Privacy

About you. Your email address and password, held by our authentication provider — we never see the password itself. A display name, if you give one. Which memorials you look after. Anything you write: tributes, stories, the words on a memorial. What you have bought, as references to the payment, never card details.

About the person who died. Their name, dates, place, the biography written for them, and the photographs and videos added to their memorial.

About other living people. This is the part worth being honest about. A memorial can name living relatives — in a story, in a tribute, in a family tree, or in a photograph of a family group. Those people have not agreed to be here, and we have no practical way to ask them. We limit what we can: relatives imported from FamilySearch are only ever people FamilySearch records as deceased, and we keep only their name, years and record identifier. We cannot limit what someone types or uploads, and we do not try to read it.

We do not record your IP address, your device, or what you looked at. There is no analytics, no advertising, and no tracking of any kind anywhere on this site. We did not remove it; it was never added.

If you are not signed in, Burial Cloud sets no cookies at all and loads no third-party scripts. There is nothing to consent to, which is why you are not being asked.

Once you sign in, we set the cookies that keep you signed in, and nothing else. Connecting a FamilySearch account sets one more that lasts ten minutes and exists only to make sure the sign-in that comes back is the one you started.

Other companies hold parts of this because the site could not work otherwise. None of them is given anything to use for their own purposes.

• Supabase — the database and sign-in.
• Cloudflare — photographs and videos.
• Stripe — payments. Card and bank details go to Stripe directly and never reach us.
• Resend — the emails we send you.
• Sentry — when something goes wrong on our servers, a note of what failed and where in our code. It is set up not to receive who you are, your sign-in, or anything you typed, and it runs only on our side: nothing about this is loaded into your browser.
• Anthropic — if you ask us to draft memorial text, the details of the memorial and the notes you write are sent to their model to produce it. Nothing is published from that without a person reading it first.
• FamilySearch — if you connect an account, to look up the records you ask for.

A published memorial is public, including its photographs, the tributes left on it, and the names and years of family members shown on its tree. That is the point of it. Think of anything added to a memorial as readable by anyone who finds the page.

A memorial stays private to its steward until they publish it, and there is no middle setting — nothing today publishes a memorial to a family and no further. If that is what you want, keep the memorial unpublished for now and tell us; knowing that families want it is what would make it worth building.

Relatives imported from FamilySearch are the exception: FamilySearch asks that their records are shown only to people signed in with FamilySearch, and that rule is enforced by our database rather than by our good intentions.

Indefinitely, by design. A memorial is meant to outlast the moment it was made, and a photograph uploaded here may be the only copy left of someone who has died. We do not quietly delete things to save space.

When a steward removes a photograph it stops being part of the memorial and stops being reachable, but the file itself is kept, so a mistake can be undone. If you want something genuinely destroyed, ask us and we will do it.

A copy of everything. There is a button for this one, in your account settings. It gives you a file holding your whole record and the photographs themselves, so it keeps working whatever happens to us.

A correction, or removal. You can close your own account from your settings. That signs you out for good and takes your name and email address off our records. For a correction, or to remove something specific, write to us and a person will do it.

When we close an account we remove the person, not what they gave to other families. Your name, your email address and your way of signing in are gone for good. A tribute you left on someone’s memorial stays where it is, with no name on it, and so does a photograph you added — it may be the only copy that family has, and it is not ours to take away from them. If you want something you wrote removed as well, say so and we will.

One thing we will ask you about first: deleting an account that looks after a memorial raises the question of what happens to the memorial, and to photographs that other members of a family may be relying on. We would rather talk that through than guess.

Email support@burialcloud.net and a person will answer. If something here is wrong, or reads as evasive, we would like to know.