The Five-Question Audit: What Every Genealogy Platform Actually Does With Your Data

You decided what data is yours to protect. Now decide whether the platform holding it has earned your trust.

Most family historians never read the Terms of Service. You click "I agree," upload your tree, and get to work. I did the same for years. But the platform you trust with your family's photos, stories, and DNA made promises in those documents about who owns your content, what their AI does with it, and what happens when you leave.

You don't have to read every contract. You need to know what to ask. This is a five-question audit you can run on any genealogy or AI platform in about ten minutes, with AI doing the reading for you. It pairs with the personal side of this question, which I covered in AI Privacy for Family Historians. That piece is about protecting your data. This one is about measuring the platform.

Here are the five questions.

Question 1: Naming — Which AI is operating on your data?

When a platform offers an AI feature, your words travel to a third party. You have a right to know which one.

Some platforms name their AI provider directly in their Terms of Service. Some mention "AI-powered assistants" without saying who runs them. Some ship an AI research tool on the website and never use the word "AI" in their legal documents at all.

The named provider matters because their privacy terms become part of your deal. An AI tool built on one company's models follows that company's data practices, and you agreed to them without knowing.

What to look for: Search the documents for "OpenAI," "Google," "Gemini," "Anthropic," "Microsoft," and "Amazon." If a platform offers an AI feature but names no provider, that absence is your answer.

Question 2: Honesty — How does the platform handle AI mistakes?

AI fabricates. It invents sources, dates, and people who never existed. An honest platform tells you so, in plain language, where you can see it.

The most honest disclosure I found in any genealogy platform's terms was a single sentence acknowledging that "outputs of these services may contain mistakes." Most platforms bury AI accuracy under a general "as-is" disclaimer that makes no specific promise about quality or reliability. None of them show the warning next to the AI output on screen, where you actually need it. It lives in a contract you signed years ago.

This is where the AIM method — Assess, Interact, Measure — does the work the platform won't. You measure every AI claim against the record yourself, because the platform has told you, in legal language, that it won't stand behind the output.

What to look for: Does the platform warn you about AI accuracy at the moment it hands you a result? Or only in the fine print? A warning you never see is not honesty.

Question 3: Real Deletion — What happens when you leave?

Most people assume that deleting an account deletes the data. The contracts often say otherwise.

Real deletion means everything the platform built from your content also disappears. Many platforms keep the indexes, compilations, and metadata they derived from what you uploaded. The original goes; the derivative stays. Some hold an irrevocable license, which means that once they share your content with a partner, they have no obligation to make that partner stop using it. And copies other users already downloaded remain with those users, beyond any platform's reach.

This is the gap between what "delete my account" sounds like and what it does.

What to look for: Search for "delete," "deletion," "irrevocable," and "perpetual." Note whether the platform commits to deleting derived data, indexes, and shared copies, or only the original file you uploaded.

Question 4: Custody — What license are you actually granting?

When you upload, you grant the platform a license to use your content. The terms of that license are the whole game.

A narrow license permits hosting, displaying, and processing your content so the service can function. A broad license adds the right to create derivative works, to sublicense your content to other companies, and to use it to "improve the services." The broadest licenses use the words "unrestricted," "royalty-free," "worldwide," "irrevocable," "sublicensable," and "perpetual" for "any and all purposes."

That last kind isn't a license. It's a transfer. You can hold both ends of this in your head with four words.

What to look for: "Irrevocable," "perpetual," "sublicensable," and "derivative works." Those four words tell you most of what you need to know about who really controls your family's stories.

Question 5: Portability — Can you take your work somewhere else?

Portability is the other side of deletion. When you decide to leave, you should be able to take your tree, your photos, your transcriptions, and your stories with you.

Most platforms offer GEDCOM export for family trees, which is the standard for tree data. Photo and story export varies widely by feature, and some platforms charge for it or limit what an export actually covers. A platform built on a shared community model may let you take only what you personally contributed, because the rest belongs to everyone.

A platform confident in its value lets you leave with your work. A platform that makes leaving hard is telling you something.

What to look for: Search for "export," "download," and "GEDCOM." Confirm the formats available, whether there's a fee, and exactly what the export includes.

The Prompt That Runs the Audit For You

You don't need to read the Terms of Service yourself. You can have AI read them. Paste this into Claude, ChatGPT, Gemini, or Perplexity along with any platform's Terms of Service and Privacy Policy.

I am a family historian deciding whether to keep using a platform that holds personal content of mine, including family trees, photos, stories, DNA, or transcriptions. I am pasting the Terms of Service and Privacy Policy below. Please analyze them using the following five questions. Quote the specific section numbers and language for each answer.

1. NAMING. Which AI providers and AI features are named in the documents? List any AI tools, assistants, recommender systems, or automated processing the platform operates. Identify the third-party companies (OpenAI, Google, Microsoft, Anthropic, Amazon) that power them. If nothing is named, say so.

2. HONESTY. What does the platform promise about AI accuracy? Are AI fabrications acknowledged? Where does the disclosure appear? Is the warning visible at the point a user sees AI output, or only in the legal documents?

3. REAL DELETION. If I delete my account, what happens to: (a) my uploaded content; (b) derived indexes, compilations, or metadata; (c) AI training data drawn from my content; (d) copies the platform has shared with sub-processors, research partners, or other companies? Quote the specific clauses.

4. CUSTODY. What license do I grant the platform when I upload? Is the license irrevocable? Perpetual? Sublicensable? Does it include derivative works? Quote the exact language.

5. PORTABILITY. Can I export my content in a usable format? Does the platform commit to providing export tools? Is there a fee? What format?

End with a one-paragraph plain-English summary: based on these five answers, what am I actually agreeing to when I use this platform?

Run it on your genealogy DNA service. Run it on your family tree platform. Run it on the newspaper archive you pay for and the AI tool you use for research. Then decide whether you're getting what you agreed to.

Why This Audit Matters Now

AI features are landing on top of services that were built before AI existed. New clauses are being added to old contracts, and old clauses are being read in new contexts. Some major platforms update their legal documents every few weeks.

You can't track every contractual change. You don't need to. You need a repeatable way to ask the right questions when something shifts, and a tool that reads the documents so you don't have to.

That's what the Five-Question Audit gives you: Naming, Honesty, Real Deletion, Custody, and Portability. Five questions, run by AI, that turn a forty-page terms of service into one paragraph you can actually act on. You already know which data is yours to protect. Now you know how to measure whether the platform holding it deserves to.

Get the Five-Question Audit as a one-page PDF you can keep and reuse — name your own price: download it here.