Privacy notice

1. Who operates Roots, and what this covers

This notice covers the Roots website at claimmyroots.com and everything served from it: the discovery questionnaire, the country and route pages, the change alerts, and the account area.

Under European and United Kingdom data protection law, the operator named above is the controller of the personal data described here. Any question about this notice, and any request about your own data, can be sent to [email protected].

Roots is at an early stage. It is a free, invitation-only research tool, and this notice describes the service as it is today rather than as it may be later.

2. The discovery tool: what happens to your answers

The discovery questionnaire asks about your family: the countries and generations your ancestors came from, and sometimes characteristics that data protection law treats as sensitive, such as religion or a family history of persecution.

By default the questions are answered on your device. The rules themselves are shipped to your browser and run there, so working through the questionnaire sends nothing about your family to Roots. The only request the page makes before you decide anything is a check for which day's rules are current: it carries no body, no query and nothing you typed.

There is one path that reaches the server for a visitor who is not signed in: a device that cannot run the rules itself. On that path your answers are sent, the rules are run against them, the result comes back to your browser, and what you entered is then discarded. No record of an anonymous visitor's answers is written to any database, log or file.

If you are signed in, saving an assessment works differently: your answers reach the server and are kept under your account, including anything you entered about a relative and, on a route that asks it, a sensitive fact such as religion. They are kept so the assessment can be shown to you again and can become the basis of a referral dossier for a professional — section 4 says what this covers, section 8 the legal basis, section 9 how long it is kept, and section 10 how to have it deleted. Saving is your choice: every assessment can be run and read without it, and before your first saved assessment you are asked to agree to the account privacy agreement, which states this plainly.

Both halves are enforced by the code rather than promised by this page. A test asserts that no request at all is issued while you work through the questions, and that an answer is still produced with the network unavailable; a second test asserts that an anonymous assessment writes no row. Each has a mutation test beside it, so neither can pass by accident.

Saving also writes a short route summary to your case file: the country, the route, the outcome, the review state, the version of the rules used, and the date. That entry stays limited to the summary, and a separate test enforces that boundary — the full answers described above live in the saved assessment, not in the case file.

3. What the site stores in your browser

Roots uses no advertising or tracking cookies, and no third-party cookie of any kind.

By default the site saves one value in your browser: the language you chose, so the next page you open is in the same language. It stays on your device and is never sent to Roots.

Some parts of the product save a little more on your device, and only if you use them: whether you have ticked off a document on a checklist, a date of birth or length of residence you typed into a route calculator, and the version of the rules your browser last saw. These stay on your device, the server never receives them, and clearing your browser data removes them.

If you sign in, one cookie holding your session is set. It cannot be read by scripts, it is limited to this site, and it expires after twelve hours. It is necessary for signing in, so it is not something consent is asked for.

4. What Roots holds if you have an account

Accounts are invitation-only and are not being offered at this stage. What follows describes the account area for the small number of invited testers who have one.

Account: your email address, your password kept only as a hash, your passkeys if you use them, and your active sessions. Held so you can sign in and so the account stays yours.

Invitation: the address an invitation was sent to, its role, its status and its expiry. Held because entry is invitation-only.

Case: the country, the route, the outcome, the stage, the review state and the facts you enter into a case. This is the case itself.

Saved assessment: the full set of answers behind any assessment you choose to save, including what you entered about a relative and, on a route that asks it, a sensitive fact such as religion. Kept so the assessment can be shown to you again and used to build a referral dossier, until you delete it or close your account. This is separate from the case above: the case keeps only the short summary described there, and a saved assessment does not by itself start one.

Messages and documents: what you and the people assigned to your case write to each other, and any file you upload with its metadata.

Audit: who did what, when, and whether it was allowed or refused, so access to a case can be reviewed afterwards, including access that was denied.

Change alerts: if you ask to be told when a law changes, the address you gave, the jurisdiction or route you chose, and whether you confirmed the request.

5. What Roots deliberately does not collect

Roots does not ask what you own or what you earn. It takes no payment details at this stage. It uses no advertising networks, no social media pixels and no fingerprinting.

Roots does not buy personal data about you from anybody, and does not sell or share yours.

6. Analytics

Analytics collection is currently switched off, and no analytics script is loaded by this site. You can check this for yourself: the site asks the server whether collection is on before it sends anything, and today the server answers no.

If it is ever switched on, it will count events and nothing else. The design makes this structural rather than a matter of care: only events on a fixed published list can be sent, and the values a counter can carry are numbers and closed categories, so free text such as a surname or an email address cannot reach it. What would be recorded is that an assessment was run, never what it was about. This notice would be updated before that happened, not after.

7. Where the service runs, and who carries the traffic

Roots does not run in a public cloud. The application, its database and any document you upload all sit on a single server the operator owns and controls, at the operator address given at the top of this page.

The public address of the site is served through Cloudflare. Cloudflare terminates the encrypted connection at its own network and passes the request on over an outbound tunnel, so no port on the operator's network is open to the internet. That means Cloudflare, as a processor, handles the traffic between you and Roots, including your address on the network, and can see it in the clear at its edge. Cloudflare operates a global network, so this leg of the journey may pass through a country other than yours or the operator's.

Where the operator address is outside your own country, using the service involves an international transfer of your data to that country. For transfers out of the European Economic Area or the United Kingdom, Roots relies on the standard contractual clauses its providers offer, and on the fact that the amount of personal data involved for a visitor who does not sign in is limited to the network address and timestamps described above.

No external database, storage or email provider currently holds Roots data. When one is engaged, this section will name it before it starts.

8. The legal bases for processing

Running the discovery questionnaire for you: the legitimate interest in providing the service you asked for. By default nothing about you reaches the server at all, and on the path that does, the answers are discarded as soon as the result is returned, so the effect on you is limited to the moment of the request itself.

Sensitive answers, such as religion or a family history of persecution: your explicit consent, which is why the questionnaire asks these questions plainly and lets you skip them. Skipping a question costs you only the routes that depend on it.

Running your account, your case and your messages: performance of the agreement between you and the operator.

Keeping audit records, keeping the service running, and investigating abuse: the legitimate interest in operating a service that can be held to account.

Storing the address you gave so you can be told when a law changes, and sending that alert once sending is switched on: your consent, which you can withdraw at any time.

9. How long things are kept

Discovery answers from a visitor who is not signed in: not kept at all. By default they stay on your device and the server receives none of them; on the one path that does send them, they exist only for the length of the request.

Account and case data, including the answers behind a saved assessment: for as long as your account is open, and until you ask for it to be deleted.

Audit records: longer than the case, because their purpose is to show what happened after the fact. A log the subject of it can erase is not a log.

Server logs: kept for as long as they are useful for operating the service and investigating abuse, and then discarded.

Exact retention periods in months have not been fixed yet. When they are, they will appear here with a new version number rather than being applied quietly.

10. Your rights

If the law of the European Union or of the United Kingdom applies to you, you have the right to ask for a copy of the personal data held about you, to have it corrected, to have it deleted, to have its use restricted, to receive it in a portable form, and to object to processing based on a legitimate interest. Where consent is the basis, you can withdraw it at any time, and withdrawing it does not undo what was lawful beforehand.

To exercise any of these, write to [email protected]. An answer will follow within one month. You may be asked to confirm who you are, but only as far as is needed to avoid handing your data to somebody else.

There is one honest limit worth stating: for a visitor who is not signed in, nothing is held that could be looked up, because the discovery answers were discarded. There is no record to give you, correct or delete.

Roots does not make automated decisions that produce legal effects about you. The discovery tool tells you what published rules say and what to ask next; it decides nothing about your rights, and a human professional is the necessary next step.

11. If you are in California

Under California law you may ask what categories of personal information have been collected about you, where they came from, why they were collected and who they were disclosed to; ask for a copy; ask for correction; and ask for deletion. You may not be treated differently for exercising any of these.

Roots does not sell personal information and does not share it for cross-context behavioural advertising, as those terms are defined in California law. It has not done so in the past twelve months, including for anybody under sixteen.

Sensitive personal information is not used or disclosed for any purpose other than providing the service you asked for.

To make a California request, write to [email protected]. You may use an authorised agent, and proof that you authorised them will be asked for.

12. Children

Roots is not intended for children. The service is for people aged eighteen or older, or older still where the age of majority where you live is higher.

Roots does not knowingly collect personal data from a child. If you believe a child has given Roots personal data, write to [email protected] and it will be deleted.

Please take particular care before entering details about a living relative, including a child, without their agreement.

13. Security, in plain terms

Traffic between you and the site is encrypted in transit. Passwords are stored only as a slow one-way hash, never in a form that could be read back. The session cookie is not readable by scripts, and every change of state is checked to make sure it came from this site.

Who may read a case is decided by the server and by the database, not by hiding a button in the interface. A professional sees only the cases they have been assigned to, assignment is explicit and revocable, and both the assignment and any refusal are recorded.

Access to a case by Roots staff requires a stated reason and is recorded.

No system is completely secure, and Roots does not promise otherwise. Roots has not been audited against any security or privacy standard and does not claim certification under one. If a breach affecting your personal data is discovered, the relevant supervisory authority will be told and, where the law requires it, so will you.

14. Who else is involved

Cloudflare carries the traffic between you and the server, as described above.

Nobody else currently processes personal data on the operator's behalf. There is no external analytics provider, no advertising network, and no customer support platform.

If you ask for an introduction to a lawyer or a tax adviser, that professional is sent only the facts relevant to that specific route, and only after you have said yes. Never your whole family tree, and never anything you have not chosen to share for that purpose. Once they have it, they are the ones responsible for it.

Personal data is disclosed to a public authority only where the law requires it, and you will be told unless telling you is forbidden.

15. Email

At this stage the service sends no email at all. If you ask to be told when a law changes, your address and the jurisdiction you chose are stored so that you can be told — and nothing has been sent yet, because sending is not switched on.

When it is switched on, an alert will say that something changed and where to read it. Roots email will not carry case content, message bodies or documents. If you receive an email containing case detail and claiming to be from Roots, treat it as suspicious and report it. Every alert will carry a link that stops them, and you can also write to [email protected] to be removed.

16. How to get in touch, and how to complain

Write to [email protected]. At this stage that reaches a person rather than an automated system, so allow a few days.

The results screen also carries a link for reporting anything unclear, to the same address. Its subject line names only which page was open — never anything entered or any assessment result — and everything else in the message is a choice made by whoever sends it.

If you are in the European Economic Area or the United Kingdom and you are not satisfied with the answer, you have the right to complain to your national data protection authority. Complaining to Roots first is not a condition of complaining to them.

17. Changes to this notice

Every material change gets a new version number and a new date at the top of this page. Superseded versions are kept, and where a previous version said something that turned out not to be true of the product, it is said so plainly rather than edited away.

18. What Roots does not claim

Roots does not claim certification or compliance under any privacy or security framework. It does not give legal or tax advice. A route assessment is assembled from official sources that are cited, and it is not a determination of your eligibility.