Privacy Policy

The short version

A tribute page is meant to be read, so most of what you put on one is public on purpose. What is not public is you: your email address, your card details, your address, and the record of who is related to whom.

We do not sell or rent any of that to anybody. Not to advertisers, not to data brokers, not to genealogy companies. That is the one commitment in this document we would ask you to hold us to.

What is public, and what is not

Public on a public page: the subject's name, dates, places, the story and photographs you add, the theme, and the first name you sign a guestbook entry with.

Never public: your account email, an email left with a guestbook entry, your shipping address, your order history, and anything on a page you have set to private.

A page set to private is reachable only by its direct link or QR code. It is excluded from search on this site and asks search engines not to index it. It is not encrypted, and anybody with the link can open it - treat the link as the key.

What we collect, and why

Account details - email address and a password you set - so you can come back and edit your page.

Order details - what you bought, the shipping name and address, and Stripe's reference for the payment - so we can make and post your stone and handle refunds. Card numbers are handled by Stripe and never reach us.

Page content - everything you choose to put on a tribute page.

Guestbook entries - the name shown, and optionally an email address that is never displayed and exists only so the page owner or we can follow up if an entry causes a problem.

A one-way fingerprint of the network address an entry came from, used to stop the same person posting fifty times in a row. It is hashed with a secret, so it cannot be turned back into an address, and it is not used to track anybody around the site.

Basic traffic statistics - which pages are viewed, roughly from where - so we know whether anybody is finding the site. We do not build advertising profiles.

The relationship graph

When two pages are linked as spouse, parent, sibling and so on, that link is a record about living people as well as the dead. It is the most sensitive thing on this site, and we treat it that way.

A link only exists when the owners of both pages have approved it, so nobody can attach you or your relatives to a page without agreement. We do not sell, rent, license or export that graph to anyone. If you remove a link, the connection goes.

Being found, and being shown

There are two separate settings, and we keep them separate on purpose.

The first is whether a page can be found by somebody looking for it - on-site search and search engines.

The second is whether a page may be shown to somebody who was not looking - in a browsable collection, a future app, or our own marketing. Agreeing to the first does not agree to the second.

You can change either at any time, and you do not need an active editing plan to do it. Withdrawing takes effect immediately. Anything already printed, cached by a search engine, or shared by somebody else cannot be pulled back, and we will not pretend otherwise.

Who else touches your data

We use a small number of companies to run the site, and only for that: Vercel for hosting, Neon for the database, Vercel Blob for stored photographs, Stripe for payments, and an email service for order and account messages. Each sees only what it needs to do its job.

Some archive pages display photographs served directly from the Library of Congress, which means your browser requests them from a US government server.

We will disclose information if the law actually requires it. If we are ever bought or merged, whoever takes over is bound by this policy until they publish a new one and tell you.

Cookies

A session cookie keeps you signed in. A short-lived cookie remembers if you have unlocked a page for viewing. We do not use advertising or cross-site tracking cookies.

How long we keep things

Tribute pages are meant to be permanent - that is the product, and we do not delete them because you stopped paying. Order records are kept as long as tax and accounting rules require. Account details are kept while the account exists.

Ask us to delete your account or a page and we will, subject to those record-keeping rules. Deleting a page removes its guestbook entries with it.

Your choices

You can make a page private, withdraw it from being featured, edit or delete what you have written, ask for a copy of what we hold about you, or ask us to delete your account. Use the support page and a person will answer.

Depending on where you live you may have further rights. Ask and we will honour them rather than argue about jurisdiction.

Children

Accounts are for adults. We do not knowingly collect information from anybody under 13. A tribute page may of course be about a child, created and managed by an adult.

Security, honestly stated

Passwords are stored hashed, payments never touch our servers, and access to the database is restricted. No small company can promise a breach will never happen. If one does, we will tell you what happened rather than manage the message.

If you have found a security problem with this site, the page at /security explains how to report it, what we will do about it, and what we ask of you while you are looking.

Changes

If we change what we do with your information in a way that matters, we will update this page, change the date at the top, and say what changed.