THE RULES, IN PUBLIC
The archive is kept by one volunteer who does not publish a personal name. That is deliberate — no branch of the family should feel the archive belongs to another. It is also why every rule below is public, and why the person accountable for the data is named even though the curator is not.
Version 1 · in force since 24 August 2026 · superseded versions are kept and linked
Under GDPR Articles 13 and 14 a controller must be identifiable. The curator's anonymity and a named controller are not in conflict: the archive is presented by a role, and the legal responsibility sits with a named entity you can write to and complain about.
What contributors choose to send: names, dates, places, the story as it reached them, and any documents or photographs they attach. For notices, an email address and the preferences chosen with it. Nothing is bought, imported or scraped.
Contributions are held on the basis of consent, given by the household that sent them and withdrawable at any time. Archival material about people long dead is additionally held in the public interest of family and historical research.
Records naming a living person are closed by default: the site shows initials only, until that person claims their own record. Where documents reach us from a relative rather than from the person themselves, that person is notified where we can reach them — this is Article 14, and it is a promise as much as a duty.
Family documents routinely reveal religion, ethnicity or health. Such material is stored closed, is never published without the explicit consent of the person concerned or their household, and is never used to infer anything about anyone.
The curator, and nobody else. Nothing is sold, shared with third parties, or used for advertising. The only external services involved are the mail sender that delivers notices and the storage that holds document scans, both acting on the archive's instructions alone.
Contributions are meant to be permanent — that is the point of an archive — but permanence is at the contributing household's discretion, not ours. An unsubscribed email address is erased and replaced by a one-way fingerprint, kept only so that no later import can add that person back.
Access, correction, erasure, restriction, objection, and portability of anything you sent. Write to the contact above; a substantive answer within thirty days. Complaints may also be made to your national data protection authority.
None. No analytics, no advertising pixels, no third-party fonts on the pages that handle your address. The site remembers your chosen language in your own browser, and that is all.
Names, approximate dates and places — incomplete is welcome, and a single name with a village is a real contribution.
Photographs, letters, certificates, identity papers and audio recordings of elders, sent by a household with the right to share them.
Corrections and contradictions. Where two accounts disagree, both are kept on the record and the disagreement is shown.
Records in any language, in any transliteration. Chaaban and Shaaban are treated as one name.
Material about a living person sent without a plausible family connection, or against that person's stated wishes.
Documents the sender has no right to share — a stranger's papers, or an institution's records taken without permission.
Invented lineage. Uncertainty is welcome and is recorded as uncertainty; a fabricated link is not.
Anything sent to settle a dispute, embarrass a relative, or establish a claim to property or inheritance.
A refusal is never silent. Whoever sent the material is told what was refused and why, the decision is written into the moderation log, and the files are deleted rather than kept out of sight.
Every decision that removes, withholds or alters a submission is written here, in the order it happened. The log is the check on a curator who is otherwise anonymous — if a branch is being favoured, it shows here.
No decisions yet.
Submissions have not opened. The first entry will appear the day the first record is filed or refused.
Anything a household sent can be withdrawn, and anything about a living person can be closed or erased at that person's request. No reason is required, and none will be asked for.
No reason is required. You will not be asked to justify the request or persuade anyone.
Removal means deletion of the files, not hiding them from view. Copies held for backup are overwritten on the ordinary backup cycle.
Every removal is written into the moderation log — the fact of it, never your identity or your reasons.
A household that withdraws keeps a copy of everything it sent, delivered before anything is deleted.