Privacy policy

Connect is an app for remembering the people in your life. This policy explains what reaches our server, why, and for how long.

Your people stay on your phone

The people, relationships, dates, notes, contact details and photos you keep in Connect are stored on your device. They are not uploaded to us, except a person or part of your tree you choose to share, and then only the details you pick, only for as long as the share lasts; your own name and birthday once someone asks to link you, for the people you accept; a relationship you choose to suggest; and a backup if you are signed in and back up (all below). You can use Connect without an account.

What reaches our server, and only this

When you choose to ask someone to confirm a date, answer a question, share a contact, share part of your tree, link someone, suggest a relationship or back up, Connect needs an account and sends us:

Your account: your email address, the name you show to others, and, if you add one, your phone number. Kept until you delete your account.
Your devices: a name for each device you sign in on, when it signed in and when it was last used. Removed when you sign out of that device or delete your account. We don't send push notifications, so we don't collect a push token.
Questions: who asked whom, the name of the person the date is about as the asker wrote it, the day and month asked about, the kind of date (a birthday or a named event), and its status. Never a year of birth. Deleted 30 days after the question is answered, declined, withdrawn or expires (questions expire after 14 days).
Answers: confirm, a corrected day and month, or decline, with the time of answering. Deleted with their question.
Shared contacts: who shared with whom, the shared person's display name, and a copy of the details the sender chose to include: names, birthday, other dates, phone numbers and email addresses. Never a photo, notes or relationships, and never a child's year of birth. The copy is encrypted while we hold it and is deleted as soon as the recipient adds or declines it, the sender withdraws it, or it expires after 30 days; only the recipient can fetch it, and only in the app. The record that a share happened (without the details) is deleted 30 days later.
Shared trees: who shared with whom, the name of the person the tree starts from, how many people it holds, and a copy of the part of the tree the sharer chose: each person's name, the birthdays and other dates they chose to include, and how the people shared are related (parent of, partner of, sibling of and so on). Never a photo, notes, contact details, your own words for a relationship, anyone outside the part shared, or a child's year of birth. The copy is encrypted while we hold it and is deleted as soon as the sharer revokes it, the recipient removes it, or it expires (after 7 or 30 days, or when revoked if the sharer chose that); only the recipient can fetch it, and only in the app. Each time they open it we record the time, nothing else. The record that a share happened (without the tree) is deleted 30 days after it ends.
Your linked profile: once someone asks to link you, the app sends us your own name and birthday from your own entry in Connect: the day and month, and the year only if you switch on "Include my birth year" (it is off unless you do). Never a photo, and nothing else. It goes only to people whose link you have accepted, in the app. It is encrypted while we hold it, and deleted once nobody has a waiting or accepted link to you, or when you delete your account.
Links: who asked to link whom, whether the request is waiting, accepted or declined, and when. When someone you linked changes their name or birthday, we keep the change for you to review, encrypted, until you accept or reject it; to send only real changes we keep a scrambled fingerprint of what we last sent you, never the details. A request nobody answers expires after 30 days, and a declined or expired one is deleted 30 days later. An accepted link lasts until either of you unlinks or deletes their account, and any change waiting goes with it.
Link invitations: when you ask to link someone not yet on Connect, the name and email address you enter for them. Cleared once they sign in with that address, when the request waits for them in the app; otherwise deleted with the request.
Relationship suggestions: when you suggest to someone you have linked how two people are related, who sent it, who it is for, the two people as their Connect accounts (each is the sender, the recipient, or someone both of them have linked), the kind of relationship (parent of, partner of, sibling of and so on) and, if you add one, your own word for it. The relationship and your word are encrypted while we hold them, with a scrambled fingerprint so the same suggestion isn't stored twice. Deleted as soon as the recipient accepts or rejects it, when the link it came through is removed, or after 30 days.
Backups: when you are signed in, the app backs up what you keep in Connect (your people, relationships, contact details, dates, reminders, groups, settings and your sharing records) once a day when something has changed, or when you tap Back up now. Photos are not included. We keep your latest 3 backups and delete older ones as new ones arrive; deleting your account deletes them all. Each backup is encrypted with a key that belongs to your account, and that key is itself encrypted with a key we keep apart from our database. So that you can never be locked out of your own backup, Connect can decrypt a backup to restore it to you: that happens only when the app, signed in to your account, downloads it to restore it, and each time it happens we record which backup and when, never what is in it. We do not open backups for any other purpose. We also record each backup's time, size, the device name the app sends, and its format version.
Invitations: the name and the email address or phone number given for someone not yet on Connect, and a one-time link (stored only in scrambled form). Deleted when the invitation is used, withdrawn or expires.

When you ask a question, share a contact or part of your tree, or ask to link someone, the app checks whether that one person is on Connect by sending their email addresses and phone numbers from your record, at that moment. We do not keep that lookup, and your address book is never uploaded.

What we use it for

Only to deliver questions, answers, shared contacts, shared trees, linked profiles and relationship suggestions between members, to keep your backups and restore them to you, to sign you in, and to protect the service from abuse (for example, limiting how many questions, shared contacts, shared trees, link requests, relationship suggestions or backups can be sent). We do not sell data, show advertising, or build profiles.

Email

We send sign-in codes, invitations, and a note when someone asks you a question, shares a contact with you (with their name and the shared person's name only) or shares part of their tree with you (with their name only). For links we send a note when someone asks to link you, and when someone you linked accepts or updates their details (at most one a day for each link), each with their name only; someone not yet on Connect gets an invitation with the requester's name and the name typed for them. When someone suggests a relationship to you we send a note with their name only (never the people or the relationship), at most one a day. Link and relationship-suggestion notes follow your setting for question emails, and every note has a link to turn its kind off. We don't send marketing.

What our staff can see

We run Connect with an admin tool that staff sign in to with a password and then a code emailed to them. It shows account details (email address, name, phone number, device names, when an account was created and when its devices were last used) and who asked, shared with, linked or sent a suggestion to whom, when, and in what state, with counts and sizes (how many people a shared tree holds, how large a backup is), and the addresses of emails not yet sent. It never shows anyone's people or dates, the name or date a question is about, a shared contact or tree, a linked profile, a relationship suggestion's content, or what is in a backup, and it decrypts nothing. Every action staff take (suspending, signing out or deleting an account, clearing its limits, retrying an email, changing staff roles) is written to an audit log that can't be edited or deleted, with who did it, when and why. Every time a backup is decrypted we record which backup and when.

Where it is kept

On a server we operate, rented from Hetzner Online GmbH in its data centre in Nuremberg, Germany (in the EU). Nightly backups of the database are kept on that server and copied to Amazon Web Services (Amazon S3) [region: to be confirmed], and kept for [retention: to be confirmed]. Deleted data leaves backups as they rotate out.

These web pages, with their fonts and scripts, are served only from that server: opening them loads nothing from any other company.

Your choices and rights

You can change your name and phone number in the app, and delete your account in the app or on the web at any time. Deleting removes your account, your devices, your backups, your linked profile, and every question, answer, shared contact, shared tree, link and relationship suggestion you are part of. Staff actions about your account stay in the audit log without your email address. You can unlink anyone at any time, and turn each kind of email off. Depending on where you live you may have further rights (access, correction, objection, complaint to a regulator). Write to privacy-connect@avenainteractive.com.

Children

Connect accounts are for adults. Questions about a child's date go to their parent, never to the child. A child's details can be shared by an adult, as a contact or in part of a tree, with the day and month of their dates but never the year. The app won't link a person you have marked as under 18.

Who we are

[Legal entity, address and contact: to be confirmed.]