← Back to ForeverTrail

ForeverTrail - Privacy Policy

DRAFT - not yet reviewed by an attorney. This document was prepared to reflect how ForeverTrail actually works today, but it has not been reviewed by a lawyer and should not be published or presented to users as binding until it has been. Bracketed items like [STATE OF FORMATION] need a real value filled in before this goes live.

Effective date: [DATE] Data controller: ForeverTrail LLC, a limited liability company formed in the State of [STATE OF FORMATION] ("ForeverTrail," "we," "us," or "our") Contact: privacy@forevertrail.com

This Privacy Policy explains what personal information ForeverTrail collects, why, and what choices you have. It should be read alongside our Terms of Service.

The most important thing to understand: ForeverTrail is a public website. A memorial, a memory, a comment, your username, your avatar, and your bio are all visible to any visitor, signed in or not. This Privacy Policy is about the account and technical information behind the scenes - not a promise that anything you post is private, because it isn't.

1. Information we collect

Account information. When you sign up, we collect an email address and a password (handled by our authentication provider, Supabase Auth - we never see or store your password in plain text). You also choose a username, which is public and required to be unique.

Profile information you choose to add. An optional short bio, and an optional avatar photo you upload. Both are public.

Content you post. Memory titles and stories, comments, and photos you attach to a memory - all public, as described above. If you create a memorial, we also collect the obituary link, the person's name and dates, where they passed away, and your stated relationship to them.

Your relationship to a memorial you created is not shown publicly - it is visible only to ForeverTrail moderators, as part of reviewing whether a memorial should be approved. It is stored in our database regardless of whether a memorial is approved.

Location information - only if you choose to share it. If you use "Use my current location" when adding a memory, we record your device's GPS coordinates at that moment. This is only collected when you actively choose that option; typing a place name does not share your device's location with us. This location is used to mark the memory as an in-person visit and to calculate the "miles traveled" total shown on a memorial's page, and (if you later drag the map pin) is kept alongside the pin's displayed position for that distance calculation. If you create a memorial, the place where the person passed away is also geocoded (converted from an address to coordinates) using OpenStreetMap's free Nominatim search service - that address is sent to Nominatim as part of the lookup.

Information stored on your own device. ForeverTrail uses your browser's local storage for a few things that never reach our servers: which alerts you've already seen (so the unread badge clears), and - if you create a memory while offline - a temporary local copy of that memory (including its photos) until it successfully uploads. This local information stays on your device.

We do not currently collect: payment information (ForeverTrail is free), analytics or advertising cookies, or any information beyond what's described above. If that changes, we will update this policy.

2. How we use your information

We use the information above to:

3. Who we share information with

We do not sell your personal information.

We share information with the service providers that operate ForeverTrail on our behalf ("subprocessors"), currently:

We may also disclose information if required by law, to protect ForeverTrail's or others' rights and safety, or in connection with a merger, acquisition, or sale of assets (in which case we'll make reasonable efforts to notify affected users).

4. Email notifications

If your account has a verified email, ForeverTrail may email you when: someone comments on a memory you posted; your memorial submission is approved; your memorial submission isn't approved, or an already-approved memorial you created is removed; or a moderator removes a memory or comment you posted. These are tied to your own content or submissions - there is currently no marketing or newsletter email, and no way to opt out of these specific notifications short of contacting us or deleting your account, since they relate directly to your own account activity.

5. Data retention

We keep your account and content for as long as your account is active. You can delete your own account at any time from "Edit profile" → "Delete my account," or by contacting privacy@forevertrail.com. Deleting your account permanently removes your login, email, bio, and avatar photo, and replaces your username with an anonymized placeholder. Memories, comments, and any memorial you created stay visible under that anonymized name - deleting your account does not remove your posted content, since doing so would also remove other people's replies and a memorial's history. If you want specific content actually removed rather than anonymized, contact privacy@forevertrail.com and we'll review it the same way we review any other removal request. Content that has already been publicly visible may persist in backups for a limited time after deletion.

6. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. To exercise any of these, contact privacy@forevertrail.com. We will respond within the timeframe required by applicable law.

If you are in the European Economic Area, the UK, or a jurisdiction with similar law: our legal basis for processing your account information and content is our contract with you (these Terms) and, for optional information like location, your consent, which you can withdraw by not using that feature going forward. You have the right to lodge a complaint with your local data protection authority. Because our infrastructure is hosted in the United States, using ForeverTrail involves an international transfer of your data; [a lawyer should confirm the correct transfer mechanism - e.g., standard contractual clauses with our subprocessors - before this policy is published].

If you are a California resident, you may have additional rights under California law (such as the CCPA/CPRA) to know what personal information we collect and to request its deletion, as described above; [a lawyer should confirm whether any additional CCPA-specific disclosures are required given ForeverTrail's size and data practices].

7. Children's privacy

ForeverTrail is not directed to children, and you must be at least 13 (or 16, in the EEA/UK) to create an account, per our Terms of Service. We do not knowingly collect personal information from anyone younger than that. If you believe a child has created an account, contact privacy@forevertrail.com and we will investigate and remove it if appropriate.

8. Security

We rely on our infrastructure provider's security practices (encryption in transit, access controls, and row-level database security rules that restrict who can read or write which data) to protect your information. No system is perfectly secure, and we cannot guarantee absolute security.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make a material change, we will try to give reasonable notice before it takes effect.

10. Contact us

Questions about this policy, or to exercise your privacy rights: privacy@forevertrail.com