Kivalio
Privacy and service limits
Updated
Kivalio is a free, capacity-limited private family directory. The service is intended for adults in the United States. Creating an account does not grant access to another family. The public demo contains fictional records.
Information and its purpose
Clerk handles sign-in, account information and verified email addresses. Kivalio uses account identifiers, invitations and memberships to check family access and editing permissions.
Family members enter genealogy, dates, contact details, addresses, optional social profiles and research notes. These records power the directory, timelines, search and permitted exports. Edit history supports review and undo. Access records and limited technical information help protect accounts, enforce service limits and investigate failures.
A person can appear in family records without having a Kivalio account. Only enter information you are authorized to share. AI questions are disabled; name search remains available.
Who can see family records
Family records are available only to active family members. Members see shared genealogy across the family. Owners and managers see all family records. Your own private fields are visible to you. Explicitly authorized guardians can see private fields of the people assigned to them; a recorded parent link alone does not grant that access.
Contact details and research notes are private by default for new families. Adults with recorded ages can opt to share their contacts with the family. Detailed birthdays and contacts of minors or people with uncertain ages remain restricted. Existing private families retain their earlier sharing settings until reviewed.
Service providers and technical information
Cloudflare hosts the application and records, and Cloudflare Turnstile protects family registration. Clerk provides sign-in and verified email accounts. Encrypted recovery copies are held separately from the hosting service.
Application logs use request identifiers, normalized routes, status codes, timing and fixed error categories rather than family record contents. Hosting infrastructure also processes request metadata. The configured hosting logs remove URL query strings and redact standard authentication headers.
See Cookies and analytics choices for authentication storage, optional analytics and browser privacy signals.
Optional analytics
When configured and allowed by your analytics choice, PostHog receives limited feature-use, timing and error-category events associated with pseudonymous account and family identifiers. Pseudonymous identifiers can link events without including your name; they are not anonymous. Events exclude genealogy, names, contact details, search text, URLs and arbitrary error messages. There is no session replay or automatic click recording.
Optional Cloudflare performance analytics is limited to plain public landing pages. Do Not Track and Global Privacy Control turn optional analytics off. Essential hosting and security logs remain. Separately configured Better Stack monitoring may receive service-readiness checks and backup-completion signals without family records.
When PostHog analytics is enabled, events may be retained for up to one year. Contact support about analytics deletion separately from genealogy deletion.
Deletion and retention
You can export the records your permissions allow. Leaving a family or deleting your account removes your access, but does not remove genealogy contributed to a family. Ask the family owner to correct or remove records. Contact support when that is not possible, including when you are recorded in a family without an account.
Owners can schedule family deletion. Member access closes immediately; the owner has seven days to cancel deletion. Background processing then removes live family records. New families retain at least 90 days of edit history and 180 days of access audit. Existing migrated history is retained until reviewed.
Routine daily encrypted backups rotate over 30 days after successful backups. Earlier migration recovery archives are held separately and are not covered by that daily rotation. Minimal deletion markers are retained without automatic expiry so a deleted family is not restored from an older backup. These recovery records are not used to serve the directory.
Free limits and availability
Each family supports up to 500 people, 2,000 events, 50 active accounts and pending invitations, and 20 MiB of current record content. An account can own two families and join ten. Registration may close when capacity is reached. There is no paid plan or automatic charge.
The service has no availability guarantee. Keep your own exports of important records. See the Terms of use for service rules.
Help and privacy requests
Email support@kivalio.com for help, privacy questions, corrections, access or deletion requests, or to report misuse.
Describe the request and how we can contact you. Do not email passwords, sign-in codes or a full family export. We may need to verify your connection to the information before taking action. The rights and response requirements that apply depend on your location and the request.