In short. Skeleton Files is a one-person genealogy research business run by James Duncan in Spring, Texas. We collect only what we need to answer your email, take your payment and research your family: your name and contact details, what you tell us about your family, the documents and photos you upload, and, only if you choose to share them, your DNA results. Payments go through Stripe, and card numbers never touch our site. Your uploads are stored encrypted, then moved into your private case file on an encrypted computer and removed from the cloud. Our pages set no cookies, we don't sell or share your data with anyone for advertising, and we never publish living people. You can ask to see, correct, download or delete your data at any time by emailing hello@skeletonfiles.com.
Who we are
Skeleton Files is run by James Duncan from Spring, Texas, United States. He is the person responsible for this website, its content and the personal data described on this page. In the language of privacy law, Skeleton Files is the "controller" of your data: the one who decides what is collected and why. The website is https://skeletonfiles.com and the email is hello@skeletonfiles.com. Our address is in the Contact section at the end of this page.
What we collect, and where it comes from
Different things at different points. Here is each one.
- When you visit the site. Our pages are served by Cloudflare. Like any host, Cloudflare sees the address your device connects from (its IP address), your browser type and the pages you ask for, and uses them to deliver the pages and block attacks. We use the IP address for one thing of our own: limiting how many requests a single address can send, so the payment and upload pages can't be abused. We count visits with Cloudflare Web Analytics, which uses no cookies and records no personal identifiers. We don't know who you are when you read this site.
- When you write to us. However you reach us, by email or through this site, we receive your name, your email address and whatever you tell us. We use it to answer you and, if you become a client, to start your case file. If you use a form on this site, the address your device sent it from is recorded with the message so we can trace abuse.
- When you pay. Payment happens on Stripe's own pages, not ours. Stripe collects your name, email address, phone number, billing address or ZIP code, and your payment details. Card numbers never touch our site. At checkout your card is authorized, not charged: Stripe places a hold for the amount shown, and the payment is captured only once you've accepted the written scope and total and we've accepted the case. If either side says no, the hold is released and nothing is charged. What we receive from Stripe is an order summary: your name, email, phone number, the package and add-ons you chose at checkout, the amounts, and Stripe's reference numbers for the hold and the payment. We store that summary in our cloud file storage and in your private case file. Later payments (milestones and balances, as described in the terms of service) are invoiced by email through Stripe, which collects the same details again at that point.
- When you build your foundation. Right after checkout you land on a private page where you tell us who the case is about, what you already know, family stories, links to existing trees or research, and where the family lived, and where you upload documents, photos, scans, old letters, tree exports and recordings of relatives. The link to that page is the key to your file: anyone with the link can see and add to it, so keep it to yourself. You can upload up to 25 MB per file, 80 files and 400 MB per case, and you can remove a file from the page yourself. The address your device uploaded from is recorded with each file so we can trace abuse.
- DNA results. Only if you choose. If you add the AncestryDNA tie-in, you buy the kit from Ancestry, under Ancestry's terms, and your results live in your Ancestry account. You decide whether to share them with us, and what to share: your match list, your ethnicity estimate, or your raw data. We never receive any of it unless you send it to us or grant us access. The rules are under Genetic data and your consent below.
- Access to your Ancestry tree. If you ask us to verify and correct your tree on Ancestry, or you share a tree with us, you grant that access from your own Ancestry account, and you can end it there whenever you like. We use it only for your case. Ancestry is a separate company with its own account, terms and privacy policy, which cover everything you do there.
Why we use it, and on what legal basis
We use your data for four reasons, and nothing else.
- To do what you paid for (contract). Your contact details, your order, your notes and your uploads are what we need to quote your case, research it, bill the milestones, deliver your file and support you afterward.
- Because you said so (consent). Genetic data, and anything you tell us about living relatives, is used only with your consent and only for your case. You can withdraw that consent at any time by email; we'll stop using that data and delete it if you ask. Withdrawing consent doesn't undo work already delivered.
- To keep the site and your file safe (legitimate interest). IP addresses, request limits and the other protections on this site guard your uploads and your payment against abuse and fraud. We also keep basic records of our business so we can answer questions about your case later.
- Because the law says so (legal obligation). Payment records are kept for tax and accounting.
We don't send marketing email. Every message you get from us is about your case or your payment. We don't build profiles of you, and no decision about you is made automatically by a computer. As our terms say, we use AI tools openly to speed up the searching and keep every person, conflict and source in your file cross-referenced; they never decide what's true, and they make no decisions about you.
Genetic data and your consent
DNA results are the most sensitive thing you can hand us. Privacy law, including the GDPR, treats genetic data as a special category that needs your explicit consent, so the rules are strict and short.
- We use genetic data (results, matches, ethnicity estimates, raw data) only with your explicit consent, which you give when you share it with us.
- We use it only for your case: to test the paper trail, confirm or break a line, and find the cousins who hold the photos and the stories.
- We never sell it, never share it with any third party, and never use it for anyone else's case.
- It's deleted on request, at any time. Tell us by email and it's gone from your case file.
- Your DNA test itself belongs to your Ancestry account, under Ancestry's terms and privacy statement. Deleting data from our file does not delete it from Ancestry; you do that in your Ancestry account.
Living relatives
Family research always touches living people: your parents, your cousins, the matches on your DNA list. When you upload or tell us information about living relatives, you confirm that you have the right to share it with us for your research. We use it only for your case and treat it with the same care as your own data.
We never publish living people. Client cases are never listed on this site; the public case files here are historical investigations with no living clients. We may describe a client's case publicly only with that client's written permission, and even then never in a way that identifies a living person. Your private family website and your case vault are yours, and who sees them is your choice.
Who handles your data
These are the companies that handle your data for us, or alongside us. We don't sell or share personal data with anyone for advertising.
- Stripe (Stripe, Inc., United States) processes every payment and invoice and sends your receipts. Stripe is responsible for the details it collects on its own pages. Stripe's privacy policy.
- Cloudflare (Cloudflare, Inc., a United States company with a global network) hosts this website, stores your uploads until we move them, routes email sent to hello@skeletonfiles.com to our mailbox, and counts visits without cookies. Cloudflare's privacy policy.
- Google Fonts. The typefaces on this site are loaded from Google's font servers, so when a page loads your browser asks Google for the font files, and Google sees your IP address the way any server you fetch a file from does. We send Google nothing else.
- Ancestry is not working for us. It's a separate service under your own account. Your DNA kit, your test results and any tree you keep there are governed by Ancestry's privacy statement and Ancestry's terms, not by this page.
We don't use advertising networks, tracking pixels, chat widgets or social-media plugins.
Where your data is stored, and how we protect it
- Everything between your browser and this site travels over an encrypted connection (HTTPS).
- Your uploads and your order summary sit in Cloudflare R2, encrypted at rest, in a private bucket that is never public. From there we copy them into your private case file on an encrypted computer and remove them from cloud storage.
- Your case file lives on that encrypted computer.
- Payment details live with Stripe, which is built to handle card data. We never see or store card numbers.
- Your foundation page is reached only through its own private link. If you lose the link, email us from the address you used at checkout and we'll send it again.
Your data is processed in the United States. No system is perfectly secure. If we ever learn of a breach that affects you, we'll tell you, and the authorities where the law requires it.
How long we keep it
- Your case file (notes, uploads, the records we find, the report, the vault and website files) is kept for as long as we need it to deliver and support your work, and then as your archive, so you can come back years later and pick up where we left off. Ask, and it's deleted.
- Uploads in cloud storage are removed once they've been copied into your private case file.
- Payment records (the order summary, invoices and receipts) are kept by Stripe and by us for tax and accounting, for up to seven years. We can't delete those early, even on request.
- Emails between us are kept as part of your case file, under the same rules.
- Genetic data is deleted the moment you ask, as described above.
If you write to us and don't become a client, your message stays in our mailbox so we can pick the conversation back up if you return. Ask, and we'll delete it.
Cookies and local storage
Our own pages set no cookies. That's why there's no cookie banner on this site: there's nothing to consent to.
- Light or dark mode. When you flip the theme switch, your choice is saved in your browser's local storage, on your device only. It never leaves your browser and tells us nothing. Clear your browser data and it's gone.
- Cloudflare Web Analytics counts page views without cookies and without personal identifiers.
- Stripe's checkout page is on Stripe's domain and sets Stripe's own cookies, which Stripe uses to make the payment work and to prevent fraud. See Stripe's privacy policy, linked above.
- Ancestry sets its own cookies on its own site, under its own policy.
Your rights
Wherever you live, you can ask us to:
- tell you what data we hold about you and give you a copy (access);
- fix anything that's wrong (correction);
- delete your data (deletion), except the payment records the law makes us keep;
- hand your data over in a usable format, for you or for another researcher (portability);
- stop using your data for a particular purpose (objection);
- withdraw any consent you've given, such as for genetic data.
Email hello@skeletonfiles.com, ideally from the address you used with us. We'll answer within 30 days. We may ask you to confirm it's really you before we send or delete anything: your case file is private, and we won't open it for someone else. You can't be treated differently for using these rights.
If you're in the European Union, the EEA or the United Kingdom. You have the rights above under the GDPR and the UK GDPR, and the right to complain to your data protection authority (in the UK, the Information Commissioner's Office). We'd rather hear from you first, but the choice is yours.
If you're in California. Under the CCPA and CPRA you have the right to know what personal information we collect, use and disclose, to correct it, to delete it, and to opt out of its sale or sharing. We don't sell personal information and we don't share it for cross-context behavioral advertising, so there's nothing to opt out of. We don't use sensitive personal information for anything beyond the services you asked for. We won't discriminate against you for using your rights, and you can have someone you authorize make the request for you.
If you're in Texas. Under the Texas Data Privacy and Security Act you can access, correct, delete and download your data, and opt out of sale, targeted advertising and profiling. We do none of those three. If we turn a request down, you can appeal by replying to our answer; we'll decide the appeal within 60 days, and if you're still not satisfied you can complain to the Texas Attorney General.
Everyone else. The same rights, by the same email. If your country gives you more, you keep them.
Children
This site and our services are for adults. We don't knowingly serve or collect data from anyone under 18. Children can appear inside a family's records, as a client's own children for instance; that information comes from the client, belongs to the client's case file and is covered by the Living relatives section above. If you believe a minor has given us data directly, email us and we'll delete it.
International transfers
We're in the United States, and your data is processed here. If you're outside the US, your data crosses a border to reach us. Stripe and Cloudflare provide standard contractual clauses, and the other safeguards the law requires, for those transfers where they're needed. Cloudflare runs a global network, so a page or an upload may pass through a data center near you on its way to the US. Your rights don't change because of where the data is.
Changes to this policy
When we change this page, we change the date at the bottom. If a change matters to you as a client with an open case, such as a new company handling your data or a new use of it, we'll tell you by email before it takes effect. The current version is always at skeletonfiles.com/privacy/.
Questions, requests and complaints: hello@skeletonfiles.com.
Skeleton Files · James Duncan
Spring, Texas, USA
Our other legal pages: the terms of service, the refund policy, and the legal notice. Prices and what each package includes are on the pricing page.
Last updated: October 7, 2026.