Privacy Policy

Last updated: 21 October 2026

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

William Payne
Aachener Straße 43
66115 Saarbrücken
Germany
Email: akwaaba@ghanachild.com

GhanaChild.com is a non-profit community project. We are not required to appoint a data protection officer. For any privacy question, email us at the address above.

2. Summary

• We only collect what we need to run GhanaChild, and we never sell your data.
• We use no tracking or analytics cookies. The only cookie is the one that keeps you logged in.
• Your profile and family tree are visible only to logged-in members. Content becomes public on the open web only where you choose it: a business you list in the public directory, and posts and replies you write in the public Music, Lifestyle and Sports sections (shown with your display name and profile photo). Church posts are for logged-in members only.
• You can see, correct, export or delete your data at any time. Just email us.

3. Hosting and server logs

Our website and database are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, on servers in Germany. We have a data processing agreement with IONOS (Art. 28 GDPR).

Whenever you visit a page, the server automatically records technical information: your IP address, the date and time, the page requested, your browser and operating system, and the referring page. We need this to deliver the website and to protect it against attacks. These logs are kept for a short period and then deleted.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website).

4. News updates (waitlist) and contact form

If you sign up for news updates on our homepage (formerly the waitlist), we store your email address (required), and, if you provide them, your phone number and country, together with the date you signed up. We use them only to send you GhanaChild news and updates. Signing up for news does not create a member account.

Double opt-in: after you sign up we send one email with a confirmation link. You are only subscribed after you click it; we store the time of your confirmation as proof of your consent. If you don't confirm, your address is deleted automatically after 7 days. Every news email contains a link to unsubscribe, which deletes your address.

To stop automated spam signups, we briefly store a scrambled, keyed (one-way) version of your IP address — never the address itself — and delete it after about 15 minutes.

Legal basis: your consent, Art. 6(1)(a) GDPR, given with the checkbox. You can withdraw it at any time by emailing akwaaba@ghanachild.com, and we will delete your entry.

Contact form: if you write to us using the contact form, we receive your name, email address, topic and message by email (sent through our host IONOS) and use them only to answer you. The form does not store your message in our database. To stop spam we briefly keep a scrambled, keyed (one-way) version of your IP address — never the address itself — and delete it after about 15 minutes. We delete the email once your request is finished, unless the law requires us to keep it.

Legal basis: your consent (the checkbox), Art. 6(1)(a) GDPR, and answering your request, Art. 6(1)(b) and (f) GDPR.

5. Member account and profile

To create an account we need your email address and a password. We never store your password itself, only a secure one-way hash of it. You can optionally add a phone number.

If you sign up with email and password, we send you a confirmation email with a one-time link, so we know the address really belongs to you. Your account only becomes active once you click it. If the link is not used, the unconfirmed account is deleted automatically after 7 days. If you forget your password, we can send you a one-time reset link (valid 1 hour). We store only a scrambled (hashed) version of these links. If you sign up with Google, no confirmation email is needed because Google has already confirmed your address (see section 9).

When you sign up we also ask for your display name, first and last name, hometown, current city and country and the languages you speak, so other members can recognise you. To complete your profile (your GhanaChild ID) we additionally ask for your year of birth and gender (you can choose "Prefer not to say").

Optional: your ethnic group ("tribe"), a short bio and a profile photo. Your ethnic group can reveal sensitive information (Art. 9 GDPR), so we never require it — it is not asked at sign-up and you only add it in your profile if you want to. By adding it, you explicitly consent to us storing it and showing it to other logged-in members. You can remove it at any time.

We also record when you last logged in.

Legal basis: Art. 6(1)(b) GDPR (providing the membership you signed up for). For optional and sensitive profile details: your consent, Art. 6(1)(a) and Art. 9(2)(a) GDPR.

6. Family tree, listings, messages and other content

• Family tree: the relatives you add (name, relationship, and optionally birth year, birthplace, ethnic group and a short note). Please only add information about living relatives that they would be comfortable with, and remove it if they ask you to.
• Inviting relatives: you can create a personal invitation link for a relative on your tree and send it yourself (for example by WhatsApp, your own email or SMS). We store the relative's name and relationship from your tree, when the link was made, and whether it was answered — only a one-way hash of the link, never the link itself. We do not send emails to people who are not members, and we do not store their email address or phone number. If you enter the email address of a relative who already has a GhanaChild account, we send them a connect request (an on-site notification, and an email if they have email notifications switched on); we never tell you whether an account was found. Nothing is connected unless the relative confirms. When they do, each of you appears on the other's tree, linked to the other's profile; the new entry is visible only to its owner until they choose to show it. Either of you can remove the connection at any time.
• Business ideas and marketplace listings: the title, description, price, location, website, contact details and images or videos you post.
• Comments, discussions and messages: what you write, who it is addressed to and when. Private messages are visible only to you and the person you are writing to (and to us, where needed to investigate abuse reports).
• Community — Music, Lifestyle, Sports and Church: the posts and replies you write there, shown with your display name, profile picture and the date. Music, Lifestyle and Sports posts can be read by everyone on the internet, including search engines. Church posts and replies can only be read by logged-in members. Because they may reveal your religious beliefs (a special category of data under Art. 9 GDPR), we only publish them after you tick a consent box. You can delete your posts and replies at any time, which also withdraws that consent for them. If you report a post, we store your report and the reason so our team can review it.
• Saved businesses, notifications and page views: which listings you save, the notifications you receive, and, when you are logged in, which business pages you have viewed. We use this to show business owners how many members have seen their listing. We do not record the IP addresses of these views.

Legal basis: Art. 6(1)(b) GDPR (providing the features you use); for Church posts and replies, your explicit consent, Art. 9(2)(a) GDPR; for handling reports, Art. 6(1)(f) GDPR (keeping the community safe).

7. Public Business Directory

When you use "List your business", the details you enter (business name, type, description, city and country, and, if you give them, street address, website, business email and business phone) are checked by our team and then shown to everyone on the internet, including search engines such as Google. Please only enter contact details you are happy to publish; your account email is never shown. You can change or remove the listing at any time in your account (Business → List in Directory) or by writing to akwaaba@ghanachild.com. Search engines may take a little while to update their results. We also add businesses ourselves, but only after the owner has agreed. Business Ideas posted in the members' Business Hub are not public.

Legal basis: your consent, Art. 6(1)(a) GDPR.

8. Email notifications

When someone comments on one of your listings, or replies in a discussion or community post you started or took part in, we can send you an email from notifications@ghanachild.com. You can switch these notification emails off in your profile settings. Account emails (confirming your email address, resetting your password) are always sent, because the account cannot work without them. The emails are sent through our host IONOS.

Legal basis: Art. 6(1)(b) GDPR, and our legitimate interest in keeping members informed, Art. 6(1)(f) GDPR.

9. Sign in with Google

You can log in with your Google account instead of a password. If you do, Google sends us your name, email address and Google account ID. We use them only to create and recognise your account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may transfer data to the USA; Google LLC is certified under the EU–US Data Privacy Framework. For how Google handles your data, see Google's privacy policy.

Legal basis: your consent (clicking "Sign in with Google"), Art. 6(1)(a), and Art. 6(1)(b) GDPR.

10. Cookies

We use a single, technically necessary session cookie (PHPSESSID). It keeps you logged in and protects our forms against misuse. It is deleted when you close your browser or log out. We do not use tracking, advertising or analytics cookies, so there is no cookie banner. If that changes (see section 12), we will ask for your consent first.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary), Art. 6(1)(b) and (f) GDPR.

11. Fonts, videos and external services

• Fonts: the fonts "Playfair Display" and "Inter" are hosted on our own server. Your browser does not connect to Google or any other font provider when you visit our pages.
• YouTube videos: some listings and community posts contain a YouTube video. Nothing is loaded from YouTube until you press "Play YouTube video". Only then does your browser connect to YouTube (privacy-enhanced mode, youtube-nocookie.com), which receives data such as your IP address. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Images from other websites: members can add an image by pasting a link to a picture on another website. Your browser then loads that picture directly from that website, which can see your IP address (we send no other information with it).
• TikTok videos: some listings and community posts contain a TikTok video. Nothing is loaded from TikTok until you press "Play TikTok video". Only then does your browser connect to TikTok, which receives data such as your IP address and may set cookies. Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Privacy policy: tiktok.com/legal.
• External links: links to other websites (for example government pages in our guides) are only followed when you click them. From then on, the other website's privacy policy applies.

Legal basis: Art. 6(1)(f) GDPR (a consistent, working design), and, for videos, your action of pressing play.

12. Advertising and support links

GhanaChild is non-profit. To cover running costs and support charitable initiatives, we may in future:

• show advertising, for example Google AdSense. Advertising services may use cookies and similar technologies. Before any such service is switched on, we will add a consent banner, ask for your permission, and update this policy.
• link to support platforms such as Patreon. These are ordinary links: no data is sent to them until you click, and from then on their privacy policy applies.

At the time of this update, no advertising is shown on GhanaChild.

13. How long we keep data

• News updates (waitlist): until you unsubscribe, or until we stop sending news. Unconfirmed signups: 7 days.
• Account, profile and your content: as long as your account exists. If you ask us to delete your account, we delete your profile and content within 30 days, unless the law requires us to keep something.
• Contact form messages: kept in our mailbox only as long as needed to answer you, then deleted (unless the law requires us to keep them).
• Unconfirmed sign-ups: deleted automatically 7 days after sign-up if the confirmation link was never used. One-time confirmation and reset links are deleted a few days after they expire or are used.
• Community reports: kept while our team reviews them, then deleted 90 days after the report is closed.
• Family invitations: a link or connect request expires after 30 days. Unanswered, declined or cancelled invitations are deleted 30 days after that. An accepted invitation is kept as a record of the connection while both accounts exist.
• Server logs: a short period for security purposes, then automatically deleted.
• Anti-spam data (keyed one-way hash of the IP address, waitlist and contact form): about 15 minutes.

14. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15)
• correct inaccurate data (Art. 16)
• have your data deleted (Art. 17)
• restrict how we process it (Art. 18)
• receive it in a portable format (data portability, Art. 20)
• object to processing based on our legitimate interest (Art. 21)
• withdraw consent at any time, with effect for the future (Art. 7(3))

Just email akwaaba@ghanachild.com. We will reply within one month.

You also have the right to complain to a data protection authority. Ours is the Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken (datenschutz.saarland.de). You can also contact the authority where you live.

15. Security

All connections to GhanaChild are encrypted (HTTPS). Passwords are stored only as secure hashes. Our forms are protected against cross-site attacks, and the admin area is locked after repeated failed login attempts. No system is 100% secure, but we work hard to protect your data and to fix problems quickly.

16. Children

GhanaChild is not intended for children under 16 without the consent of a parent or guardian. If you believe a child has given us personal data without that consent, please contact us and we will delete it.

17. Changes to this policy

We update this policy when GhanaChild changes, for example before introducing advertising. The date at the top always shows the latest version. See also our Impressum (legal notice).