Ownership and access
A guest project belongs to the session that creates it. Verify an email identity before checkout for recovery access. Knowing a project URL does not grant access. Customer uploads, previews and books are kept outside public static storage.
Processing and privacy choices
Gramps processes the file in an isolated workspace with network access denied. Private records are excluded and living or uncertain details are redacted by default. No family content is sent to external AI services. No third-party trackers, session replay or family-content analytics run on private pages.
Retention and deletion
Unpaid projects expire after 72 hours; paid download access expires 30 days after payment. Exact dates appear in the workflow. You may delete early, which revokes access immediately. Minimal transaction metadata remains separate. The preview service does not create application backups of family files. Its database and artifacts use encrypted local storage. Keep your original export: the service is temporary storage, and infrastructure failure can make an unpaid project unavailable. Host-level backup arrangements must be reviewed before paid delivery opens.
Service measurements
First-party events measure stages such as import completion, preview viewing and payment verification using non-content identifiers. They do not contain family names, birth dates, titles, file contents, recovery codes or search query strings.
Reviewed .