What these tools promise
A GEDCOM file is often the only copy of years of research. Most tools that touch one rewrite it in their own dialect and hand back something the original program no longer recognises. These are the seven rules every tool here is built and tested against.
- C1Your bytes come back unchanged
- Read a file and write it straight back and you get the same bytes: byte-order mark, mixed line endings, trailing spaces, long lines split across CONC and CONT, tags no standard defines. A tool changes the lines it tells you it changed and leaves the rest alone.
- C2Every change is a patch you can undo
- No tool edits the tree directly. Each change is a patch with an inverse, recorded in a ledger. You can read the list before you export, and every entry can be applied backwards.
- C3Decisions are written into the file
- A merge you did, a pair you rejected, a confidence score, a finding that something is not there: each one is written into the exported GEDCOM. Close this tab and the decisions are still in your file, readable by other programs and by these tools next time.
- C4Every suggestion shows its reasons
- A suggestion carries a confidence number and the list of signals that produced it. You can see why a pair scored 0.82 before you accept it.
- C5Browser tools keep your file on your machine
- Browser tools parse in a local Web Worker. Model-assisted actions send the text you approve after explaining the disclosure. The optional hosted vault has a separate upload and retention consent flow; loading a file into a browser tool does not save it to the vault.
- C6Three versions of GEDCOM parse
- 5.5, 5.5.1 and 7.0 all load, along with the ANSEL, UTF-8, UTF-16 and code-page encodings the exporting programs write. Behaviour that differs between versions is keyed off the version in the file, not guessed.
- C7Every tool has its own address
- Each tool lives at its own path and works from a cold load with no stored state. You can link to one, bookmark it, or open several in separate tabs.
Hosted vault privacy
The optional vault sends your selected GEDCOM to Cloudflare for private retained storage, deterministic checks and HTML reports. We keep originals and reports until you delete them. Saving grants no permission for training or secondary use. Hosted checks call no models.
Keep your owner recovery key in a password manager. Keys stay in page memory and leave it when you close or reload the page. We store credential hashes, not recoverable keys. We offer no email recovery. Give agents scoped, revocable keys instead of your owner key. An external agent can send results to its own provider.
Owner checks protect originals and reports in private R2 storage. This is not user-level end-to-end encryption. Our service can read files to analyze them. We do not fetch media links embedded in GEDCOM files or expose public report links.
Deletion revokes live access before cleanup. We retry uncertain storage cleanup daily without restoring access or promising a fixed completion deadline. Cloudflare infrastructure logs and database backups have separate retention; deleting a live vault does not erase those systems at the same instant. We retain up to 32 opaque cleanup identifiers per vault when storage writes have uncertain outcomes, including after vault deletion. At that limit, we block new writes. Application logs omit file contents, filenames and credentials.
Launch limits cover file size, stored documents, report output and daily requests across REST and MCP. Deletion and key revocation have a separate global anti-abuse allowance, so exhausting ordinary usage does not consume cleanup capacity.
Tiers
- Free
- Reads the file, reports what it finds, and where the correction is mechanical, writes the corrected file out.
- Pro
- The heavier rewrites: merge, unmerge, privatise, bulk edits. Every one goes through the ledger with an inverse.
- Studio
- Adds a language model to the reading. It sees the text you approve and nothing else. Merge Arbitration is Pro and can also call it, and says so before it does.