Privacy Policy for PastPaths¶

Version 1.0 — effective from 2026-05-20

Summary in one sentence¶

PastPaths stores all your genealogical research locally on your own computer. Nothing is sent to me or anyone else without you choosing to do so yourself — the only network traffic the program generates is fetching map tiles when you open the Map page (see section 3.4).

This document explains in detail what that means.

1. Who is responsible for the data?¶

PastPaths is a local program — it runs on your computer, saves all data on your computer, and does not communicate with any servers operated by us.

This means that you are the data controller for the genealogical data you enter into the program, not me as its developer. I never handle your genealogical data and cannot access it.

This design is a deliberate choice. It gives you:

Full control over your data
Protection from policy changes at a service provider
Protection should the developer of PastPaths disappear — the data is yours and works in other programs via GEDCOM export

2. What is stored, where, and how¶

2.1 What is stored¶

PastPaths can store:

Personal data you enter yourself (names, dates, places, notes)
Photos and documents you upload
Source citations
Blog posts and stories
Settings and account information for the program

2.2 Where the data is stored¶

All data is stored locally in a folder on your computer. Currently only Windows is supported as a platform:

Windows: C:\Users\YOUR_USERNAME\AppData\Local\PastPaths

The folder contains:

pastpaths.db — an SQLite database with all your genealogical data (people, events, places, relationships, sources, blog posts, etc.)
uploads\ — your uploaded photos and documents in their original format
_internal\ and other program files from the installation

If you move or back up the PastPaths folder, your entire database and all your files move with it. You can move the entire folder to another computer if you wish. Versions for Linux and Android are planned but not yet released. When they exist, this policy will be updated with their corresponding paths.

The current version of PastPaths does not require login. The program runs locally on your computer, and anyone with access to your user profile in Windows can start the program and see your genealogical data.

If you need to protect the database from others who have access to the same computer — use disk encryption (see section 9), separate Windows user accounts, or move pastpaths.db to an encrypted container.

A future version may introduce optional password protection, but currently security depends on your computer and your Windows user account.

2.4 Log files¶

PastPaths displays technical logs in a console window while the program is running. When you close the program, these disappear — nothing is written to disk.

3. The data does not leave your computer — exceptions¶

PastPaths does not communicate with external servers for normal use.

Note: Importing GEDCOM files from programs such as Ancestry, MyHeritage, TNG (The Next Generation), and Disgen happens entirely locally. You export a GEDCOM file yourself from the other program and select that file in PastPaths — the program never contacts these services directly.

The only situations where data may leave your computer are:

3.1 You import from WordPress¶

If you import a WordPress export, PastPaths downloads the images from your WordPress site to your local computer. The traffic occurs between your computer and your WordPress server — not via us.

If you yourself export GEDCOM, create PDF reports, or share images, that is your own active action. PastPaths never sends anything automatically.

3.3 Software updates¶

PastPaths does not automatically check for updates online and does not send any version information anywhere. You need to visit pastpaths.se yourself to see if a newer version is available and, if so, download it.

3.4 Map feature¶

If you open the Map page, the program fetches map images (so-called tiles) from OpenStreetMap's public server (tile.openstreetmap.org). The traffic occurs between your computer and OpenStreetMap — not via us. What is sent is the coordinates of the map tile being displayed (i.e., which geographic area you are looking at), your IP address, and standard browser information. No data from your database — neither names, coordinates, nor search terms — is sent onward. The search box on the Map page only filters among already-loaded local places.

PastPaths contains no geocoding functionality. Coordinates for places are entered manually or imported from GEDCOM — no calls are made to look up addresses against external services. If you never open the Map page, no requests are sent to OpenStreetMap. Processing at OpenStreetMap is governed by their own privacy policy.

4. Telemetry, statistics, and analytics¶

PastPaths does not collect user statistics, anonymous or otherwise. I do not know how you use the program, how often you start it, or which features you use. I have no "anonymous usage figures" to refer to.

This is a deliberate choice. For genealogical research — where the data is personal and often sensitive — I consider privacy by design more important than product-optimization data.

5. Third parties¶

PastPaths is built on open-source libraries (a list is available in THIRD-PARTY-LICENSES.md). These run as part of the program on your computer and do not have separate access to your data.

PastPaths does not integrate with:

Social media
Advertising networks
Tracking services
External cloud services (beyond what you actively choose yourself)

*Exception: the map feature contacts OpenStreetMap, see section 3.4

6. Your responsibility for other people's data¶

When you enter information about relatives — especially currently living relatives — you become responsible for that processing under GDPR.

PastPaths helps you by:

Keeping all data local (lower risk than cloud services)
Offering a feature to mark people as living, which hides sensitive information in printouts
Supporting privacy marking on GEDCOM export

But you need to:

Consider whether you have a lawful basis to process the data
Inform the persons concerned to a reasonable extent
Be careful about what you share and with whom
Respect relatives' wishes if they want to be "removed"

Since you yourself are the data controller for your genealogical data, you already have full technical control over your rights:

Right of access: all your data is available in the program and in the local folder
Right to rectification: you can edit at any time
Right to erasure: you can delete people, events, the entire database
Right to data portability: GEDCOM export gives you your data in a standard format
Right to restriction: you yourself control who has access to your computer

As for the developer of PastPaths — I have no data about you to delete or disclose.

8. Children¶

If your genealogical research includes currently living children (under 13 according to GDPR practice), you should exercise extra caution. Such data has special protection and usually requires guardian consent. PastPaths does not technically prevent you from entering such information, but it is your responsibility to do so correctly.

9. Security¶

The program's security largely depends on your computer's security. I recommend:

Using a strong password for PastPaths
Using a strong password for your computer
Keeping your operating system updated
Using a reliable backup solution
Being careful about who gets physical access to your computer

The program's database is not encrypted by itself. If someone gains access to your folder, they can read the database even without your PastPaths password. If you need stronger protection — use disk encryption (BitLocker is built into Windows Pro and Enterprise; for Windows Home, Device Encryption is available on most modern computers).

10. Backup and data loss¶

Since the data is stored locally, it disappears if your computer breaks and you have no backup. I have no copy. This is the price of full privacy — you must take responsibility for backups yourself.

Backup advice is available in the program's documentation.

11. What happens if PastPaths ceases to exist?¶

If I as the developer disappear one day — the data is still yours. It resides on your computer in:

An SQLite database (an open, documented format that can be read by many programs)
A folder with your photos and documents (in their original format)

You can export to GEDCOM and import into other genealogy programs. You are never "locked in" to PastPaths.

12. Changes to this policy¶

When this policy is updated, the new version is published on pastpaths.se along with information about what has changed. The version of the policy that came with your installation continues to apply to that version — you are therefore not bound to future policy changes simply because you have the program installed.

13. Contact¶

Questions or concerns about privacy and PastPaths:

Email: Support
Web: https://pastpaths.se

For questions about GDPR in general, or if you need to file a complaint about the processing of your personal data, you can contact the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): imy.se.

Last updated: 2026-05-20