Privacy

You can read any memorial on this site without telling us anything, without an account, and without being counted. There is no analytics script, no advertising and no tracking cookie anywhere on a memorial page.

The rest of this page is the honest detail: everything we do hold, and every time your browser talks to somebody who is not us.

If you have an account

Somebody who looks after a memorial has an account. We hold the email address, the name given, the password as a bcrypt hash we cannot reverse, whether the address has been confirmed, and the time of the last sign-in. That is kept while the account exists, and goes when it does.

Signing in creates a session held in our own Redis, not in a cookie you carry about. The cookie called requiem_session holds a random identifier and nothing else, and it lasts fourteen days. A second cookie, requiem_csrf, lasts an hour and exists only so that a form posted to us really came from a page we served. Neither is used to follow you anywhere, and there are no others.

If you follow a memorial

Following a memorial stores your email address against that memorial, with two random tokens: one to confirm and one to stop. Nothing is sent to you and nothing counts as a subscription until you have followed the link in the confirmation email, so somebody else typing your address achieves nothing at all.

When you unsubscribe we keep the row, marked as unsubscribed, rather than deleting it - otherwise the link in an old email would stop working and you would have no way to prove you had left. Ask us and we will delete it outright.

If our mail provider tells us a message hard-bounced or was reported as spam, we record that address on a suppression list so we stop writing to it.

If you write to a family

The contact form and the "this grave needs attention" form both store what you wrote, the address you gave if you gave one, and a token for the reply thread. The two sides never see each other's address; the replies go through us.

We also store a SHA-256 hash of your IP address - not the address itself. That is enough to see that a hundred messages came from one place, and not enough to be a record of who stood at a grave. These messages are kept until the matter is settled, because when one side later complains about the other, what was actually said is the only thing that helps. Ask and we will delete yours.

If you try to sign up and are turned away

The sign-up form refuses obvious automation - an empty field a person never sees, a form filled in under two seconds, a throwaway address, a domain that cannot receive mail. There is no puzzle to solve and nothing goes to Google.

A refusal is recorded for 30 days as a keyed hash of the address plus a masked hint such as s****@example.com, so that somebody who could not sign up and writes in can be found and helped. After 30 days it is deleted automatically. The long-run counters that show the guard is working hold no addresses at all.

Counters, and how we stop abuse

Some forms are rate-limited by counting attempts in Redis against a hash of your IP address. Those counters hold a number, expire within the hour or the day, and are never joined to anything you wrote.

The soundtrack, and YouTube

A family may choose a song for a memorial. Where that song is on YouTube, playing it loads a player from youtube-nocookie.com, which means your browser contacts Google and Google sees your IP address. This is the only third party your browser ever reaches on a memorial page.

When it happens depends on how you arrived. Scan the code on the stone and nothing loads until you press play - somebody standing at a grave may not be alone. Arrive any other way, from a search result or a link, and the music starts by itself, which means the request to YouTube happens on load without you pressing anything. The page says so beside the player, and pressing stop is remembered in your own browser so it will not start again.

Google's handling of that request is theirs, not ours, and is covered by their own privacy policy.

Maps and places

The map of a grave is drawn on our own server: we fetch the OpenStreetMap tiles ourselves, composite the picture once and cache it, so your browser never contacts OpenStreetMap and they never learn that you looked at a particular grave.

When somebody looking after a memorial pins a place, our server - not their browser - asks OpenStreetMap's Nominatim service for the address, and optionally what3words for the three words covering it. A memorial page can carry a link to what3words.com; following that link is you visiting them, as any link is.

Email

Our post is sent through Amazon SES. That means Amazon handles the message, including the address it goes to and what it says, on the way to your inbox. SES also tells us when a message bounced or was marked as spam, which is what the suppression list is built from.

Who else sees any of this

Amazon SES, for outbound email. Google, only through YouTube, and only on a memorial whose family chose a song. OpenStreetMap and what3words, contacted by our server rather than by you. That is the entire list. Nothing here is sold, and nothing is shared for advertising - there is no advertising.

Things we keep for the site to work

Photographs and words a family uploads are stored on our own servers. Every edit to a memorial is kept as a revision, so a page can be put back after a mistake, and that revision records which account made the change.

Keys we hold for other people's services are encrypted in the database with a master key kept outside it, so a stolen copy of the database is not a stolen set of keys.

Taking something down, or being forgotten

Write to shane@acemedia.ninja. Say which memorial or which address, and how you are connected to it. A person reads it - there is no form and no ticket queue.

We will take down a memorial at the request of the family, and we will delete your own data on request: your account, your subscriptions, the messages you sent through us, and any refusal record. Some of it we will keep for a short while first where deleting it immediately would break somebody else's unsubscribe link or hide what was actually said in a dispute - and if that applies we will tell you why, rather than quietly not doing it.

You can also ask for a copy of what we hold about you, ask us to correct it, or object to us holding it, and we will answer within a month.

If we get it wrong

Tell us first, at shane@acemedia.ninja, and we would rather fix it than argue. If we do not put it right, you can complain to the Information Commissioner's Office at ico.org.uk.

This notice was last changed in September 2026.