MEC Labs Privacy Policy

Applies to: meclabs.ca and its product surfaces (including Mastery and Ancestry), operated by MEC Research Labs Ltd., Vancouver, British Columbia, Canada. Privacy contact: [[email protected]] — this address reaches the person accountable for privacy at MEC Research Labs.

MEC Labs is a small company and this is a Beta service. We have written this policy in plain language, and we have kept it short enough to actually read. It reflects British Columbia's Personal Information Protection Act (PIPA) and Canada's PIPEDA.

1. The short version

• We collect what you give us and what the service needs to run. We use no analytics trackers, no advertising, and no tracking pixels — none.
• During the Beta the service is offered to residents of Canada only (Terms §1), so this policy is written to Canadian privacy law.
• Your data lives on hardware we own and operate in Canada. It is not stored in a public cloud.
• We never sell personal information, and we never share it except with the small set of service providers listed in §6.
• Ancestry is special: family trees contain information about people other than you. Section 4 explains how that works, what protections are built in, and what your rights are if someone recorded you.
• You can ask us to show you, correct, export, or delete your data at any time: [[email protected]].

2. What we collect

Account information. Email address, display name, and a password (stored only as a modern cryptographic hash — we cannot read your password).

Eligibility information. Your year of birth only — never a full date of birth — used solely to confirm you meet the 16-or-older requirement. And your country of residence, because during the Beta the service is offered to residents of Canada only (§1).

Session information. When you sign in we record a session with your browser's user-agent string so that sessions can expire and be revoked. We do not collect precise location, and we do not fingerprint devices.

Product data you create.

• Mastery: your learning progress — lessons visited, quiz answers, streaks, notes.
• Ancestry: the family history you and your family record — people, dates, places, relationships, photos, stories, and life events. See §4.
• Feedback you submit through the product.

What we deliberately do not collect: browsing analytics, advertising identifiers, contacts uploads, or anything from your device beyond what the pages themselves need.

3. How we use it

• To operate the service: sign-in, saving your work, showing your family the tree you share with them.
• To send transactional email: invitations you ask us to send, password resets, and (when the feature exists) activity summaries you can turn off.
• To keep the service safe: reviewing flagged content, rate-limiting abuse.

We do not use your personal information to train AI models. Learning content in Mastery is generated with AI assistance from curriculum materials, not from user data — your personal information is not sent to AI providers. [HARD RULE, restated from the internal assessment: any future feature that would send user or family content to an AI provider requires its own explicit, separate consent screen first.]

4. Ancestry: information about people other than you

A family tree is, by nature, information about a family — including living relatives who may not use this service. This section is the most important one in the policy.

What the platform does to protect the living, by design:

• Records about living people default to restricted visibility: members of the tree beyond a close-kinship distance see, at most, that a person exists — not their details. Deceased ancestors are treated as shared family heritage and are more widely visible within the tree.
• Living people are never used in cross-tree matching or discovery. Our matching features read deceased records only.
• Email addresses never cross from one family tree to another. Trees are identified to outsiders by a label, never by anyone's address.
• Family trees are private to their members. There is no public browsing and no search engine exposure of tree content.
• Photos and stories pass a human review step before other members see them.

Your responsibility as a contributor. When you record a living person, you are sharing information about someone else. Only record living relatives you would be comfortable telling that you had recorded — and prefer inviting them to claim their own entry so they control it themselves.

Who recorded what. We record which member added each person record and each life event. This is not shown to other members — no screen in Ancestry displays it. It exists so that you can remove records you added by mistake, and so that we can answer a request from someone asking what is recorded about them.

If someone recorded you. Contact [[email protected]] and we will: show you what is recorded about you, correct it, restrict its visibility, or remove your identifying details. You do not need an account to exercise this.

What "remove your identifying details" leaves behind. Your given name is reduced to an initial. Your dates, places, notes, photos and life events go. Your surname and your place in the family tree stay — removing the whole record would tear a hole in the tree for the living family around you, who have their own record of their family. We also keep a note that you asked, so that we can act on it again without you having to explain twice.

If someone records you again. We do not prevent a family member from typing your details in a second time, and we have decided not to build the name-matching that trying would need — matching living people across families is the very thing we promise above not to do. So the honest position is: tell us again, and we will remove the details again. We would rather say that than promise a protection we cannot keep.

Deceased relatives. Canadian privacy statutes protect living individuals. We treat deceased family members' records as family heritage, visible to tree members, and we rely on family stewardship — trees have human stewards who govern what is recorded.

Children. Minors may appear in family trees as recorded persons; their records receive the same living-person protections above. The service itself is intended for users 16 or older; younger family members should be represented in a tree by a parent or guardian rather than holding accounts.

5. Where your data lives, and for how long

Your data is stored on servers owned and operated by MEC Research Labs in British Columbia, Canada — not in a public cloud.

We keep backup copies for up to 10 days on a rolling basis. When data is deleted from the live service it disappears from backups as they roll over, so deletion becomes complete within about 10 days.

Stated plainly: these backups are not yet encrypted at rest. They are held on storage we own and physically control in Canada, and are not exposed to the internet. Encrypting them and holding a copy offsite is scheduled work, and we will update this section when it lands.

We retain account and product data for as long as your account exists. When your account is deleted (§7), we remove your personal information, subject to the family-content rule described in the Terms of Service (§"Your content" — contributions to a shared family tree can remain with that family, with your authorship identity removed on request).

One exception, stated plainly. If you shared a tree with other members, your own person record in that tree is minimised, not deleted — the same treatment described in §4: an initial, your surname, and your place in the tree remain, and everything else goes. A tree with nobody else in it is removed completely.

6. Who else touches the data

We never sell personal information. No advertising or analytics companies receive anything. The complete list of service providers that touch personal data in operating the service:

Provider	Role	What they see	Where
Cloudflare	Network edge (TLS, tunnel)	Traffic in transit	US company
Google (Gmail SMTP)	Sending our transactional email	Recipient addresses and email contents (e.g., an invitation naming a tree)	US company

AI providers used for generating learning content receive curriculum material only — no personal information (§3).

Because two providers are US companies, data in transit may be processed outside Canada. Data at rest stays in Canada.

7. Your rights

Under PIPA and PIPEDA you may, at any time, ask us to:

• Show you the personal information we hold about you;
• Correct it (much of this you can do in-product — your profile, and in Ancestry your own person record);
• Export it (Ancestry trees export to the standard GEDCOM format from the product; for a full account export, email us);
• Delete your account and personal information — email us at [[email protected]] and we action deletion requests within 30 days — noting the backup rollover (§5) and shared-tree rule (§5);
• Withdraw consent for anything optional;
• Complain — first to us at [[email protected]]; and you always have the right to contact the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

8. Security, honestly stated

Passwords are hashed with a modern memory-hard algorithm; sessions are revocable server-side; the servers accept no inbound connections from the internet (traffic arrives only through an outbound-established tunnel); and tree data is compartmentalized per family with layered visibility rules. This is a Beta service operated by a small team: we state plainly that no system is breach-proof. If a breach creates a real risk of significant harm to you, we will notify you and the appropriate commissioners as PIPEDA requires.

9. Changes

We will post changes here with a new effective date, and for material changes we will tell you in the product before they take effect.

---

MEC Research Labs Ltd. · Vancouver, BC, Canada · [[email protected]]