Privacy Policy

1. Information We Collect

We collect only the information necessary to operate our memorial services:

• Account credentials: email address and password (hashed) when you register an account.
• Public profile: a chosen nickname displayed alongside your memorials and stories.
• Personal information: first name and last name, collected at registration. Used internally only — never shown publicly.
• Mailing address (optional): address line 1, address line 2, city, state, and ZIP code, if you choose to provide them. Used solely for donation receipts and to verify identity for privacy-rights requests.
• Phone number (optional): only if you opt in to SMS-based two-factor authentication.
• Memorial content you create: pet name, biography, dates, photos, and stories.
• Tribute messages you post on memorials.
• Technical data: IP address, browser/user-agent, referring URL, and timestamps, recorded by our audit log for security and abuse-prevention purposes.

2. How We Use Your Information

• To provide and operate the memorial services.
• To send transactional emails (account verification, password resets, MFA codes, donation receipts).
• To verify your identity when responding to a privacy-rights request.
• To detect, prevent, and respond to fraud, abuse, and security incidents.
• We never use your data for advertising and we never sell or rent it to third parties.

3. Cookies

We use only strictly necessary session cookies (HttpOnly, Secure) to maintain your login state. We do not use tracking cookies, advertising cookies, or third-party analytics.

4. Data Sharing

We do not sell, rent, or share personal data with third parties except where required by law or to prevent imminent harm. Memorial content you mark as public is visible to all visitors; private memorials are visible only to you.

5. Your Rights (GDPR / CCPA)

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Object to or restrict processing of your data.
• Data portability (GDPR Article 20).

To exercise these rights, please use our Privacy Rights Request form. We respond to verified requests within 30 days.

6. Data Retention

Account data is retained for as long as your account is active. Deleted accounts are soft-deleted and fully purged after 30 days. Memorial content is retained until you delete it or request account deletion.