Privacy

A tool like this necessarily handles information about living people who have not agreed to anything: your parents, grandparents, your children. The cleanest way to protect that is not to collect it. So the classifier runs entirely as code in your browser, and there is no server endpoint that family data is sent to.

So that a long interview survives a refresh, c3check saves your progress in your browser's localStorage under two keys:

• c3check.draft.v1, the family line you have entered and the answers you have given. Concretely: any name or description you typed for a relative, exactly as you typed it, each birth date, each place of birth, any date of death, and every answer to a question the interview asked.
• c3check.consent.v1, a record that you accepted the terms, so you are not asked repeatedly.

That is the complete list. There is no third key, no cookie carrying any of it, and nothing is copied anywhere else on the way through.

This stays on your device and is not transmitted. It does mean that anyone else who uses the same browser profile could see it, so take care on a shared or public computer. You can erase both at any time:

The only thing that ever appears in the URL is a step number. Not a name, not a date, not a place, and not an answer. The interview addresses each question as a plain ordinal, so a page in your browser history reads /check/interview?step=4 and nothing more. Which question that was depends entirely on what is stored on your device, and cannot be worked out from the address.

The other thing that can appear in a URL is a share code, because a shared result is addressed by its code. That is described under Share codes below.

To keep a copy, print the results page, use the button that copies it as plain text, or download it as a markdown file. All three are made in your browser and none of them is uploaded anywhere.

The download holds every name, date and place you entered. That is the point of it: it also contains your interview as data, so uploading it again restores every answer. It is an ordinary file on your device, which means it is no longer covered by anything this policy can promise. It goes wherever you send it, it can be read by anyone who gets a copy, and an email attachment sits on a mail server. If a family line is sensitive, treat the file the way you would treat a photograph of the certificates it is about.

A finished result shows a short code, like koqqg1870syv1, and the link that opens it. Both are worked out in your browser from the result in front of you. Nothing is uploaded when one appears, and nobody else can reach it unless you share the link yourself.

A code carries exactly three things:

• one letter for each generation, oldest first, naming the paragraph of section 3 that applied to them or, where no paragraph did, the outcome
• which generation in the line the result is about
• the year the earliest generation in the line was born

Plus two check characters, which catch a typo, and a version number, so a code opened years from now still reads with the meanings it was made under.

It carries nothing else. No name, and no label you typed for a relative. No place. No date apart from that one year, and none of the other generations' birth dates. No answer to any question the interview asked, nothing about what was assumed or what is still unknown, and no document checklist. There is nothing in a code that an interview could be rebuilt from, and no key anywhere that would turn one back into one: it holds conclusions, not the facts they were drawn from. That is enforced by a test rather than promised. The suite builds a family line out of distinctive markers, makes a code from it, and fails the build if any marker survives into the code or comes back out of it.

A code is not stored anywhere, including on your own device. It is worked out afresh each time a result is shown, which is why the two keys listed above are still the complete list.

Anyone who has the link can open it, and there is no way to withdraw one once it is out.

If you import a file, whether a GEDCOM family tree or a c3check download of your own, it is read by code running in your browser. There is no upload and no server endpoint that receives it. The parsed file is held in the page while you use it and is discarded when you reload, navigate away, or press "Forget this file". From a family tree, only the people in the line you actually choose are copied into the saved draft described above. A c3check file is your own interview coming back, so all of it is restored into a new line; nothing already saved on the device is overwritten or deleted.

Most of a family tree is never read at all. It carries notes, sources, photographs, addresses, causes of death and medical facts about living people who have not agreed to anything, so the parser reads only names, sexes, dates, places and parent links, and discards everything else before it reaches memory. That is enforced in the code rather than promised: there is a test that parses a file full of notes and addresses and asserts that none of that text survives.

This site uses Vercel Web Analytics to count page views, so it is possible to tell whether the tool is being used and which pages people struggle with. It is cookieless, it does not track you across sites, and it does not build a profile of you. Vercel Inc. acts as the processor for that data.

Analytics records which pages are visited. It does not and cannot see the contents of your interview, because that data never leaves your browser and never appears in a URL.

A shared result is the one page whose address carries anything, and that address is rewritten to a placeholder in your own browser before the event is sent. So what analytics receives is that a shared code was opened, and never which one.

The site is hosted by Vercel. Like any web host, its infrastructure logs the requests it serves, including IP addresses and browser user agents, for delivery, security, and abuse prevention. That is ordinary web-server logging and applies to the page itself, not to anything you type into it. The address of the page is part of that log, which for a shared result is the code. Unlike the analytics above, a host's own request log is not something a browser can redact.

c3check links out to the Citizenship Act, to court decisions, and to IRCC guidance. Those sites have their own privacy practices and this policy does not cover them. They are links and nothing more: no code from any of them runs on this site, so none of them can see anything you have entered here.

There is none. No advertising, no tracking pixels, no social buttons, no donation widget, no fonts fetched from anybody else's servers. Every line of code that runs while you use this site is served from this site, apart from the page-level analytics described above. Nothing else is in a position to see that you were here, let alone what you entered.

That is enforced by a test rather than by memory. The suite fails the build if a script from another host appears anywhere in the site's own code, and if a frame is ever added, it fails unless that frame is sandboxed and denied access to this origin.

A citizenship line often includes children, and you may enter a child's birth details as part of your own family line. That information is treated exactly like everything else here: it stays on your device. The site is not directed at children as users.

If this policy changes materially, the date at the top will change with it. Questions or concerns about privacy go to GitHub issues. Note that issues are public, so please do not include personal or family details in one.