Privacy Policy

This policy explains what personal data OpenHeritage ("we") collects, why we use it, who else receives it, how long we keep it and what you can do about it. It covers the openheritage.online website, the OpenHeritage mobile app, our Telegram bot, the public API and MCP server, and the emails we send. Requests about a specific grave, memorial or photo are explained in more detail in the articles on burial data and requests (in Ukrainian).

1. Who we are and how to contact us

OpenHeritage is a project run from Ukraine that preserves memorials, cemetery photographs, archival documents and genealogical research. For any question about this policy or your data, write to [email protected] or use the Contacts page. Requests about personal data are reviewed by our support team.

2. Your account

You can create an account with a username and password, with Google or with Telegram. For each account we store:

• your username and a hash of your password (never the password itself);
• your email address, if you provide one: it is optional, and so is confirming it;
• the profile details you choose to add: first and last name, city, country, birth year, phone, address, biography and public contacts;
• your roles, the dates you registered, last signed in and were last active, and the date you accepted the Terms of Service;
• your points and their history, any ad-free period, and fingerprints of your personal API tokens (not the tokens themselves);
• your settings: interface language, time zone, whether you take part in leaderboards and prize draws (both on by default), whether your profile appears in search (off by default) and your email preferences.

If you sign in with Google, we receive your Google account identifier, email address, name, profile picture and language. If you sign in with Telegram, we receive your Telegram identifier, username, name, language and profile photo; we keep a copy of the photo, and of earlier photos when you change it.

3. What you contribute

Most of what you add is meant to be public: memorials, cemetery and grave photographs, historical photographs, sources, documents, transcriptions and research projects. Your username, and your full name if you provided it, are published as the contributor. We also store:

• for memorials: the names, dates and places of the people buried, and the inscription, religion, cause of death and notes when they are recorded;
• for photographs: who uploaded them, the original file name, checksums and similarity fingerprints used to find duplicates, and the camera data and GPS coordinates in the file (see section 4);
• people marked on photographs: areas outlined by hand, with the name and dates someone entered. We do not use face recognition;
• research projects, which can be public, reachable only by direct link, non-public (visible to signed-in users only) or private, and may contain Y-DNA or mtDNA haplogroups if you add them;
• family tree files (GEDCOM or Gramps) submitted for matching: living people and people marked as private are excluded from matching, and each match stores the identifiers and names of both users;
• your views, appreciations and complaints about photographs, and the delivery country of Marketplace orders.

The edit history of sources keeps earlier values, including removed ones, and signed-in users can see it. Under Article 7 of the Law of Ukraine "On Burial and Funeral Business", information about a deceased person shown at a burial place is not confidential. Portraits on gravestones may be protected by Articles 303 and 308 of the Civil Code of Ukraine. Please do not add contact details or other data about living relatives.

4. Photographs, camera data and location

Photo files often contain metadata: the date taken, the camera model and GPS coordinates. This is what happens to it:

• the copies shown on the site (previews and resized versions) do not contain this metadata;
• the original file is kept unchanged together with its metadata, because original files are never modified;
• signed-in users may have access to original files, subject to privacy restrictions;
• GPS coordinates are also stored separately and may be shown with the photograph and on maps;
• areas blurred for privacy stay blurred in every copy shown on the site.

If you do not want the location of a photograph to be kept, remove it from the file before uploading.

5. Cookies and browser storage

We set only our own cookies. We do not use third-party analytics or advertising networks.

• auth_token keeps you signed in; scripts cannot read it; it lasts 3 months;
• oh_vid is a random visitor identifier used to protect the platform, to keep assistant conversations and for our own statistics; it lasts 1 year;
• oh_attr records the campaign tags (UTM) of one of our short links when you follow it; it lasts 30 days;
• culture, openheritage-theme and darkMode remember your language and theme for 1 year;
• technical cookies protect forms against forgery and last until you close the browser.

The site runs behind Cloudflare, which may set its own security cookies. Your browser's local storage keeps interface settings, drafts and the state of interrupted uploads, and its session storage keeps assistant settings; this data stays on your device. The registration captcha runs on our own servers.

6. Data collected automatically

When you use OpenHeritage, our systems record technical data in three categories: connection data, device and browser data, and usage data. In particular:

• Cloudflare, which carries all traffic to the site, passes your IP address and country to us;
• requests are counted per account or per IP address to prevent abuse;
• an audit log records significant actions together with account and technical data;
• requests to the public API and MCP server are logged with the IP address, browser, country and request content;
• our own statistics record usage events together with technical identifiers;
• the search log keeps search queries together with technical identifiers;
• feedback you send is stored together with technical data and any contact you leave;
• conversations with the AI assistant are stored, and technical data about them is used to operate the service.

7. Email

We send email from [email protected]; replies go to [email protected]. There are four kinds of email:

• security emails, such as address confirmation and password reset;
• account emails;
• community notifications;
• the newsletter and weekly digest.

We send community notifications and the newsletter only with your consent, for example given with the boxes at registration or in your notification settings, and each such email has a one-click unsubscribe link. Security and account emails are sent for as long as you have an account. Our emails may contain technical means of measuring delivery and engagement. Email is delivered by Resend, SMTP2GO and Mailjet.

8. Advertising

OpenHeritage shows only its own advertising campaigns, on a limited set of pages. We do not use advertising networks and do not target ads by your behaviour or family history. For each ad shown or clicked we store the campaign, the placement, the day and a hashed visitor code derived from your account, visitor identifier or IP address; the identifier itself is not stored. These records are deleted after 90 days, and only daily totals remain. You can buy an ad-free period with points.

9. Why we use your data

We use personal data for these purposes:

• to run your account and the services you use, such as uploads, search, matching, the AI assistant and points;
• with your consent: for community emails and the newsletter, leaderboards and prize draws, and showing your profile in search;
• to preserve historical, cultural and family memory in the public interest, including publishing information shown on graves;
• to protect the platform: preventing abuse, investigating incidents and keeping backups;
• to meet legal obligations and answer lawful requests from public authorities.

We aim to process only data that is adequate and not excessive for these purposes, as required by Article 6 of the Law of Ukraine "On Personal Data Protection". You can withdraw your consent at any time in your settings or by writing to us.

10. Who receives your data

We do not sell personal data. To run the platform, some data is passed to these services:

• Cloudflare carries all traffic to the website;
• Google Cloud Vision, OpenAI and Google Gemini receive images of graves and documents for text recognition, and OpenAI also processes messages to the AI assistant;
• Resend, SMTP2GO and Mailjet deliver our email;
• Google and Telegram take part when you sign in with them, and Telegram also carries your conversation with our bot;
• DigitalOcean stores backup copies of the database and of original files;
• the Karma reputation service at uagenealogy.com receives your user identifier and contribution totals when that integration is enabled;
• Gramps Web at gramps.openheritage.online receives your username and email when a family tree is created for you there;
• search engines receive only the addresses of public pages, through IndexNow;
• OpenStreetMap services (Nominatim and Overpass) and map providers (OpenStreetMap, Esri, OpenHistoricalMap and OpenMapTiles) receive your IP address and the area or place you view or search for.

Text recognition can also use other providers connected by our administrators. Search, the models behind it and part of text recognition run on our own servers. The Ukrainian-language page about DNA embeds YouTube videos in privacy-enhanced mode and links to a Google form. Some of these services are located outside Ukraine and the European Union. We may also disclose data when the law requires it.

11. How long we keep data

We keep data for these periods:

• server logs and traces: 14 days; technical metrics: 30 days;
• advertising events: 90 days, after which only daily totals remain;
• email content: from 1 to 30 days depending on the kind of email; delivery records: 1 year; addresses that unsubscribed or could not receive our email are kept indefinitely so that we do not write to them again;
• Telegram bot sessions: 24 hours;
• photographs queued in the mobile app: deleted from the phone 14 days after upload;
• cookies: as described in section 5.

Account data is kept while the account exists; after an account is deleted, some of it may remain where it is linked to contributions, records or backups. Contributed content is kept without a fixed limit as part of the archive, unless it is removed on request or by a moderation decision. Records of activity and other technical data are kept without a fixed period, for security, abuse prevention and operating the service. Backups are kept long-term to restore the platform after a failure, and deleted data may remain in them.

12. Your rights

Under Article 8 of the Law of Ukraine "On Personal Data Protection" you can find out which data we hold about you, receive a copy, have it corrected or deleted, object to its processing, withdraw consent and complain. In your profile you can:

• edit your profile and change your password;
• connect or disconnect Google and Telegram;
• choose whether your profile appears in search and whether you take part in leaderboards and prize draws;
• manage notifications and unsubscribe from emails.

To delete your account, receive a copy of your data or change your email address, write to [email protected] from the email address on your account, or explain how we can confirm that the account is yours. Some data may be kept after an account is deleted where it is needed for the purposes in section 9 or required by law; tell us what you want removed, and we will do what is technically and legally possible.

If a memorial or photograph concerns you or your family, use the report button on its page or email us its address. We can correct the record, hide a living person's data, blur part of a photograph, reduce the precision of its coordinates, remove a photograph, make the record non-public or, in exceptional cases, delete it. We aim to check a request within 5 working days and decide within 15 days, within 30 days for complex cases and, exceptionally, within 45 days. You can appeal a decision within 30 days. You can also complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.

13. Children

OpenHeritage is not intended for children under 14. If you believe that a child under 14 has created an account, write to us and we will close it.

14. Mobile app and Telegram bot

The mobile app for photographing graves asks for access to the camera, to storage or the photo library, and to your location; on iOS it may ask for location access "Always" rather than only "While Using the App". While the app is open it reads your location every 5 seconds, writes it into the photographs you take and uses it to find nearby cemeteries. Photographs wait in a queue on your phone and are deleted from it 14 days after upload.

For 24 hours the Telegram bot keeps a session with your chat and user identifiers, email, name, username, language and the import you are preparing. When you forward a message to the bot, we record who originally sent it: their display name, username and Telegram identifier. The display name may be saved as the author of the imported source.

15. Security

We protect data with encrypted connections, a sign-in cookie that scripts cannot read, password hashing, temporary account lockout after failed sign-ins, request limits, our own captcha and restricted access to original files and servers. No system is completely secure; if you notice a problem, write to [email protected].

16. Changes to this policy

We will update this policy when the platform changes the way it handles data. The date of the current version is shown below, and significant changes are announced in the platform updates. The Ukrainian version is the official one.

Last updated: 30 September 2026