Privacy, plainly.
This page covers online activity on kolache.org and kolache.ai, including the Kolache Tradition Pattern Pilot, genealogy contact forms, and update lists. It does not authorize paper-form or Census research collection. Updated October 1, 2026; purchase terms apply separately below.
What we collect
We collect an email address when you join an update list or ask for an emailed quiz result. Census research submission is not currently open. We collect the contact and family-history details you enter online only when you select contact permission. Requests also carry limited technical context such as time, language, page source, campaign tags, kiosk status, and a random request identifier. Cloudflare may process ordinary network metadata while providing the site infrastructure. An approved festival conversation worksheet may be handed to a participant only as a no-retention aid; it is not a submission form and does not authorize paper or Census collection.
What we do with it
If you request an emailed quiz result without selecting Census or contact permission, the address is used for that delivery and is not retained in the quiz-results table. That delivery does not put you on an update or product-marketing list. Joining the project update list permits only the updates described beside that form; it is not genealogy-sales or general product-marketing permission. The current Census research control is disabled and the server rejects research storage. If a later approved pilot opens, it will have a separately reviewed notice and consent. With contact permission, the contact details you supplied may be retained so a genealogist can reply. Research and contact permissions are optional, default off, and limited to adults who confirm they are 18 or older.
What we never do
We do not sell personal information. We do not publish a recipe, story, or research response with your name without additional permission. Necessary service providers process information only to operate the site, database, and requested email delivery. The quiz result is an unvalidated cultural-similarity reading, not a genetic test, ancestry probability, or genealogical conclusion.
Where it lives
Permitted online submissions are stored in a project database on Cloudflare infrastructure. When contact permission requests human follow-up, the project inbox receives only a request identifier and limited consent metadata; the family narrative remains in the secured database. Quiz progress can be stored only for the life of the current browser tab using answer choices only; names, email, and story are not included. It is not saved to persistent local storage. Failed submissions are not queued on the device. Staff must not collect, photograph, copy, transcribe, retain, transport, or enter a completed conversation worksheet into any system. The participant must either take the worksheet away or personally place it into the provided secure-destruction container. Any future retained paper intake requires a separate accurate notice, versioned permissions, custody plan, and approval.
Retention targets and activation
The periods below are approved launch targets, not a claim that an unattended deletion schedule already operates. They become operating limits only after the cleanup route, a named operator, and the first reviewed dry run and execution are approved. Until that activation is recorded, verified deletion requests remain available, but automatic expiry must not be assumed.
Once activated, the targets are: rate-limit windows, 2 days; technical retry receipts, 7 days; orphaned consent receipts, 30 days; the closed legacy quiz table, 90 days; contact-only quiz rows and genealogy inquiries, 365 days; and inactive pseudonymous subscription history and minimal privacy completion receipts, 730 days. Active update-list permission remains until unsubscribe, verified deletion, or list retirement. Linked consent receipts are removed with their record. Census research collection remains disabled and has no implied retention term.
Access, correction, deletion, and withdrawal
Write to hello@ajhpress.com. Before disclosing or changing records, we verify control of the address used in the submission or use another documented method reasonably connected to the record. If a record has no contact address, its random request identifier may be needed to locate it. We ordinarily aim to complete a verified request within 30 days and will explain if applicable law or the request’s complexity requires more time. Corrections update the current identifiable field; historical consent receipts are not silently rewritten. Deletion covers matching active and legacy signup, quiz-contact, genealogy, consent, and technical-request records that can be linked after verification. To leave only the project update list, use the subject “Unsubscribe”; this does not withdraw a separate genealogy inquiry.
Deletion limits and recovery copies
Deletion does not include information that must be kept for a specific legal obligation, security investigation, or the establishment or defense of a claim; if such an exception applies, we limit use and explain it. After retention activation, the target for a secret-salted, non-mailing privacy completion receipt is no more than 730 days; it contains the case identifier, action, dates, verification method, and row counts—not the address or family narrative. Provider-managed disaster-recovery copies are not edited record by record and age out on the provider’s recovery schedule. If a recovery copy must be restored before it expires, completed deletions must be reapplied before ordinary service resumes.
Optional paid Field Guide
The free survey result does not require purchase, research participation, or contact permission. If you choose the $19 Kolache DNA Field Guide, a separate purchase notice asks to retain your answer choices and order details to create and deliver your guide. “DNA” is a cultural metaphor, not genetic data. Stripe processes your payment and checkout email; we do not receive card numbers. We store your selected answers, computed guide, versioned purchase consent, checkout identifiers, checkout email, payment status, timestamps, and campaign source in separate fulfillment tables. These are not research responses and do not authorize marketing or genealogy contact.
A laptop-to-phone QR encodes only answer choices in the URL fragment; it contains no name, email, or payment details. QR generation happens on the device. Scanning and opening that link does not submit a research response. A phone can keep the choices and retry identifier in its current tab session so cancelled checkout can resume. A report link contains a private access token; anyone with it can open that guide. We remove it from the browser address bar after opening and do not load third-party analytics.
Online purchased-guide access lasts 365 days. Fulfillment records are scheduled for removal after that period; unpaid order drafts after 7 days, once Stripe confirms no payment needs fulfillment. If payment verification is unavailable, deletion may be delayed so a paid guide is not lost. Payment-provider records have their own retention requirements. Delivery retries use a separate queue containing an order reference and delivery status. Provider acceptance is not proof of inbox delivery. For access, correction, or deletion of a purchase record, email hello@ajhpress.com from your checkout address with your receipt. A verified purchase-record request is handled separately from the older survey-contact records described above.
The shared festival laptop keeps no resumed survey progress, disables result-card downloads, and clears after three minutes of inactivity with a warning. Choose Next guest when finished. The personal-device purchase flow is separate from the shared laptop.