Privacy Policy
Effective September 7, 2026
A memorial holds some of the most personal things a family will ever publish. This page sets out exactly what we collect, why, and what you can do about it.
1. The short version
- We do not run analytics or advertising trackers. There is no Google Analytics, no advertising pixel, and no third-party tracking script anywhere on this site.
- We never see your card details. Payments happen on Stripe's own hosted page.
- We do not sell your data, and we do not use memorial content to train machine-learning models.
- You control who sees a memorial — public, unlisted, or password-protected.
- You can take everything with you. A one-click export gives you a complete archive; closing your account erases your personal details for good.
2. What we collect
We collect only what the Service needs to work. Nothing below is optional-but-secretly-required, and nothing is bought from data brokers.
When you create an account
| Data | Notes |
|---|---|
| Email address | Your login identifier and how we send account mail. |
| Display name | A username, plus an optional first and last name. |
| Password | Stored only as a modern one-way hash. We cannot read it, and neither can anyone who obtains the database. |
| Google account ID | Only if you sign in with Google. We receive your Google email, name, and account identifier — never your Google password. |
| Profile photo | Optional, and only if you upload one. |
| Preferences | Default memorial visibility, whether contributions show your name, and whether we email you about new tributes. |
When you build a memorial
Everything you choose to put on the page: the person's or pet's name and dates, their life story, roles, service details, timeline entries, family members, the portrait and gallery photographs, and — if you add one — the final resting place.
The resting place deserves a specific note. The map coordinates come from your browser using Google Places autocomplete and a draggable pin. Our server never sends an address to a geocoding service; it only stores the result your browser produced.
If you protect a memorial with a shared family password, that password is stored as a hash, not as readable text.
When you leave a tribute
The name you type, an optional note on how you knew them, your message, and the time you sent it. If you are signed in, the tribute is linked to your account so it can honour your display preference. We do not store a visitor's email address or IP address with a tribute.
When you buy a plan
The plan purchased, the amount, the currency, and the identifiers Stripe gives us for the checkout session and payment, so we can match a payment to your account and issue an invoice. Card numbers never reach our servers.
Automatically, as you use the site
Your IP address is used transiently to enforce anti-abuse limits — capping tribute submissions, password-reset requests, sign-in attempts, and the "pay respect" gesture. These counters live in a short-lived cache keyed by IP; they are not written to the database and are not linked to your account. Our hosting provider and web server also keep standard request logs, as any web server does.
3. Why we use it
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Running your account and memorials | Performance of our contract with you. |
| Taking payment and issuing invoices | Performance of our contract; and a legal obligation to keep financial records. |
| Transactional email (password resets, export links, tribute notifications) | Performance of our contract, and your consent for the notifications you can switch off. |
| Rate limiting, sign-in throttling, CAPTCHA | Our legitimate interest in keeping the Service secure and available. |
| Answering your support messages | Our legitimate interest in supporting our users. |
| Memorial content you publish | Your consent, expressed through the visibility setting you choose. |
We do not profile you, make automated decisions with legal effects about you, or use your data for advertising.
4. Who can see a memorial
You decide, per memorial, and you can change it whenever you like:
- Public — anyone can find the page, and search engines are invited to index it. It also appears in our sitemap and can generate a social-preview image when the link is shared.
- Unlisted — reachable only by its link. It is excluded from our sitemap and marked
noindexfor search engines. Anyone holding the link can still open it. - Private — additionally gated behind a password you share with the family. Also excluded from the sitemap and marked
noindex.
Tributes are held for the owner's approval and are invisible to the public until approved.
5. Who we share it with
We do not sell personal data and we do not share it for anyone else's marketing. We rely on a small number of service providers, each processing data only on our instructions:
| Provider | What it handles |
|---|---|
| Stripe | Payment processing. You enter card details on Stripe's page; they act as their own controller for that data under their privacy policy. |
| Optional sign-in (only if you use it), and the map on a memorial's resting place. The map is loaded by your browser from Google, so Google sees that request. | |
| Cloudflare | The Turnstile challenge on public forms, to keep out automated abuse. It is designed to work without tracking visitors across sites. |
| Our email provider | Delivering account email — password resets, export links, tribute notifications, and replies to your support messages. |
| Our hosting provider | Storing the database and uploaded files, and serving the site. |
We may also disclose information where we are legally required to, or where it is necessary to establish or defend a legal claim, or to protect someone's safety. If the Service is ever sold or transferred, your data would move with it, and we would tell you first.
7. How long we keep it
- Account and memorial data — for as long as your account is open. Memorials are meant to last; nothing expires on its own.
- Data-export archives — the download link expires 48 hours after we generate it, and the archive is then deleted.
- Password-reset tokens — one hour, single use, cleared as soon as they are used.
- Rate-limit counters — a rolling one-hour window in a cache, then gone.
- Invoices — retained after account closure, without your personal details attached, for as long as tax and accounting law requires.
8. Your rights
Depending on where you live you may have rights to access, correct, delete, restrict, or object to our use of your personal data, to withdraw consent, and to receive your data in a portable form. We extend the two that matter most to everyone, wherever they are, as self-service tools:
Export everything
From Account settings, request a data export. We build a complete archive of your account and memorials and email you a private download link, which expires after 48 hours.
Delete your account
Also from Account settings. When you close an account we:
- delete every memorial you own, together with its photographs, timeline, family entries and tributes;
- delete your profile photo and any pending export archives;
- permanently overwrite your email address, username, and Google link, and clear your password so no sign-in route can ever resolve the account again.
This cannot be undone — export first if you want a copy. Invoices survive, stripped of your personal details, because we are legally required to keep financial records. Tributes you left on other people's memorials also survive, detached from your account.
Everything else
To correct something, object to a use, or ask anything else about your data, contact us — see Contact. We will respond within one month. If you are in the UK or EU and you are unhappy with our response, you may complain to your national data protection authority.
We do not charge for exercising these rights, and we will never treat you differently for doing so.
9. How we protect it
- The site is served over HTTPS, with strict transport security and a content security policy that blocks injected scripts.
- Passwords are stored as modern one-way hashes; family memorial passwords likewise.
- Sensitive configuration secrets are encrypted at rest.
- Sign-in attempts, password resets, and tribute submissions are rate limited, and public forms carry a CAPTCHA challenge.
- Card data never touches our systems.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant regulator as the law requires.
10. Children
The Service is not directed at children, and accounts require you to be at least 16, or the age of digital consent where you live if that is higher. We do not knowingly collect personal data from children below that age. If you believe a child has created an account, contact us and we will remove it.
This is separate from memorial content: a memorial may of course be for a child who has died, and may include their photographs and story, published by their family.
11. Information about the deceased
Most data-protection law, including GDPR, does not apply to the deceased. We nevertheless treat memorial content with the same care as personal data, because it is deeply personal and because it inevitably names living people too — surviving family, tribute authors, the person who created the page.
If you appear on a memorial and want your name or details removed, contact us or the page's owner. We will act on reasonable requests even where no law compels us to.
12. International transfers
Our providers — notably Stripe, Google and Cloudflare — operate globally, so your data may be processed outside your own country, including in the United States. Where data leaves the UK or EEA, those transfers rely on the safeguards those providers maintain, such as the European Commission's standard contractual clauses.
13. Changes to this policy
If we change how we handle personal data, we will update this page and its effective date. For material changes we will notify account holders by email or by a notice on the site before the change takes effect.
14. Contact
You can reach us through the Help & support form, or by email at the address listed on our Help & support page.
My App is operated by [registered entity name], [postal address].