Privacy notice
What you share, what becomes public, and how to manage your information.
1. Who is responsible
G25 Directory is an independent project operated by Luka Kelava, who is the data controller for the service. For privacy questions or requests, contact contact@g25.directory. This notice applies to visitors and contributors worldwide.
2. Information we collect
When you sign in with Google, we receive account information through Supabase Auth, including an account identifier and email address. These details let you submit and manage your profiles; your email address is not included in public profiles.
A submission contains a public name or pseudonym, 25 G25 coordinates, coordinate format and source, country, region, place, an approximate map location, a family-origin note, optional country and region of family origin for each grandparent, and any Y-DNA or mtDNA haplogroup you choose to provide. We also record ownership, submission time, consent version and moderation status.
Security and moderation records include account identifiers, submission times, moderation decisions and reasons. Hosting, sign-in and map services receive technical information such as IP addresses, browser details and access times. We also process the information you send when contacting us.
We do not accept raw SNP files or whole-genome sequence files. Providing a profile is voluntary. An account and the required form fields are needed to submit; family notes and haplogroups are optional.
3. How we use information
We use your explicit consent to receive, review and publish your genetic and ancestry profile and make approved coordinates available for download. Where the GDPR applies, this is based on Articles 6(1)(a) and 9(2)(a). You can withdraw consent at any time.
Account management enables the service you request. Limited non-genetic security and support records are used to protect the service, prevent spam, resolve requests and document moderation. Our legitimate interests are operating a reliable service and protecting contributors against abuse; these do not replace explicit consent for genetic-profile processing. We may retain information where required by law.
We do not use profiles for advertising or make automated decisions about employment, insurance, credit or other similarly significant matters. Moderation decisions are made by administrators.
4. Public profiles and downloads
Approved profiles can be viewed worldwide without signing in. The submitted profile fields are public, including your note, optional grandparent-origin details and haplogroups. Visitors can download G25 coordinates. Pending, hidden and rejected profiles are accessible only to their owner and administrators.
A pseudonym does not make genetic information anonymous. Coordinates, locations, notes and haplogroups may allow someone to identify you or infer information about relatives. Use an approximate family-origin location, not a home address, and avoid identifying other people in your note.
Deleting or hiding a profile removes it from the active public listing; a cached response may remain available for about 15 seconds. Copies previously downloaded, indexed or shared outside the service may persist. Public availability is not permission to ignore data-protection law or the rights of the person concerned.
5. Service providers and international access
We use Vercel for hosting, Supabase for the database and authentication, Google for sign-in, and OpenStreetMap with a CARTO fallback for map tiles. Contact email is handled through Zoho Mail. These services process information needed to provide their functions; their privacy notices explain their own processing.
The project database is hosted in the EU (Frankfurt). Hosting, support, email and authentication infrastructure may process information in other countries. Applicable provider arrangements govern those transfers, including contractual safeguards where required. Contact us for information about the arrangements relevant to your data. Public profiles can also be accessed by visitors outside your country.
7. Retention and deletion
Profiles remain in the active database until you delete them or we remove them. Pending and rejected submissions do not currently have an automatic expiry. You can delete your own profile while signed in, or contact us for help.
Deleting a profile does not by itself delete your sign-in account. Request account deletion at contact@g25.directory. Rate-limit records are linked to the account. Separate moderation records retain decision details and identifiers, rather than a copy of the coordinates; relevant records may be kept to resolve complaints, investigate abuse or meet legal obligations.
The application does not currently apply a fixed automatic expiry to moderation records. Retention of those records is assessed against the need to document decisions, resolve outstanding disputes and meet legal obligations. Provider logs and backup copies follow the applicable service settings and retention cycles, so removal from the active service does not necessarily erase every backup immediately.
8. Your choices and rights
You can withdraw consent by deleting a profile or contacting us. Withdrawal does not affect the lawfulness of earlier processing. You can edit grandparent-origin details from your own profile; saving sends the profile back for moderation. For other corrections, contact us or delete the profile and submit a replacement for review.
Depending on the law that applies, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. Email contact@g25.directory, describe your request and identify the relevant profile. We may need to verify account ownership. Do not email a raw DNA file as proof of identity.
We respond within the deadlines required by applicable law. You may complain to your competent data-protection authority. In the EEA this may be the authority where you live, work or where an alleged infringement occurred.
9. Children
Profile submissions are limited to people aged 18 or over and must concern their own data. If you believe a child’s information has been submitted, contact us so we can investigate and remove it where appropriate.
10. Changes to this notice
We publish updates here with a revised date. Material changes to the purposes or scope of genetic-data processing will be explained before they take effect, and we will request new consent where required.
Provider privacy information: Vercel · Supabase · Google · OpenStreetMap · CARTO · Zoho