Taishan Genealogy (taishanzupu.com, "the site") puts the printed genealogies of Taishan's villages online for their families to read and to help complete. This policy explains what personal information the site collects, how it is used and protected, and how you can see, correct or delete it.
In short
- By default the names in a genealogy are shown only to those with access: its administrators, members linked to it, and people who have entered its access code. Its administrators may make its names public, but the names of its recent generations are still not public. Reading with the code needs no account.
- The site shows no advertising, uses no third-party analytics or tracking, and does not sell personal information.
- An account needs only an email address, a display name and a password. The password is stored one-way encrypted, so the site cannot read it.
- A genealogy's PDF and lineage image can be downloaded only by those who may edit it.
- For any question, or to delete your account, leave a message on the Contact us page.
1. What the site collects
When you browse
You can browse the site without an account; reading the names in a genealogy needs its access code or an account linked to it, unless its administrators have made them public (see section 4). Like almost every website, the server keeps an access log: IP address, time, the address requested and the browser type. It is used to diagnose faults and to defend against attacks. To look into a fault, a site administrator can also switch on the site's own request log for a while: pages only (nothing after a question mark in an address), a file a day, kept at most 7 days and deletable at any time, seen only by the site administrators.
The site also counts how many people visit each day. When you open a page, and again once the page has run in your browser (its script sends this site an empty notice, which tells a person's browser from a program that only fetches pages), your IP address and browser type are hashed one-way together with a random key that is replaced every day, and the hash is kept for that day only, so that the same visitor is not counted twice. The next day the hashes are deleted and the key replaced, and only the number of visitors for each day remains. The site does this counting itself, with no third party.
When you register
- Email address: to sign in, and to send a reset link if you forget your password.
- Display name: chosen by you. Genealogy administrators see it when they review your changes, and if you create a genealogy it is shown publicly on the front page as its creator.
- Password: only a one-way hash is stored. The site cannot recover your password.
- Your interface language, when you registered and last signed in, the genealogies your account is linked to, and your role and access in each (view only, or can edit).
When a log-in fails, the site records the time, the IP address and a one-way hash of the email address typed, but never the password typed. After a failed log-in, the form also asks for the verification code shown in a picture. If one email address or one network fails too many times in a short while, logging in is paused for a while.
When you contribute
- The changes you propose, the people, spouses and biographies you add, the sources you give, and when you submitted them and what was decided.
- If you contribute with a genealogy's access code without signing in, the site does not know who you are. You may add a name of your own choosing; it is shown to the genealogy's administrators with your change, and the site cannot verify it.
- The reason you give when asking to be linked to a genealogy; if its administrator asks for more, their question and your answer; and what was decided. Your request and your answer, with your display name and email address, are emailed to the genealogy's creator and administrators.
- The surnames, villages and old names you submit under Villages (with the source you give for an old name), and the new names and moves you ask for there (with the reason you give), when you submitted them and what was decided.
- The videos you submit for a place under Villages: the link, the title, the category, what the video has to do with the place, and the author, description and date you give, with when you submitted it, what was decided and the reviewer's note. The site keeps only this text and the link; it never downloads or stores the video itself. If you give no title, the site's server reads the video's title from its site (known video sites only, such as Bilibili and YouTube): all it sends is the video's link, with nothing about you, and nothing of the page but the title is kept.
- What you write or change in a surname's history, or in its lineage, under Surnames: the full text of each version and the edit summary you give, with when you saved it and your account.
- If you submit a surname, an old name or a video, or ask for a village to be renamed or moved, under Villages without signing in, the site records your network address (to limit how many can be sent) and the name you choose to give, if any; only the site administrators can see either.
When you enter an access code
Each genealogy's access code is given to family members by its administrators. When you enter it correctly, your session remembers that the genealogy is unlocked, for 14 days. So that nobody can guess codes repeatedly, the site records the time and IP address of every attempt and whether it was correct, but not what was typed. After a wrong code, the form also asks for the verification code shown in a picture. If one network gets the code wrong too many times in a short while, or a genealogy's code is got wrong too many times within an hour, the site stops accepting codes for a while.
When you upload a cover photograph
When making a PDF you may upload a photograph for the cover. It is scaled down and re-encoded, which removes its EXIF data, including where it was taken. It is used only to draw your cover and is never shown to anyone else. It is deleted when you remove it, and automatically after two days at most. The cover preview and the PDF drawn from it stay in the server's cache and are likewise served only to you.
When you reset a password
The site emails you a one-time link. The database keeps only a hash of that link, when it was made and the IP address that asked for it, never the link itself.
When you use Contact us
The name, email address and message you fill in are written into an email to the site's administrator. Its reply address is the one you gave, so the administrator's answer goes there. If you are signed in, the email also gives your account's display name and email address. The site also keeps a copy of the message - the name, email address and message you gave, your account if you are signed in, the page's language, and the network it came from and when - which only the site administrators can see. It also records when it was sent and the IP address, to limit how many are sent from one network.
When you check in on a page
The pages of genealogies and of administrative and natural villages take check-ins, whether or not you have an account. The name, place and message you give, and when, are shown publicly on that page; signed out, you may leave the name out, and are shown as Visitor. The site administrators can set it so that, signed out, only the place, the time and a message of emoji alone are kept, shown as Visitor. The place starts as where your IP address is estimated to be: the site looks it up on its own server in DB-IP's IP address database (IP Geolocation by DB-IP), and does not send your address to DB-IP or to anybody else. The estimate is at most a city; you can change it to another country, and in China to another city. The site also records the network the check-in came from (to limit how many come from one network) and, if you are signed in, your account; neither is shown publicly, and only the site administrators see the network. An email address in a message is shown only in part until someone clicks Show; the site records the network each Show came from, only to limit how many one network may see in an hour. Check-ins are loaded by the browser after the page opens, and search engines are asked not to fetch or index them.
Anybody can hide a check-in with the × beside it: it is hidden for them at once (in their session when signed out, in their account when signed in), and the administrators are asked to hide it for everyone. A check-in of your own is deleted at once by its ×, with no administrator asked (known by your account when signed in, by your session when signed out). The site records the network the request came from and, if signed in, the account, for the administrators: a genealogy's administrators or the site administrators for a check-in on a genealogy's page, the site administrators for one on a village's. A hidden check-in is no longer shown and can be shown again; a deleted one is deleted with the requests about it.
When you use the Chinese converter
The text you paste is used for that one conversion and is not kept.
When you look at a map
Each place's page under Villages has three links: Baidu Maps, Google Maps and OpenStreetMap. Following one takes you off this site to that one, whose own privacy policy then applies; merely opening this site's page does not make the site contact any of them.
Search results under Villages can be shown as a map instead of a list, each administrative and natural village has a map on its page, and a genealogy's 族谱溯源 page draws the family's migrations on a map. The map's tiles are OpenStreetMap's, fetched and kept by this site's server and served to you from here: your browser contacts only this site, never OpenStreetMap, and when the site fetches a tile from OpenStreetMap it sends nothing about you. Like any page, those requests go into the site's access log (see "When you browse"). The program that draws the map is served by this site too. When a genealogy's administrator saves its 族谱溯源, the site sends the place names written there (such as 福建莆田) to OpenStreetMap's place search to find where they are, and keeps the answers; only the place names are sent, nothing about you or the administrator.
The related videos on a place's page, and those on the Videos page, are links to videos on other sites. One on YouTube or Bilibili can be watched on the page: only once you scroll to it does your browser contact that site and load its player (which does not start by itself), and from then on that site handles your IP address and the like under its own privacy policy; until you scroll to it, nothing is sent there. "Watch on its own site" opens the video's site in a new window.
What is kept on your device
The site uses only four cookies:
- tszp: the session cookie. It remembers whether you are signed in, which genealogies you have unlocked, a security token for forms and any verification code you are being asked for. It expires after 14 days.
- tszp_theme: set only if you choose a colour scheme. It holds the scheme's name and lasts a year.
- tszp_ostrip: set only if you fold away the "Where this line comes from" strip above a person's lineage or a chart, so that it stays folded on other pages. It holds one word and lasts a year; opening the strip again deletes it.
- tszp_js: written by the page's own script. It holds nothing about you and only tells the site that a browser, not an automated crawler, is reading (a person's chart, a genealogy's statistics and the relationship between two people ask for it). It lasts a year.
The following are kept in your browser's local storage and are never sent to the site: the "recently viewed" list for each genealogy, the name you typed when contributing with an access code, which page numbering you prefer on the book's scans, and whether you last looked at search results under Villages as a list or as a map. You can clear them at any time in your browser settings.
2. How the information is used
- To run the site: signing in, reviewing changes, making PDFs.
- To keep it secure: investigating abuse, code guessing and attacks.
- To count how many people visit each day; only the daily totals are kept.
- To send password-reset emails; to pass Contact us messages on to the administrator; and, when somebody asks to be linked to a genealogy or answers what they were asked, to tell the genealogy's creator and administrators by email. These are the only emails the site sends; it sends no advertising or newsletters.
The site does not sell, rent or trade personal information, and does not use it to profile you or to advertise to you.
3. Who can see your information
- The public: each genealogy's name, description, counts, generation characters, check-ins and line of origin, but not the names of the people in it, unless its administrators have made them public - and even then not those of its recent generations (see section 4), and the display name of each genealogy's creator. An accepted change becomes part of the genealogy, but the public cannot see who made it. The villages, old names (with the source given) and surnames not on the national list of Chinese surnames submitted under Villages become public once a site administrator approves them; a surname on the list is public as soon as it is added (unless the site administrators choose to review these too) - in either case without who submitted it: only the person who submitted one and the site administrators can see that. A request to rename or move a village takes effect once a site administrator approves it; the request itself and the reason given are not public. A video submitted for a place becomes public once a site administrator approves it, on the place's page and on the Videos page, likewise without who submitted it; a YouTube video is public as soon as it is submitted (unless the site administrators choose to review these too); one waiting or not approved only its submitter and the site administrators see. What an account the site administrators have set to need no review under Villages submits is public at once. A surname's history or lineage saved under Surnames is public at once, and every version is kept: anybody can read and compare the earlier ones. The page does not show who edited it; only the editor and the site administrators can see that.
- Genealogy administrators: family members, being a genealogy's creator and anyone appointed to help. They can see the display name, email address and last sign-in of accounts linked to their genealogy; pending changes with their sources and who submitted them; the display name and email address of anyone asking to be linked, how many genealogies they are linked to, their reason, and the questions and answers between them (a request and an answer are emailed to them as well); and the genealogy's change history. They may use this only to administer the genealogy.
- System administrators: the people who run the site. They can see all accounts and activity records, for administration and security, and the messages sent through Contact us.
- Service providers: the server is hosted by Amazon Web Services. Password-reset emails, Contact us messages and notices of requests to be linked are sent through Amazon Simple Email Service in the United States, which handles only the recipient's address and the message.
- Where the law requires it: when a law, regulation or competent authority lawfully requires disclosure.
4. The people in the genealogies
A genealogy records many people's names and family ties, and many of them are alive. The site therefore:
- By default, shows the names in a genealogy, and every page that lists them (the chart, a person's page and timeline, name search, the generation lists, relationships, biographies), only to those with access: system administrators, that genealogy's administrators, members whose account is linked to it (view only or can edit), and people who have entered its access code or its view-only code. Anybody else sees only the genealogy's front page (its name, description, counts, generation characters and check-ins), with no name on it; a name search across genealogies from the home page leaves out those they may not read. A genealogy's administrators can make its names public under Genealogy admin (they are not until they do, they can be made private again at any time, and each setting records who made it and when): everybody can then read those pages, but its recent-generation members are still not named, as the next point says. The line of origin - the forebears above the founder, gathered from other genealogies and histories, and its timeline - is open to everyone, and names the founder where it joins the genealogy.
- Keeps the site's demonstration genealogy (the Chen genealogy of Taishan, an invented family) open to everybody. In it, and in any genealogy whose administrators have made its names public, the recent-generation members, meaning anyone with fewer than four generations recorded below them, are still not named: the public sees "***" with only their generation, sex, number of children and number of descendants, and cannot find them by searching. Someone added on the site has nobody recorded below them, so their name is not published until four generations are recorded below them; the site works this out again whenever somebody is added, removed or moved to another parent. A genealogy's administrators can also set an individual otherwise; once set, the four-generation rule no longer changes it, and each setting records who made it and when.
- When somebody with access shares a person's page, the link they share carries the site's signature: whoever receives it sees the name on the chat app's share card and in the page's title, but the page itself still shows nothing and still asks for access, and the site asks search engines not to index such pages. A link without that signature shows the name to nobody new.
- Lets only those who may edit a genealogy download its PDF and lineage image, which carry every name: system administrators, its administrators, members linked to it who can edit, and people who have entered its access code where the code may edit. The scanned pages of the book are for those with access.
If you think someone's details should be hidden, corrected or removed, contact that genealogy's administrators, or tell us through the Contact us page.
5. Where it is kept, and for how long
The site's data is stored on Amazon Web Services servers outside mainland China. If you use the site from mainland China, your information is transferred abroad to be stored and processed.
- Account details: until the account is deleted.
- Changes and change history: kept as part of the genealogy's history. Undoing a change leaves a record too.
- Deleted genealogies: once its creator deletes a genealogy nobody can open it, but its data is kept, and a system administrator can restore it.
- Activity records (including IP addresses): used for security review, currently kept indefinitely.
- Visitor counts: the number for each day is kept; the hashes used to count are deleted the next day.
- Check-ins: with their network, until an administrator deletes them, hidden ones too. Requests to hide one go with it. The record of a Show is deleted, once it is an hour old, the next time anybody clicks Show.
- Contact us messages: the copy is kept until a site administrator deletes it; your messages are deleted with your account.
- Sessions: expire after 14 days.
- Cover photographs: deleted after two days at most.
6. Your rights
- See your data: once signed in, the My account page shows your details and your change history.
- Change your password: at any time on the My account page.
- Correct your data: to correct your email address or display name, leave a message on the Contact us page.
- Delete your account: ask on the Contact us page. We will delete your email address, password and other account details. Changes of yours that were accepted remain part of the genealogy, and the versions of surname histories and lineages you wrote remain too, but none is linked to you any more.
- Withdraw consent or complain: leave a message on the Contact us page and we will reply as soon as we can.
To protect your account we may ask you to reply to our email from the address you registered with, to confirm it is you.
7. Children
The site is intended for adults. Children under 14 should register and use it only with the consent and guidance of a parent or guardian. Children recorded in a genealogy are likewise named only to those with access, and in the demonstration genealogy and any genealogy whose names have been made public they are treated as recent-generation members, so their names are not published.
8. Security
The whole site is served over HTTPS. Passwords and reset links are stored only as hashes. A wrong password or code brings a verification code, and too many in a short while pause further attempts. The genealogy data files are kept apart from the web pages and cannot be read directly over the web. Each administrative function is open only to the administrators it belongs to. No website can promise perfect security, so please keep your password and any access code safe.
9. Changes to this policy
When this policy changes, the new version is published on this page and the effective date at the top is updated.
10. Contact
For anything about this policy or your personal information, leave a message on the Contact us page.