Your family's information belongs to your family. Not to us.

No public trees, ever

There is no public search, no directory of families, and no way for somebody outside your family to find out that your family has a tree here. The only way in is an invitation from somebody already on it, or starting a tree of your own.

That holds at the front door too. When somebody gives an address to come in, the answer is identical whether or not that address already belongs to an account, and the code goes to the address rather than to the screen. Nobody is ever told who is already here, including by trying.

You control your own information, not just your family as a whole

This is set by the person the information is about, not by whoever added them to the tree. If your uncle adds you to the family tree, he can write down that you exist and how you are related. He cannot decide who gets to see your phone number. Only you can, and not even a steward can change your settings on your behalf.

Stewards do keep access to what you hide from other relatives, because they are accountable for the archive and cannot look after what they cannot see. What they cannot do is change your settings, and they cannot agree to your name going on a poster.

Nothing is decided in your browser

What you are allowed to see is worked out on the server before anything is sent, so what is hidden from you is genuinely absent from the response rather than merely not drawn on the screen. The same goes for photographs: every image is fetched with your own session and checked against your membership each time, so a copied image link does nothing in anybody else's browser.

Removing something does not break the tree for everybody else

If you ask for your information to be limited or taken down, here is what happens. Your name is reduced to an initial and your details are cleared, but your place in the tree stays, connected the same way it always was.

That is on purpose. If somebody's father asks to be removed after a divorce, he is still his child's father, and deleting him outright would erase that child's own history along with his. Full removal is also possible, where everything about you disappears completely. It is a separate, deliberate step, and the archive says who else would be affected before anybody does it.

Any request like this gets a response within a month.

Nothing about your family is for sale

Printing is asked for separately

Using the app privately and having your name printed on a wall poster are two different things, and Ukoo Yangu treats them that way. Somebody might be perfectly happy appearing in the family's private tree and not want their name on a poster hanging in somebody's living room. So before any name goes on a poster, Ukoo Yangu asks that person directly. No answer means no name, not a guess either way. See how the poster works.

Take it with you, any time

A steward of your family can export the entire tree - every person, every relationship, the stories, the events and the details of every photograph - as one .zip file holding the photographs themselves, and its owner can delete the family permanently, whenever they choose. Nobody outside has to approve it and nobody can talk them out of it. The one thing to know: it can be records are a record, not a document - several hundred megabytes for a family with many pictures - and the page says the size before you start. Both actions are on the family's settings page.

The formal part

What follows is the privacy policy itself: who is responsible, what is held, on what legal basis, for how long, and what you can demand. It is longer and drier than the explanation above, and it is the part that is binding. Where the two ever disagree, this part is the one that was written against the code.

Last reviewed: 24 September 2026.

1. Who is responsible

The controller, in the sense of Article 4(7) GDPR, is Leanstart Africa - Derrick Tawah, Bessemerstraße 51, 12103 Berlin, Germany. That is the registered business address. Leanstart Africa is a sole proprietorship, which means the trading name and the person behind it are one legal person, and the same details appear on the legal notice as German law requires.

Contact for anything in this policy: leanstart.africa@gmail.com. There is no data protection officer, and none is required: a sole proprietorship with no employees does not meet the thresholds in Article 37 GDPR or section 38 BDSG. Questions go to the proprietor directly and are answered by him.

German law applies to this service and to every language it is ever offered in, because that is where it is established. The full legal notice has the rest.

2. What this archive actually holds

More than most services, and it is worth being exact rather than reassuring. A family tree is by its nature a collection of personal data about a group of people, most of whom are not the person entering it.

• About your account: the email address or telephone number you proved you could be reached at, any further addresses you add, a hash of your password if you set one, and the record of your sessions. Never the password itself.
• About each person in a tree: names and nicknames, gender, year or full date of birth, place of birth, the town and country they live in now, whether they are living, year or date of death, a short biography, a telephone number and an email address, and how they are related to everyone else.
• Photographs and what is written under them: the image itself, its caption, when and where it was taken, and which people are marked in it.
• Stories and events recorded by relatives, and which people each one is about.
• The decisions people make: who may see which of their fields, whether their name may be printed on a poster, requests to be removed or hidden, and who confirmed which relationship.
• Operational records: failed sign-in attempts against an address, which is kept against the address typed rather than any account, and a log of every action taken by staff running the service.

Most of it is optional. A person can exist in a tree with a name and nothing else, and every field has its own visibility setting, so what is recorded and what is visible are two separate questions.

3. Records about people who never signed up

This is the part that makes a family tree different from an ordinary service, and it is stated plainly rather than buried. Most people in a tree did not put themselves there. A relative recorded them: a grandmother who has died, a cousin who has never heard of this service, a child too young to decide anything.

Where information about you was given to us by a relative rather than by you, Article 14 GDPR applies, and this section is how you are being informed. The categories are the ones listed above, the source is the relative who entered them, and the recipients are the other members of that family subject to the visibility each field carries.

What you can do about it does not depend on having an account. Write to the address in section 1 and you can ask what is held about you, ask for it to be corrected, ask for it to be reduced to a name, or ask for it to be removed entirely. You do not have to join to object to being in it.

One honest limit, because it is a real one. Removing a person entirely can erase somebody else's own history - a father removed after a divorce is still his child's father - so the archive offers a reduction to an initial with the connection intact as well as full deletion, and says who else is affected before either happens. Which one you get is your choice, not the family's.

4. Why we are allowed to hold it

The legal bases, in the terms Article 6 uses:

• Article 6(1)(b), performing a contract: your account, your sessions, and running the archive you asked for. Without this there is no service to provide.
• Article 6(1)(f), legitimate interests: recording relatives in a family tree, and the security measures that protect it - the limits on how often a code may be requested, the record of failed sign-ins, and the log of what staff did. The interest is keeping a family's own history and keeping it safe; against it stands the interest of somebody who did not choose to be recorded, which is why section 3 exists and why every field carries its own visibility.
• Article 6(1)(a), consent: having a name printed on a poster. Asked for separately, per person, and never assumed from silence. Consent can be withdrawn at any time and withdrawal takes effect on the next print.

There is no processing for advertising, profiling or analytics, because none of those things happen here.

Children. An account is for people aged 16 or over, which is the age Germany sets under Article 8. You are asked to confirm it when an account is made; no date of birth is collected to check, because gathering an exact age from everybody in order to identify a few would mean holding more about children, not less.

Children still appear in family trees, because a family tree without them is not one. A child's record is entered by a relative, on the legitimate interest above, and the child has not chosen anything about it - so where nobody has chosen, more of it is kept from the wider family than an adult's would be. Their date of birth, birthplace, town, and anything written about them are visible to stewards rather than to everybody. Their name, their photograph, and the day and month of their birthday are not hidden, because a tree whose children are blank and faceless is not a record of a family, and because remembering somebody on their birthday is one of the things families are here for.

If you are a parent or guardian and would rather a child's record was not here at all, say so and it will be removed. You do not have to give a reason and you do not need the agreement of whoever added it, which is the same answer anybody gets about their own record.

5. Photographs, and what a photograph can reveal

A family photograph is not only a picture of people. It can show a place of worship, a ceremony, dress, or a gathering, and from any of those a reader may infer religion or ethnic origin. Those are special categories under Article 9 GDPR and they get a paragraph of their own because the risk is real rather than theoretical.

Nobody is asked to state a religion or an ethnicity, and there is no field for either. What the service does is store what a family chose to upload, show it only inside that family and only to the people the uploader's settings allow, and never analyse, tag or infer anything from an image. Photographs are not run through recognition of any kind.

If a photograph of you is here and you would rather it were not, say so and it will be removed. You do not have to give a reason, and you do not need the agreement of whoever uploaded it. Any steward of your family can now do it from the archive itself, and so can whoever added it. The picture is deleted with it, unless somebody is using the same one as their portrait.

6. Children

Children appear in family trees, and pretending otherwise would be dishonest. Two separate questions, answered separately.

Holding an account. You must be sixteen or over to hold an account of your own. That is the age at which somebody can agree to a service like this for themselves in Germany, under Article 8 GDPR and section 32 BDSG. Your age is not asked for and not verified.

Being recorded by a relative. A parent or guardian may record their own child, which is an ordinary exercise of parental responsibility. Anybody else recording a child should have the agreement of a parent. A parent or guardian can write to the address in section 1 and have a child's record reduced or removed, and that request is treated the same as one from an adult about themselves.

7. What is kept on your device

Very little, and all of it strictly necessary. There is no analytics, no advertising, no third-party script and no tracker of any kind, which is why this site has no cookie banner: section 25 TDDDG requires consent for storing things on your device unless they are strictly necessary for a service you explicitly asked for, and nothing here goes beyond that.

• ft_session - the cookie that keeps you signed in. It holds a random value and nothing about you: no name, no family, no role, all of which are looked up on the server each time. HttpOnly so no script can read it, SameSite=Lax, and Secure whenever the site is served over HTTPS. It lasts seven days if you signed in with a password, thirty if you came in with a code.
• ft_staff - the same idea for the separate console used to run the service. Twelve hours, and confined to that part of the site, so an ordinary visitor's browser never holds one.
• An offline cache, only once you are signed in and using the archive. It holds the application's own files - stylesheets, scripts, icons and a page that says you are offline. It never stores a page about your family, anything from the interface behind sign-in, or any request that returns your data, so nothing personal is written to your device by it.

The marketing and legal pages, this one included, store nothing at all. You can read them without anything being written to your device.

8. Who else is involved

Ukoo Yangu uses as few other companies as it can. There are two.

• Hetzner Online GmbH, Germany, runs the servers the application and its database sit on, in their Nuremberg data centre. A data processing agreement under Article 28 GDPR is in place. Your family's records stay in Germany - they are not copied to another country, and nothing about your tree leaves the European Economic Area.
• Google Ireland Limited carries sign-in codes and invitations by email, so your address, and usually your name, passes through them each time one is sent. A data processing agreement under Article 28 GDPR is in place. Part of this handling takes place outside the European Economic Area; the safeguard for it is below.

Your email leaves the European Economic Area. Google handles part of it in the United States. This is permitted because Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission has recognised under Article 45 GDPR as offering protection equivalent to European law. Nothing else about your family is transferred outside the EEA: your records stay on the German servers above.

Nothing is sold, shared or disclosed to anybody else. Not to advertisers, not to data brokers, not between one family and another, and not for training any model. Data is disclosed to a public authority only where the law obliges it, and the operator will tell the people affected unless forbidden from doing so.

If either company is replaced, this section will name the new one, the country it operates in, the agreement in place, and - where any processing happens outside the EEA - the safeguard under Chapter V GDPR that permits it.

9. How long things are kept

• Your family's records are kept while the family exists. The family's owner can delete the whole family at any time, which removes the people, the relationships, the stories, the events, the photographs and the memberships together.
• Your account lasts while you want it. Ask and it goes.
• Sessions expire on their own, and an expired one is deleted rather than merely ignored. Signing out deletes it immediately.
• Failed sign-in records exist to slow down guessing and are cleared when a correct sign-in happens.
• The log of staff actions is kept, and nothing can delete from it - not the operator, and not somebody who has taken over an account.
• Backups roll forward and are overwritten in turn, so something deleted disappears from them as they age out rather than the moment it is deleted.

10. How it is kept safe

Separation between families is enforced by the database itself rather than by application code remembering to check. Every table carrying family records refuses to return a row unless the connection has declared which family it is acting for, and a connection that declares none sees nothing at all rather than everything. The same mechanism is what stops the console used to run the service from reading inside any family, including the operator's own.

Passwords are stored as scrypt hashes, and sign-in codes and invitation tokens are stored only as hashes, so reading a backup does not hand anybody a working key. Sign-in answers identically whether or not an address belongs to an account, and takes the same time either way. There are limits on how often a code can be requested and how often a password can be tried.

No security is absolute. If a breach ever puts your rights at risk, the supervisory authority is told within 72 hours as Article 33 requires, and you are told directly where Article 34 requires it.

11. What you can require

Whether or not you have an account, and whether or not you put yourself in a tree, you can require all of the following. Write to leanstart.africa@gmail.com and you will have an answer within one month, as Article 12(3) requires. There is no charge. Some of it you can do yourself without writing to anybody, and the end of this section says which.

• Access (Art. 15) - a copy of what is held about you, and confirmation of who it has been shared with.
• Correction (Art. 16) - a wrong birth year, a misspelled name, a relationship recorded the wrong way round.
• Erasure (Art. 17) - removal, either reduced to an initial with your place in the tree intact, or complete.
• Restriction (Art. 18) - holding it without using it while something is disputed.
• Portability (Art. 20) - your data in a machine-readable form.
• Objection (Art. 21) - to anything done on the basis of legitimate interests, including being recorded at all.
• Withdrawing consent (Art. 7(3)) - for a poster, at any time, without needing a reason and without affecting what was lawful before.

What you can do without asking us. If you have an account, sign in, open the menu under your name and choose Your account. There you can download your own data - your account, the ways you sign in, which trees you are in, and your own record in each - and you can close your account. If you look after a family tree, its settings page lets a steward export the whole tree, photographs and all, as a zip that opens anywhere, and lets the owner delete the family outright.

Two things to be straight about. Closing your account does not take you out of a family tree. The account is how you sign in; the record is your family's record of a relative, and it stays, because removing it would break somebody else's history. To have your record changed or taken down, ask your family or write to us. And if you are the only owner of a tree, you cannot close your account until somebody else owns that tree or it is deleted, because a tree left with nobody to look after it cannot be exported, deleted or repaired by anyone.

Writing to us still works for all of it, and it is the only way in for somebody who has no account. That is a lot of people: a relative can be written into a family tree by somebody else and never sign in at all.

12. Complaining about how this is done

If you think this service has handled your information unlawfully, you can complain to a supervisory authority under Article 77 GDPR. For a business established in Berlin that is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin. You may also complain to the authority where you live or work, wherever that is in the EU.

You do not have to raise it here first. It is usually quicker if you do, and a complaint to the operator costs you nothing and can be withdrawn, but there is no obligation.

13. When this changes

This page is kept in step with the service, so what it describes is what is done today. The date above it is when it was last reviewed.

Where a change affects information already held about you, you are told directly rather than left to notice it for yourself. Where it affects only what happens from then on, the change appears here.