Privacy Policy

Effective 20 October 2026 · App: Silsilara (Android id.silsilara.app and web)

This policy explains what data Silsilara accesses, why, and where it is stored. In short: family tree data and photos are stored in the Google Drive of the family tree owner, not on our server. Silsilara runs a small server that connects invited family members to that family tree; the server only keeps the data needed for this (see section 3) and does not store the family tree contents or photos.

1. Data from your Google account

Name, email address, and Google profile photo, to show the signed-in account (also in the list of accounts with access) and to record who last changed the family tree.
Limited Google Drive access (scope https://www.googleapis.com/auth/drive.file): Silsilara can only see and change files created by Silsilara itself, namely the Silsilara folder containing the silsilah.json file and a photo folder. This access is used to create, read, and update those files, and to upload family members' photos and move them to the Trash.

Silsilara cannot see, read, change, or delete any other files in your Google Drive.

2. Data you enter

Names, nicknames, gender, dates of birth and death, WhatsApp/phone numbers, photos, and relationships between family members. If you mark yourself (the "This is you" feature), your Google account email is recorded on that member. All of this data is stored in the silsilah.json file and the photo folder in the Google Drive of the family tree owner, and can be viewed by accounts given access through the Account management feature. If you are an invited member, the changes you make are saved to the owner's Google Drive.

3. Data stored on the Silsilara server

So that family members can open the family tree without granting access to their own Google Drive, the Silsilara server opens the Silsilara files in the owner's Google Drive on the owner's behalf, after checking that the requesting account has access. For this, the server stores:

A Google Drive access key (refresh token) for each signed-in account, encrypted. It is only used to open the Silsilara files in that account's Drive, and only for accounts it has given access.
The access list of each family tree: the email of the owner and of invited accounts, with their role (Admin or View only).
Google account name and profile photo, to show the list of accounts with access.
Your personal family name set in Profile (not shared with other accounts).

Family tree contents and photos are only passed through the server when opened or saved; they are not stored or logged on the server. Sign-in sessions are signed tokens valid for 30 days. The server runs on Vercel with Upstash storage; these providers may process data outside Indonesia.

4. Data stored on your device

Settings such as light/dark theme, language, the last family tree and member opened, skipped getting-started steps, the "This is you" mark for View only access, the sign-in session, and a usage-analytics code (see section 5). If birthday reminders are turned on, the names and dates of birth of living members are stored on the device so notifications can appear without opening the app. This data is removed when you sign out or turn off reminders.

5. Sharing data

Silsilara does not sell, rent, or share your data with third parties, and uses no ads. Family tree data can only be opened by Google accounts invited through Account management. The service providers used to run Silsilara only process data for that purpose: Google (Google Drive, Google Sign-In), Vercel (web app & server), Upstash (server storage), Google Fonts (fonts), and PostHog (usage analytics, servers in the European Union). The WhatsApp button on a member card and the invitation button open wa.me only when you tap them.

Usage analytics. To learn which features are used most and to fix errors, Silsilara records app usage through PostHog: screens and features opened, device type, operating system, browser, approximate location (country/city) from the IP address, connection status, app speed, and technical error messages. Session recordings only capture the screen layout and movement; all text, form fields, and photos are masked. These records are linked to a pseudonymous code derived from your account (not your email or name), so usage across several devices counts as one person, and to a pseudonymous code for the family tree opened along with its member count. Family tree contents (member names, dates, photos, and notes) are never sent to PostHog.

Silsilara's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Security

All communication uses HTTPS. Google Drive access keys are stored encrypted, Google Drive access is limited to files created by Silsilara, and the server checks access on every request (View only accounts cannot change data).

7. Deleting data and revoking access

Delete a single member, or all members at once via Profile → Reset data (only for family trees you own).
Remove family accounts via Profile → Account management.
Leave a family tree shared with you by another account via Profile → Leave this family tree. Your account is removed from that family tree's access list and your own family name for it is deleted from the server. The family tree and its photos are not deleted, because they are stored in their owner's Google Drive.
Delete the Silsilara folder from your Google Drive to delete all of your family tree data and photos.
Revoke Silsilara's access at any time at myaccount.google.com/permissions. After that, the server can no longer open your Google Drive, and the family you invited cannot open your family tree until you sign in again.
Ask for your data on the Silsilara server (access key, access list, family name) to be deleted via the contact below.
Remove data on your device by signing out or uninstalling the app.

8. Children

A family tree may contain data about family members who are children. That data is entered and managed by adult family members who have access to the family tree, and is subject to the same policy.

9. Changes to this policy

If this policy changes, the latest version and its effective date will be updated on this page.

10. Contact

Developer: Risyad Abdala Ramadhan · GitHub · LinkedIn

This is a translation of the Indonesian Privacy Policy. If the two versions differ, the Indonesian version prevails.