Privacy Policy

This page explains what we hold, who can see it, how long we keep it, and exactly what happens when you close your account. We have tried to write it the way we would explain it to you in person, because most people reading it are dealing with a death and should not have to decode legal language on top of that.

1. What we collect

Only what the service needs to work:

• Your account — your email address, your name if you give one, your profile photo if you upload one, and your settings.
• What you record about the person who died — their name, dates, the story you write, photographs and video, and the place or places they rest.
• Locations — the GPS coordinates of a resting place, and of you when you use a feature that needs to know where you are (see §4).
• What you do here — visits you log, guest book entries, candles you light, messages to family, FootPrints, Legacy Letters and Time Capsules you write, and anything you post on the Whisper Wall.
• Technical necessities — your IP address is used to rate-limit sign-in attempts and form submissions so the service can resist abuse. It is not stored alongside your account or used to profile you.

We do not run advertising or analytics trackers. There is no Google Analytics, no advertising pixel, and no third-party session recorder on this site.

2. How we use it

To show you memorials, to find them on a map and guide you to them, to deliver the messages you have written to the people you addressed them to, to tell you when family members do something you asked to be told about, and to keep the service running and secure. We do not sell your information, and we do not share it with advertisers.

3. Where your data lives, and who else handles it

We are a small operation and we rely on other companies to run the service. Each one below receives only what its job requires. This list reflects what is actually switched on in production today.

• Supabase — the database, sign-in system and file storage. Everything you write here lives on their servers in Canada (region ca-central-1).
• Railway — runs the website itself, in the United States (Virginia). Your requests pass through these servers.
• Resend — sends our email: sign-in mail, family invitations, delivered Legacy Letters, contact-form replies and the confirmation we send when an account is closed. They see the recipient address and the message.
• Mapbox — draws the maps. When a map is on your screen, your browser fetches map tiles directly from Mapbox, so they see the area you are looking at.
• OpenWeatherMap and TideCheck — give us the weather and the tide times at a resting place. They receive the coordinates of the memorial, never anything about you.
• Shopify — runs the shop. If you buy a physical item, the checkout happens on Shopify's own pages under their privacy policy, and we never see your card.
• Stripe — would handle subscription payments. Card details go straight to Stripe and never touch our servers. Paid plans are not currently switched on.
• Your browser or phone maker's push service — if you turn on notifications, your device registers with Apple, Google or Mozilla to receive them. We send the notification through that service.

Because the database is in Canada and the servers are in the United States, your information crosses borders in the normal course of using the service. If you are not comfortable with that, please do not use the service, and get in touch — we would rather hear it than not.

4. Location data

Location is the heart of this service, so we want to be precise about it. We store the coordinates of a resting place because that is the question the whole product exists to answer. We read your device's location — only when you use a feature that needs it — to check you have arrived at a graveside, to guide you there with a compass, to unlock a FootPrint that was sealed to a particular spot, and to place a Whisper Wall post near where it was written.

You can refuse or withdraw location access in your browser or phone settings at any time. Features that need it will stop working; nothing else will.

5. Who can see a memorial

Every memorial has one of three settings, which the person who created it chooses and can change:

• Only me — nobody else can open it, and it is not on any map or list.
• Family — you and the people you have invited who accepted. Still not public, still not indexed.
• Anyone — open to anybody with the link. Memorials set to “Anyone” are listed in our sitemap and are intended to be found by search engines. Memorials with any other setting are marked noindex so crawlers are told not to index them.

Organizations (cemeteries, funeral homes) can see the memorials created through their own organization account, and no others.

One honest caveat about photographs. Photos and video on memorials are served from public storage so that a shared memorial page loads for anyone you send it to. That means a photo's direct file URL works for anyone who has that exact URL, even if the memorial itself is private. The URLs are long and unguessable and are not listed anywhere, but they are not secret. Files attached to Legacy Letters are different: those are in private storage and are only reachable through a short-lived signed link.

6. Security

Your data sits in Supabase's managed Postgres, which is encrypted on disk, and every connection to us is over HTTPS. Access to each row is enforced by database-level security policies, not just by our application code — so a bug in a page cannot hand somebody else's memorial to you. Passwords are stored hashed by the sign-in system and we never see them.

We are not going to claim more than that. We are a small team, we have no security certification, and if you find something wrong we want to know — write to security@thememorialcollective.com.

7. How long we keep things

• Whisper Wall posts are deleted after 30 days. Really deleted — a job runs every day and removes them from the database, along with the support counts and any moderation reports attached to them. This is not a display filter; the rows are gone.
• Everything else is kept until you delete it, or until you close your account (§8). We do not have a schedule that quietly ages out memorials, photographs or messages, because losing them is precisely what people come here to prevent.
• Sealed messages — FootPrints, Legacy Letters and Time Capsules stay sealed until the condition you set is met, and are then delivered. If you close your account before that happens, they are deleted undelivered (§8).
• Operational records — our hosting, database and email providers keep their own short-lived server logs and delivery records under their own policies. Payment records, if you ever buy anything, are kept by Stripe or Shopify for as long as tax and accounting rules require.

8. Deleting your account

You can close your account yourself, from Settings → Danger zone → Delete account. There is no waiting period and no way to undo it, so we show you exactly what will happen first — worked out from your own records at that moment, not from a general description written once and left to drift.

What is permanently erased

• Your profile, your sign-in record, your settings, your notification preferences and your registered notification devices.
• Your subscription record and any organization membership.
• Any FootPrints, Legacy Letters and Time Capsules you addressed to other people, delivered or not. A sealed message cannot be sent by an account that no longer exists, and we will not leave one queued to arrive in somebody's inbox years after you have gone.
• Any walking trails you made but never published. Published trails stay online without your name on them, because they are about other people's memorials.

What happens to memorials you created

A memorial is not your personal data. It is a record about someone who died, and usually a family shares it. Your right to erase your own information is not a right to erase your cousins' only copy of their grandmother's photographs. So memorials are handled one at a time:

• If someone can inherit it, it is transferred, not deleted. Ownership passes to a family member you invited who accepted and has admin access — somebody who already had full rights over that memorial. We show you their name before you confirm. Volunteer stewards who tend a grave are deliberately excluded: tending a resting place does not make somebody family.
• If nobody can inherit it, we ask you about that memorial by name. You have to tick each one individually to confirm you want it destroyed. Destruction is never the default and never silent — if you do not tick it, the deletion stops and nothing changes.
• A QR code etched on a physical plaque keeps working. It moves to the new owner along with the memorial.

If you want a particular person to inherit a memorial, invite them as a family admin before you delete your account.

What is kept, but no longer linked to you

Things you contributed to other families' memorials stay where they are, with your identity removed. A guest book is a conversation, and deleting one person's entries years later leaves holes in something the surviving family still reads. So:

• Guest book entries stay, with your name replaced by “A former member” — both the link to your account and the name shown on the page.
• Visits you logged, photos you added, candles you lit and messages you sent in a family conversation stay, with your account no longer attached.
• Whisper Wall posts are detached from you immediately, and deleted within 30 days by the normal retention above.

How we make sure it actually happened

All of it runs as a single database transaction, and the last thing it does is delete your profile record. The database refuses that step if anything anywhere is still attached to you. So there is no half-deleted state: either everything above completed, or nothing was changed and your account is still exactly as it was. If it fails, we tell you it failed rather than showing you a success message.

Your session is signed out before your sign-in record is removed, so no logged-in cookie can outlive the account. Afterwards we send one confirmation email to the address that owned it. It contains no marketing and no recovery link, because there is nothing to recover — its only purpose is so that you find out if somebody else closed your account. If you get one you did not ask for, contact security@thememorialcollective.com straight away.

Two things we cannot do

• We cannot clear other people's caches. If a memorial was public, search engines and social networks may hold copies of the page for as long as their own caches hold them. We stop serving it immediately; the rest is out of our hands.
• We cannot remove records the law requires somebody to keep — payment and tax records held by Stripe or Shopify, and short-lived security logs at our hosting providers. None of that includes the content you wrote.

9. Your other rights

You can see and change everything on your account from Settings, and you can edit or delete any memorial, photograph, guest book entry or message you created at any time without deleting your whole account.

Asking for a copy of your data: we do not yet have a one-click export button. If you want a copy, email privacy@myfinalrestingplace.com or use the contact form and we will put one together for you by hand. We would rather tell you that plainly than advertise a button that does not exist.

You can also ask us to correct something, to stop sending you email, or to explain what we hold about you. Ask, and we will do it.

10. Children

This service is for adults. It is not designed or intended for children under 16, and we do not knowingly collect information from them. We do not currently ask your age when you sign up, so if you believe a child has created an account, tell us and we will remove it.

Memorials frequently record information about children who have died, including their names, dates and photographs. That is the purpose of the service, and the person creating the memorial decides who can see it — see §5.

11. Cookies

We set cookies for one reason: to keep you signed in. There are no advertising cookies and no analytics cookies, so there is no consent banner to click through. Clearing them signs you out.

12. Changes to this policy

If we change how any of this works, we will change this page and update the date at the top. Changes to what happens when you delete your account will be described here before they take effect.

13. Contact

Privacy questions: privacy@myfinalrestingplace.com. Security problems: security@thememorialcollective.com. Anything at all: our contact form, which reaches a person.