging.
• ·Payment data — if you purchase a premium reveal, your payment is processed by Dodo Payments. We store only the transaction ID and plan type, not your card details.
• ·Cookies and local storage — session tokens and preference flags. No third-party advertising cookies.

We use your data exclusively to:

• ·Generate and display your ancestry report.
• ·Store your reports so you can access them later from your dashboard.
• ·Process your payment and grant premium access.
• ·Send transactional emails — account confirmation, password reset. No marketing emails unless you opt in.
• ·Improve the reliability and performance of the service (aggregated, anonymised usage analytics only).
• ·Comply with legal obligations.

We do not use your photos or report data to train, fine-tune, or benchmark any publicly available AI model.

Your uploaded photos are stored in a private cloud storage bucket (Supabase / AWS S3). Access is restricted to authenticated requests tied to your account.

• ·Authenticated users: photos are retained until you delete them from your dashboard or close your account.
• ·Anonymous users: photos and reports expire automatically after 24 hours if not claimed by creating an account.
• ·Deletion is immediate and permanent — we do not keep backups of deleted photos.

We do not sell, rent, or share your personal data with third parties for their own commercial purposes. We share data only with:

• ·Service providers — Supabase (database and storage), Vercel (hosting), Dodo Payments (payment processing), OpenRouter / Anthropic (AI inference). Each is contractually bound to use your data only to provide their service to us.
• ·Legal authorities — if required by law, court order, or to protect the safety of users.

Depending on your location, you may have the following rights:

• ·Access — request a copy of the data we hold about you.
• ·Deletion — delete your photos, reports, and account at any time from your dashboard. Account deletion removes all associated data.
• ·Correction — update your email address or account details.
• ·Portability — request your report data in a machine-readable format.
• ·Objection — object to processing based on legitimate interest.

To exercise any right, email info@faceancestry.com. We will respond within 30 days.

FaceAncestry is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect data from children. If you believe a child has submitted data, contact us and we will delete it immediately.

Our servers are located in the United States (us-west-2). If you are accessing the service from the EU, UK, or other regions, your data may be transferred to and processed in the US. We rely on standard contractual clauses where required.

We use industry-standard measures including TLS encryption in transit, access-controlled storage, row-level security on our database, and hashed password storage. No system is 100% secure — if you discover a vulnerability, please report it to info@faceancestry.com.

We may update this policy from time to time. When we make material changes, we will update the "last updated" date above. Continued use of the service after changes constitutes acceptance.