Who we are
Witness — Family History Intelligence ("Witness," "we") is an independent app, available on iOS, iPad, and the web at app.witnesslives.com, operated by Rufus Howe. Questions about this policy or your data can be sent to support@witnesslives.com.
What we collect and why
Account information
Your email address and authentication credentials, used to create and secure your account, and your subscription status, used to manage your trial and membership.
Your family tree
When you import a GEDCOM file, two things happen:
- Your original file is encrypted on your device before upload and stored as an unreadable blob. We cannot open or read it. It exists so you can restore your import.
- A minimal index of names, dates, places, and family relationships is stored in our database so the app can answer your questions and generate historical context. This index is protected by access controls scoped to your account alone.
Living relatives
People in your tree who appear to be living are treated differently: they are excluded from all AI processing, never appear in shareable content, and are stored with an additional layer of encryption. They never leave your device unprotected.
Location
Field features like "I'm Here" mode and cemetery search use your device's GPS (or, on the web app, your browser's location permission) to match nearby places against your own tree. Your location is used in the moment you use these features. We do not track, log, or store your movements, and location is never shared with third parties.
Usage and diagnostics
We collect basic diagnostic information (crashes, performance) to keep the app working. We do not sell data, run ads, or use third-party advertising trackers.
AI-generated content
Witness uses Anthropic's Claude models to generate ancestor biographies, historical context, digest notes, and research briefs. To do this, relevant details from your tree's index — names, dates, places, and family structure of deceased individuals only — are sent to Anthropic's API for processing. Anthropic does not use API data to train its models. Generated results are cached so repeat requests don't require reprocessing.
Historical record matching
To surface possible matches from the National Archives, Witness sends names, dates, and places of deceased individuals in your tree to the National Archives Catalog (catalog.archives.gov) to search public historical records. Nothing about you as a living person — your identity, account, or location — is included in these searches. Matches are shown to you as leads worth investigating, never as confirmed facts.
Sharing
Nothing about your tree is public by default. If you choose to share an ancestor's story card, Witness creates a tokenized public link showing only what you saw when you shared it — never your live tree, and never a living person (the option is hidden for them). These links are revocable at any time from within the app and expire automatically after 90 days. Research briefs can also be shared using your device's standard share sheet. We do not share, sell, or rent your personal information to anyone.
Service providers
Witness is built on a small set of infrastructure providers, each receiving only what its function requires:
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase | Database, storage, authentication | Account info, tree index, encrypted GEDCOM blob |
| Anthropic | AI enrichment | Deceased individuals' index details, per request |
| Apple / RevenueCat | Subscription billing (iOS) | Purchase and subscription status; Apple handles payment details — we never see them |
| RevenueCat / Stripe | Subscription billing (web) | Purchase and subscription status; Stripe handles payment details — we never see them |
| Resend | Weekly digest email, if you opt in | Your account email and that week's anniversary content from your own tree |
| National Archives (NARA) | Historical record matching | Names, dates, and places of deceased individuals only |
| OpenStreetMap (Nominatim) | Place geocoding | Place names from your tree (no personal names) |
| Wikidata / Library of Congress | Historical event and newspaper context | Dates and places only |
Data retention and deletion
Your data is retained while your account is active. You can delete any imported tree from within the app, which removes its index and stored file, and revoke any share link at any time. To delete your account and all associated data, email support@witnesslives.com from your account address; we will confirm removal. Cached AI content tied to your trees is deleted with them.
Security
Data in transit is encrypted with TLS. Your original GEDCOM file is encrypted on your device before upload with keys we do not hold. Database access is restricted by row-level security so that your tree is queryable only by your authenticated account.
Children
Witness is intended for adults and is not directed at children under 13. We do not knowingly collect personal information from children. Deceased ancestors in your tree are historical records, not app users.
Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal information. Witness supports all of these regardless of jurisdiction — email support@witnesslives.com and we will honor your request.
Changes to this policy
If this policy changes in a meaningful way, we will note the new effective date here and inform you in the app. Continued use after a change means you accept the updated policy.
Contact
Witness — Family History Intelligence
support@witnesslives.com
witnesslives.com