Privacy (draft)
DRAFT. This page is a draft under review and is not yet in force.
Privacy
For the Oregon and Utah release. Last updated October 13, 2026.
YourLandHistory.org helps you research the history of land. This page says what we keep, who can see it, and what you can do about it. Who runs the project, and how to reach it, is on About this site.
What stays private
A Land File you keep is private. It holds the land you chose, the papers and photographs you upload, the records we found, the people named in them, your research plan, and your saved reports. Nothing in it is public, and there are no share links in this release: a file opens only in a browser signed in with your key, or through a one-time recovery link. A file’s web address on its own opens nothing.
Records that name living people stay with the file that found them. Our shared holdings — the public records every file draws on — keep only place records and records whose named people are presumed dead, and they never show who looked a record up.
Until you choose Keep this land, your first pass is a draft. It holds place records only; the county’s owner-of-record lookup happens when you keep the land. You can return to an unkept draft in the same browser for seven days; then it is deleted.
Reports made before this release, which opened by a link alone, still open at their old links. Each one can be kept in a private file from the browser that made it, and nowhere else.
Your key and your email
Your file opens with a secret key, shown once when it is made. We keep no readable copy of it; we never put it in a web address, never email it, and never write it in our activity records. Anyone who has your key can open your files, so keep it private.
An email address is optional and has one use: recovering your key. It counts only after you click the confirmation link we send. We do not use it for notices, newsletters, or anything else. A recovery link works once, expires after 15 minutes, and gives you a new key rather than revealing the old one; the new key replaces the old one and signs out every browser. Sign out everywhere ends your sessions without changing your key.
Without your key, or a confirmed recovery email, we cannot reopen your private files.
Your papers and photographs
We keep the documents you upload, your answers about what each one is and who made it or holds the rights, and your choice about using it in your private report. Saying yes to the report is not permission to publish anything.
Every original is encrypted before it is stored, with the encryption keys held apart from the files. Hidden photo information, including location, is removed before storage; the date the photo was taken is kept. What is visible in a photograph — a house number, a face — is still in the photograph.
As each page is read, we look for Social Security numbers, driver’s license numbers, and account or loan numbers. The reader that does the reading sees the page in order to find them; after that, the numbers are replaced with [number blacked out] in everything we store and in every later step. If a sensitive number is found, the original is locked: its page previews are withheld, it is never sent for another reading, and it is left out of Download everything unless you choose Include locked originals. Locking does not paint over the original image; the number is still in the original document.
We do not display anyone’s mailing address in search results, summaries or reports. Original papers can still contain addresses, names and other personal details; do not assume an original has been cleaned.
How an AI assistant is used, and what the providers keep
An AI assistant reads uploaded pages, summarizes documents, prepares your research plan, and writes and checks your report. Planning uses a summary of your file, not your original uploads; every step after the first reading uses text with sensitive numbers removed.
Our rule: no private file material goes to any provider that trains on what we send. We use only paid business services on terms that forbid training. In this release that means one provider, Anthropic, through its paid API. The site’s code holds a short list of allowed providers and tiers and refuses any request to a model that is not on it. OpenAI is not used. Google’s Gemini service is not used for any private file material, because its abuse-monitoring policy allows training of models used for policy enforcement, which does not meet our rule. What the provider we use keeps, from its own published policy:
| Provider | What it keeps |
|---|---|
| Anthropic | Inputs and outputs are deleted within 30 days by default. Its most capable models require a fixed retention period (30 days, to confirm against the current policy). Content flagged for a policy violation can be kept up to two years, and safety classification scores up to seven years. Checked October 13, 2026. |
Deleting your file does not shorten a provider’s own retention period; our 30-day promise about backups (below) covers our copies.
Uploaded documents and fetched pages are treated as material to read, never as instructions. A sentence inside a document cannot open another file, send a message, change a permission or direct a request. Automatic research uses only sources on the site’s approved list.
Names, and searching by an owner’s name
Every name in your file is shown with the record, date and role that support it. The assessor’s entry says who the county lists as owner of record on that date; it is not our conclusion about ownership. Two people with the same name are never treated as one because their dates or places are close.
The labels Presumed living, Presumed dead and Living status unknown follow the dates in the records and are not proof of anyone’s present status: we presume a person dead when a record shows a birth more than about 110 years ago, adult status more than about 95 years ago, or a death; with no date, the status is unknown.
Searching by an owner’s name is offered one county at a time, only where that county’s own rules allow it, with the basis and check date for each county on Coverage. There is no search across counties and no index of living people’s names. Results are shown to you and are not kept as a list; a lot you choose may be added to your private file. Names on our removal list are left out of results.
We never sell personal data.
Removing a protected name
Use Remove a name: the name, state and county, the parcel or account number if you know it, and the reason — an Oregon protected person (ORS 192.345 or 192.368), a Utah at-risk government employee or law-enforcement official (Utah Code 63A-19-408 or 53-18-103), or another reason in a sentence.
We apply removal requests within 48 hours of receiving them. The request alerts the project’s administrators, who are responsible for that deadline. Removal applies inside private files and to owner-name search results, is applied again whenever county records are refreshed, and shows as name withheld at the person’s request. We keep what is needed to keep the name withheld; we keep your contact details for 90 days, then remove them. This changes what our site shows; it does not change the county’s own records.
What is public
This release publishes no Land File and offers no family sharing. Answering Yes, ask me later to the heritage question lets us ask you, inside your file and never by email, about publishing the historical parts of it in a later release; it publishes nothing now, and you can change your answer in Settings.
The Sullivan tree farm sample is a separate public copy, published by its owner; only the publisher’s own living name appears in it.
The shared-collection map shows counts of files by state and county and nothing else: no names, addresses, parcel numbers or outlines. County counts below five show as “a few,” state totals are rounded to the nearest five, test files are left out, and the counts are refreshed nightly.
Cookies, activity records and the state list
We use no tracking scripts. One cookie keeps you signed in, and your browser keeps what it needs to return to an unkept draft.
We keep the activity records needed to protect the service: sign-in attempts, uploads, downloads, deletions, and owner-name searches. A search record holds the county and the coded values used to enforce limits, never the name searched. Private file contents are kept out of visitor statistics and search engines.
If you ask to hear when another state opens, that is a separate list: you confirm your address by clicking the link we send, unconfirmed entries are deleted after seven days, and you can unsubscribe at any time. That list is separate from your recovery email and from the heritage question.
Downloading and deleting
Download everything gives you your records, the people named in them, your plan, your uploads and every saved report, with a guide to the download. Locked originals are included only when you choose them.
Forget this file deletes that file’s records, people, plans, uploads and reports; your other files and your key remain. Forget me deletes all your files, your account and your recovery email; your key stops working and every browser is signed out.
Copies in our backups are gone within 30 days. Research-cost totals remain, with no link to you or your files. Deleting a file does not delete a public record held by its source, and does not end a request to keep a protected name withheld.
Questions about privacy go to the project contact on About this site. Removal requests go through Remove a name, so the 48-hour clock starts when you send it.