Who we are
Witness — Family History Intelligence ("Witness," "we") is an independent app, available on iOS, iPad, and the web at app.witnesslives.com, operated by Rufus Howe. Questions about this policy or your data can be sent to support@witnesslives.com.
What we collect and why
Account information
Your email address and authentication credentials, used to create and secure your account, and your subscription status, used to manage your trial and membership.
Your family tree
When you import a GEDCOM file, two things happen:
- Your original file is encrypted on your device before upload and stored as an unreadable blob. We cannot open or read it. It exists so you can restore your import.
- A minimal index of names, dates, places, and family relationships is stored in our database so the app can answer your questions and generate historical context. This index is protected by access controls scoped to your account alone.
Living relatives
People in your tree who appear to be living are treated differently: they are excluded from all AI processing, never appear in shareable content, and are stored with an additional layer of encryption. They never leave your device unprotected.
Location
Field features like "I'm Here" mode and cemetery search use your device's GPS (or, on the web app, your browser's location permission) to match nearby places against your own tree. On iOS, your location is processed on your device and never transmitted to us or anyone else. On the web app, your coordinates are sent once to OpenStreetMap's Nominatim service to put a name to the town you're standing in — nothing about who you are travels with them. We do not track, log, or store your movements.
Usage and diagnostics
We don't use ad trackers or cross-site analytics — no Google Analytics, no Meta Pixel, no ad-tech SDK of any kind. We do keep basic operational logs in our own database: sign-ins, which features get used, and the size of imported files. This is used only to run and improve the app — it is never shared, sold, or used for advertising, and it never leaves our own systems. Our subscription processor (RevenueCat) receives the basic purchase and device information billing requires, keyed to your account ID. We do not sell data, run ads, or use advertising trackers.
Two things happen on the website itself. We count page views with Vercel Web Analytics, which is served from our own domain, sets no cookie, and does not follow you anywhere else. And if you reach us from a link we have shared — a society newsletter, a post, a podcast — we keep the campaign name from that link in a cookie on witnesslives.com, so we can tell which of those efforts actually brought someone here. That cookie holds the name of a campaign and nothing else: no name, no identifier, nothing about your tree. Clearing your cookies removes it.
AI-generated content
Witness uses Anthropic's Claude models to write ancestor biographies, historical context, the daily note on Home, story arcs, the overview of a tree, and research briefs, and to read headstone and other photographs you add; a Microsoft Azure neural voice records the Hearth's narrator. To do this, relevant details from your tree's index — names, dates, places, events, and family structure of deceased individuals only — and the photographs you chose to have read are sent to the provider's API for processing. Neither provider may train on what we send; Anthropic deletes API inputs and outputs on its side within thirty days. Generated results are kept with your tree so repeat requests don't require reprocessing, and are deleted with it.
A tree read from FamilySearch Family Tree is kept out of the models and the recorded voice by a wall in the code and the database, except on the surfaces opened by name: since October 29, 2026 the written story, the world around a person, and the Hearth's spoken household, for which the documented facts from Family Tree are given to the model as for any other tree. Nothing a model writes is ever sent to FamilySearch. The full account of what the models are given, what they are kept from, where you meet them in the app, and what to do when a story is wrong is at witnesslives.com/ai.
Historical record matching
To surface possible matches from the National Archives, Witness sends names, dates, and places of deceased individuals in your tree to the National Archives Catalog (catalog.archives.gov) to search public historical records. Nothing about you as a living person — your identity, account, or location — is included in these searches. Matches are shown to you as leads worth investigating, never as confirmed facts.
Sharing
Nothing about your tree is public by default. If you choose to share an ancestor's story card, Witness creates a tokenized public link showing only what you saw when you shared it — never your live tree, and never a living person (the option is hidden for them). These links are revocable at any time from within the app and expire automatically after 90 days. Research briefs can also be shared using your device's standard share sheet. We do not share, sell, or rent your personal information to anyone.
Service providers
Witness is built on a small set of infrastructure providers, each receiving only what its function requires:
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase | Database, storage, authentication | Account info, tree index, encrypted GEDCOM blob |
| Anthropic | AI writing and photograph reading | Deceased individuals' index details and photographs you chose to have read, per request; deleted on their side within 30 days |
| Microsoft Azure | Recorded narrator voice (Hearth) | The narration text for one household, deceased members only |
| FamilySearch | Reading your branch of Family Tree, if you sign in with FamilySearch; one write, a headstone photograph as a Memory, if you choose it | Your FamilySearch sign-in for that session; the photograph and caption you choose to send. Nothing from Family Tree is sent to any AI provider. |
| Apple / RevenueCat | Subscription billing (iOS) | Purchase and subscription status; Apple handles payment details — we never see them |
| RevenueCat / Stripe | Subscription billing (web) | Purchase and subscription status; Stripe handles payment details — we never see them |
| Resend | Weekly digest email, if you opt in | Your account email and that week's anniversary content from your own tree |
| National Archives (NARA) | Historical record matching | Names, dates, and places of deceased individuals only |
| OpenStreetMap (Nominatim) | Place geocoding | Place names from your tree (no personal names) |
| Wikidata / Library of Congress | Historical event and newspaper context | Dates and places only |
Data retention and deletion
Your data is retained while your account is active. You can delete any imported tree from within the app, which removes its index and stored file, and revoke any share link at any time. To delete your account and all associated data, use Delete your account on the You screen (under Help & account) — it removes every tree, shared link, and stored file, then the account itself. You can also email support@witnesslives.com from your account address and we will do it for you. Cached AI content tied to your trees is deleted with them. Deleting your account does not cancel a subscription — cancel that first (App Store subscriptions in Settings, web subscriptions from the You screen).
Security
Data in transit is encrypted with TLS. Your original GEDCOM file is encrypted on your device before upload with keys we do not hold. Database access is restricted by row-level security so that your tree is queryable only by your authenticated account.
Children
Witness is intended for adults and is not directed at children under 13. We do not knowingly collect personal information from children. Deceased ancestors in your tree are historical records, not app users.
Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal information. Witness supports all of these regardless of jurisdiction — email support@witnesslives.com and we will honor your request.
Changes to this policy
If this policy changes in a meaningful way, we will note the new effective date here and inform you in the app. Continued use after a change means you accept the updated policy.
Contact
Witness — Family History Intelligence
support@witnesslives.com
witnesslives.com