Privacy policy

This Privacy Policy explains how Nearest & Dearest LLC, a Utah limited liability company ("Nearest & Dearest," "we," "us," "our"), collects, uses, and shares information when you use our family tree design application and related services (the "Service"), formerly Dearest Forever.

1. Information we collect

Information you provide

• Account information — email address and authentication-related identifiers, and, if you sign in with Google, the name and profile picture on your Google account
• Project/family tree data — names, relationships, dates, places, notes, photos, and obituaries you choose to provide
• Order information — shipping address and details needed to fulfill physical print orders
• Support communications — information you share when contacting us

Information about other people

A family tree is mostly information about other people, and most of them will never use this service. When you add a relative you may record their name, their relationships, dates and places connected to them, notes, and photographs of them. We hold that information because you asked us to, in order to build and print the tree you are making.

We do not use it to build profiles, we do not combine trees from different accounts to make a larger record of anyone, and we do not make it searchable. Within one tree, the page opened from the code or tag on a printed tree lets the people allowed to see that page search that tree by name; nothing is searchable across trees or across accounts. A tree is visible to the account that made it, to the people it is shared with (including family approved after asking from a printed tree), to anyone holding a link that account has shared, and to anyone holding a print whose page its owner has opened to anyone. If you believe you appear on a tree and you want that changed, see “If you appear on someone else’s tree” below.

Faces in your photos

If you choose a photo layout, where each person’s photo fills their place on the chart, the designer looks for the faces in your photos so it can frame each person well. This happens in your browser. It finds where a face is, never whose face it is, and it creates no face template or other biometric identifier. The face positions it finds stay on your device. What you choose for each photo, such as where it sits and how far it is zoomed, is saved with your tree like your other design choices.

Photos in a photo layout

Many family photos are too small to print sharply in a photo layout, so the designer sends the small photos of the people nearest the middle of the chart, out to great-great-grandparents, to a program of ours that enlarges them for print. A photo also goes to that program when you use one of the photo tools on it: removing the background, extending the edges, sharpening a face or colorizing. Photos go only while you are signed in, and only the picture goes, never the person’s name, dates or anything else from your tree. The program holds a photo only while it works on it, keeps what it makes for up to 30 days so it doesn’t have to make it again, and then deletes it. Nothing it receives is used to train an AI model. A sharpened face or a colorized photo is the program’s guess at the detail or the colors, not a record of them.

Information collected automatically

• Basic technical data — device and browser information, IP address, and diagnostic logs (primarily for security and reliability)

Payment information

Payments are processed by Stripe. We do not store your full payment card number. Stripe may collect and process payment information under its own privacy policy.

2. How we use information

We use information to:

• Provide, operate, secure, and maintain the Service
• Create and render your family tree designs and previews
• Enlarge photos for print, and change them as the photo tools you use describe
• Read an obituary you add and suggest facts from it for you to review
• Compose short biographies of people on your tree who have died, when they are chosen with a print, for the page behind the code or tag, for each person’s page in your tree, and for the family email if you sign up for it
• Make the puzzles, games and calendars generated from your tree
• Process transactions and fulfill physical print orders you request
• Provide customer support and communicate with you about your account or orders
• Find and fix mistakes in, and improve, the way the Service builds trees, pages and biographies; to do this, a member of our team may read a tree’s biographies and the entries they were written from
• Prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not use the information in your tree to train AI models, we do not use it in our marketing without your permission, and we do not sell it. Our Terms of Use set out the limited license you give us to it, what you may do with the biographies, puzzles, games and calendars we make from it, and the scraping, copying and reverse engineering they forbid.

3. How we share information

We do not sell your personal information.

We share information only in limited circumstances:

Service providers

We use a small number of companies to run the service. They may only use what they receive to do work for us, and they must protect it. Where a company works behind the scenes we describe it by what it does; where you deal with a company directly, or it sets cookies in your browser, we name it. You can ask us for the names of any of them at any time.

• A database, sign-in and file storage provider. Family tree content is encrypted at rest.
• A website hosting and delivery provider, which also runs the challenge that protects our forms from bots.
• A hosting provider for three programs of ours: the one that writes the short biographies described under “The page behind the code or tag on a print,” the one that reads an obituary you add, described under “Obituaries you add,” and the one that works on photos, described under “Photos in a photo layout.” The first two read a tree only while they work and delete their working copy when they finish.
• AI service providers, for the biographies described under “The page behind the code or tag on a print”: to read in full the obituaries you added and suggest the facts they mention, as described under “Obituaries you add,” and to help write and check the biographies, and to help our team find and fix mistakes in them. We use only providers that are barred by contract from training their models on what we send, and that delete it within 30 days unless they must keep it longer to prevent misuse or to comply with the law.
• An email delivery provider, for messages such as order confirmations, account emails and the family email described under “The family email.”
• A team messaging provider, where we read the messages you send through our contact and help forms, with the email address and phone number you include.
• A shipping provider, for shipping labels and delivery tracking.
• Stripe — payments (see below)
• Google — sign-in, if you choose to continue with Google, which gives us your name, email address and profile picture; a private spreadsheet we use internally to manage orders; and address suggestions (Google Maps Places), which receives the shipping address text you type at checkout and your IP address
• PostHog and HubSpot — analytics and live chat, described in section 6
• FamilySearch — only if you choose to connect it, and only to read the tree you authorise

Some pages embed video from Vimeo or YouTube. Playing one lets that provider see your IP address under its own privacy policy.

Where information is processed

We are based in the United States and our providers process information in the United States and other countries. If you are in the United Kingdom, the European Economic Area, or Switzerland, this means your information is transferred outside your country. Where that transfer needs a legal basis, we rely on our providers’ standard contractual clauses and equivalent safeguards.

Order fulfillment

If needed to produce and deliver your physical prints, we may share limited information (such as your shipping address and order details) with printing, framing, or shipping providers. We share only what is reasonably necessary to fulfill your request.

The page behind the code or tag on a print

If the person who ordered a print chose it, the print carries a small code or tag. Scanning the code, or tapping the tag with a phone, opens a page about the tree, and the tree’s owner chooses who can see it.

By default the page shows the tree only to people signed in to an account with access to that tree: the people it is shared with, and family approved after they ask. Anyone else sees the tree’s name and a way to ask. Approved family see the tree the way a shared link shows it, living relatives included, along with anything the family has written on a person’s About tab. Asking shows the tree’s owner and editors your name, your email address, and any note you add.

The owner can instead let anyone holding the print open the page without signing in; for a printed code, that includes anyone who scans the code from a photo of the print. The page then shows a living relative only by their name and how they’re related.

For people who have died, the page may also show short biographies we compose from the names, dates and places entered on the tree, from what the family has written on a person’s About tab (including facts they confirmed from an obituary), and from the general history of those places and times. We write them only when someone chooses them when ordering a print, or orders a print with the code or tag, and they also appear on each person’s page in your tree, whether or not the print carries a code or tag. Our own software writes each biography first. When a person has their own reviewed obituary or life history, or family stories on their About tab, or is the person or couple the print is made for or one of their closest ancestors (parents through great-great-grandparents), an AI service then rewrites the biography from that same material, and a second AI service checks each sentence against it; anything they cannot back up is replaced with our own software’s wording or taken out. For this, the AI services are sent that person’s entries from the tree and their About tab, their family stories in full, their own obituary or life history where they have one, the paragraphs of a relative’s obituary that speak of them, and the names and dates of the close relatives the biography may mention, living ones included. Before anything is sent, we take out the street addresses we find in the About tab, the family stories and the obituaries (a place entered on the tree itself is sent as entered), cut to the year the dates the tree records for the living relatives it names (a date written only in a story or an obituary is sent as written), and remove the obituary sentences we find that list surviving relatives or that hold a fact you rejected or left unconfirmed. In lists of children, siblings and survivors we also hold back the names we find of relatives who are not on the tree, unless the same sentence holds a fact you kept when you reviewed the obituary. The owner can turn the page off at any time; a page someone already opened can stay viewable for up to two hours.

The family email

If you sign up for our family email, in your account settings or by leaving its box ticked when you ask for their stories with a print, we send it to the address you signed up with. It is made from the tree you choose: the names, birthdays, anniversaries and other dates on it (for a living relative, never their age or the year they were born) and questions about the people on it. It can also include the biographies described above. Anyone the tree is shared with can sign up for it as well, so what it carries can reach their inbox too. Every email has a link to stop it, and you can also turn it off in your account settings.

Obituaries you add

You can add a person’s obituary to their About tab. We keep its text with the tree, and our software reads it to suggest facts for the book and the biographies: dates, parents, marriages, work, service and the like. You then review every suggestion, untick or correct anything wrong, and answer any question where the obituary and the tree disagree. If you leave the review part way, the suggestions that were already ticked are kept, and you can change them later. The obituary’s list of surviving relatives is used only to check who was living, and is never printed.

When you add an obituary, our own software reads the dates, the family and the service details; nothing is sent outside our service for this reading. When we write a printed tree’s biographies, we read the rest of each obituary too: we send it to an AI service to suggest the other facts it mentions, add them to the obituary’s suggestions for you to review, and until you do, use the ones that would have been ticked. Before anything is sent, we remove the sentences that list surviving and deceased relatives and the funeral, viewing and burial details. What is sent still names the person who died, and may name other people the obituary mentions elsewhere, such as their parents or spouse; we also send the person’s name and, if you gave it, the newspaper. For this reading, the AI service is not given your family tree. We keep its suggestions with the obituary, so the same obituary is not read twice. The biographies themselves are a separate step: they may draw on the whole obituary, as described under “The page behind the code or tag on a print.”

With your authorization

We may share information when you direct us to do so (for example, if you request a feature that sends information to a third party).

Legal and safety

We may disclose information if required by law or if we believe disclosure is necessary to comply with legal process, protect rights and safety, or prevent fraud and abuse.

Business transfers

If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

4. Your choices and controls

Project storage is optional

The Service may store your projects so you can return later. If you choose to keep your project data stored with us, you do so voluntarily. We use reasonable safeguards, but no system can guarantee absolute security.

Deleting a tree or your whole account

You can delete an individual family tree at any time from inside the designer, and you can delete your entire account from Account settings. Deleting the account removes your trees, their photos, and your sign-in. It takes effect straight away and does not need to go through us.

If you cannot sign in, email team@nearestdearest.com from the address on the account and we will do it for you. We may ask you to verify your identity first.

We may retain certain information as required by law or for legitimate business purposes (e.g., transaction records, dispute resolution, and security logs). Backups may persist for a limited period.

Your rights over your information

Wherever you live, you may ask us for a copy of the information we hold about you, ask us to correct it, ask us to delete it, or object to a particular use. Email team@nearestdearest.com and we will respond within the time your local law allows. We will not treat you differently for asking.

If you are in the United Kingdom, the European Economic Area, or Switzerland, you also have the right to receive your information in a portable form, to withdraw consent where we rely on it, and to complain to your national data protection authority. If you are in California, we do not sell or share your personal information as those terms are defined by the CCPA, and we have not done so in the past twelve months.

If you appear on someone else’s tree

You can ask us to remove information about you from a tree you did not create. Email team@nearestdearest.com and tell us as much as you can: the link you saw, the name shown, and who you believe entered it. If you saw it on a page opened from a printed tree, send the address your phone opened, or a photo of the print; either lets us find the tree.

We ask for that detail for a reason worth stating plainly. Tree contents are encrypted, and we deliberately keep no searchable index of the people inside them, so we cannot look someone up by name across the service. Building that ability would mean creating exactly the searchable record of living people we do not want to hold. Given a link or an account we can act quickly; without one we may need to ask you for more before we can find the right record.

Email preferences

If you opt in to emails about future updates, you can opt out at any time by contacting us or using the unsubscribe link if one is provided.

5. Data retention

We retain information for as long as needed to provide the Service, fulfill orders, and meet legal and security obligations. You may request deletion as described above.

When a tree or an account is deleted, its photographs and any scans you uploaded are moved to private storage that only we can reach and are permanently destroyed 30 days later. That window exists so an accidental deletion can be undone; after it passes the files are gone and cannot be recovered by anyone, including us. Database backups are kept on a rolling basis for disaster recovery and age out on their own.

An obituary you remove from a person can be restored until its tree is deleted, and deleting the tree deletes its obituaries. The facts the AI service suggested for an obituary are kept with it and go when it goes. Answers kept from earlier readings, which never include the parts we removed before sending, are kept apart from any one tree so the same text is never sent twice; we delete them on request.

6. Analytics and cookies

Essential cookies. Some cookies are required for the Service to work at all: they keep you signed in, protect forms from abuse, and remember the analytics choice described below. These are always set, because without them the Service cannot function.

Analytics. We use PostHog to understand how the site is used. It records pages viewed, how long a visit lasts, basic device and browser information, page performance, and a small number of events we define ourselves, such as completing an order. We do not use its automatic click tracking. Requests are sent through our own domain rather than directly to PostHog, and PostHog sets a cookie so repeat visits are recognised as the same person.

Session recordings and click maps. Only if you actively say yes on the banner (or in Account settings), PostHog also records how you move through our pages, such as scrolling, mouse movement and clicks, and builds maps of where people click, including clicks that go nowhere or are repeated in frustration. We use this to find what is confusing. Every typed field and every piece of text on the page is masked in your browser before anything is sent, so recordings do not contain what you type or the names and dates in your tree. We never record the sign-in, checkout, payment, redemption, account or contact pages. Simply visiting never starts a recording, even where analytics runs by default, and saying no or switching Analytics off stops it at once.

Live chat. We use HubSpot to run the chat widget so you can reach us. Its script also records which pages of our site you visit, so whoever answers your chat can see where you have been, and it sets its own cookies. It follows the same choice as analytics. It appears in the designer, including while you order a print there, but not on the checkout pages for buying an edition or a gift, and never on pages reached through a private link.

Purchases. When an order completes, our server sends PostHog a record of the sale so we can see revenue accurately even if your browser blocked the page script. That record includes your email address, the amount, the currency, the product, and the payment reference. It does not include your name, your postal address, your payment details, or anything from your family tree.

Your choice. If you are in the UK, the EU or the European Economic Area, or in Switzerland, nothing above is loaded until you agree. Everywhere else, analytics and chat start when you arrive and you can switch them off at any time. In both cases the choice is offered on a banner the first time you visit, and it is remembered for a year.

Do Not Track and Global Privacy Control. If your browser sends either signal, we treat it as a request not to be measured, we do not show you the banner, and we do not ask again. If you have an account, that choice is recorded on our side too, so it applies to the purchase records described above and not only to your browser.

Changing your mind. If you have an account, open Account settings and turn Analytics off or on. The change takes effect straight away, and applies to your account as well as this browser. Otherwise, clear this site's cookies to be asked again, or email team@nearestdearest.com and we will switch analytics off for you.

Pages reached by a private link. A shared tree, the page opened from the code or tag on a printed tree, an order status page, a gift link and a family calendar each carry a token in their address. We load no analytics and no chat on those pages at all, so the link itself is never sent to an analytics or chat provider.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. Family tree contents are encrypted where they are stored. However, no online service can guarantee absolute security.

Photos you add to a tree are kept at long, hard-to-guess web addresses so they can appear on your chart, your prints and the pages you share. They are not encrypted the way the rest of the tree is, and anyone who has one of those addresses can open the photo, even without an account, so think of a shared page's photos as visible to whoever you share it with.

If we discover a breach affecting your personal information, we will notify you and the relevant regulators where the law requires it, without undue delay, and tell you what we know and what we are doing about it.

8. Children's privacy

The Service is not intended for use by children under 13, and we do not knowingly let a child under 13 create an account. If you believe a child under 13 has created one or provided personal information directly, contact us and we will take appropriate steps.

This is separate from the children who appear on a family tree. An adult building a tree will often record their own children and grandchildren, and that information is handled the same way as the rest of the tree described in section 1: held because the account holder entered it, never made searchable, and removable on request.

9. Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify you (for example, via an in-app notice). Continued use after changes means you accept the revised policy.

10. Contact

Privacy questions or requests:
team@nearestdearest.com

Nearest & Dearest LLC
336 East University Pkwy #1209, Orem, UT 84058