Crest Systems · Updated September 14, 2026

Your family's privacy

Your family history is personal. Here's what Cited Roots collects and how we use it.

Your tree

When you sign in with Google we receive your verified email address and create a tree for that account. The people, dates, places and notes you add are stored in a database that belongs to that account alone. A tree is private to the Google account that created it. Nobody else can open it, and we don't use it as a sample or copy it into another family's tree.

What you share when you request an investigation

We store your name, email, research question and starting information when you submit a request. If we undertake an investigation, we also keep its agreed scope, payment reference, research records and findings. Please share only information you're entitled to provide. Don't send passwords, identity documents or DNA files through the request form.

Why we use it

We use this information to review your request, carry out the agreed investigation and add sourced people to your tree and report. Research may involve searching names and relevant historical details with search and archive providers. AI tools assist the research. Findings are checked against the cited documents and reviewed by a person before delivery. We don't sell your family information.

Who can access it

Crest Systems operates the service and can access case information to perform the work. Your case page uses an unguessable private link. Anyone you share that link with can open the case and its report, so keep it private. Your tree requires your Google login and stays separate from other families' trees.

Payments and sign-in

When payments are open, Stripe handles card details on its own checkout page. We store payment references and status, not card numbers. Google and Cloudflare Access handle sign-in. We receive your verified email to select the correct tree. Those providers process information under their own privacy policies.

Analytics, browser storage and service records

We use our own Umami analytics to count visits to the public pages (this page, the home page and the research terms) and to see which sites visitors come from. Analytics never runs on your tree or on case pages. We don't send form answers, case keys, names, emails or URL query strings to analytics. Our server records a small number of product events, such as a new tree being created or a relative being added, without any name, email or case identifier attached. Referrers include only the referring site, not its page address. The site has no advertising trackers. Your browser saves a case-access key so you can return to your request, and the tree uses a secure session cookie after sign-in. Hosting providers may record technical requests to operate the service.

Keeping or deleting your information

We keep your tree, case and report so you can keep using them. You can export your tree as a GEDCOM file and download your report at any time. To delete your tree or a case, or to correct account information, email [email protected] from your account email. We verify the request before changing access or removing a family's data. Payment providers retain their own transaction records.

Questions

Email [email protected]. Cited Roots is operated by Crest Systems and isn't affiliated with Ancestry.com.