Privacy, clearly explained.

Who to contact

Held in Memory is the public name of the Australian online memorial service at heldinmemory.com.au. Privacy questions, access or correction requests, and deletion or ownership concerns can be sent to support@heldinmemory.com.au.

What we collect

When you create an account, we collect details such as your first name, email address, password hash, email-verification status and login timestamps. Password-reset links are represented by hashed tokens rather than storing the reset token itself.

We store the memorial information an account holder chooses to add, including names, dates, relationships, stories, timeline moments, photographs, captions, display choices, visibility settings and plan status.

If an adult prepares their own memorial, we also keep the minimum records needed for its optional future handover: whether it is self-authored, the creator’s release choices, accepted or declined trusted-contact relationships, invitation and security-token hashes, contact status, activation requests, claimed date of death, hold and review dates, the verification methods used, decisions and a limited audit trail. Trusted contacts must use a separate, email-verified account; we do not give them the creator’s password.

When someone submits a tribute, we collect the name they provide, an optional relationship, the tribute text and their IP address. IP addresses and security-event information are also used to limit spam, investigate abuse and protect accounts.

For Premium purchases, we record transaction details such as the memorial, amount, currency, payment status and Stripe reference. Card details are entered into Stripe’s hosted checkout and do not pass through Held in Memory’s server.

How we use it

We use this information to provide and secure accounts, verify email addresses, create and display memorial pages, process Premium access, manage photographs and tributes, respond to support requests, prevent abuse and let account holders control how a memorial is shared.

Account-registration and tribute forms use Cloudflare Turnstile as a necessary security check. Turnstile may process connection, browser and device signals, including an IP address, to distinguish people from automated abuse and return a verification result. It runs independently of the optional advertising choice, and Held in Memory does not put account, memorial or tribute form content into the Turnstile action data.

Who can see memorial content

Public memorials can be viewed by anyone and may be indexed by search engines. Link-only memorials can be viewed by anyone with the address and are marked noindex, but the address can still be reshared. An ordinary Private memorial is visible only to its signed-in account holder. A private self-prepared memorial remains unavailable to the public after an approved handover, but the accepted Legacy Contact can access only the released memorial and the permissions the creator recorded. Drafts and memorials pending deletion are not shown to public visitors.

Premium visitor tributes remain pending until the account holder approves them. Approved tributes appear to anyone who can view that memorial.

Self-memorial contacts and handover

Planning Ahead stores and hands over memorial content only. It does not replace a will or an executor, administer an estate, or carry out executor or estate-administration duties. A Legacy Contact’s limited website permissions remain separate from any legal role that person may independently hold.

Invited trusted contacts receive enough information to understand and accept or refuse the relationship. Before an approved release, an accepted contact can see only relationship and handover status information. They cannot read the creator’s private story, photographs, messages, notes, tributes or other draft content. A backup contact is treated the same way unless and until the creator’s recorded settings and our verification process give them a later role.

A trusted contact can submit a claimed date of death and an explicit statement asking us to begin review. The feature does not accept death certificates, identity documents or other evidence uploads, and support does not ask people to send those documents through the memorial or handover forms. Review uses limited identity facts from the creator’s frozen snapshot and independently checked sources. Requests are held for at least 72 hours, reviewed by a person and require at least two independent supporting signals. Inactivity alone never triggers a report, review or publication.

When a request is submitted or its state changes, we send necessary safety messages to support and to the creator and relevant trusted contacts. Those emails identify the relationship or request and link to an authenticated page; they do not include memorial stories, photographs, private notes, cause of death, identity documents or submitted evidence. This gives a living creator and other contacts an opportunity to report a mistake or misuse.

The handover record keeps the closed verification method, outcome, reviewer, dates and a bounded administrative reason. It does not store source links, certificate or grant numbers, document copies, memorial stories or photographs. If someone sends sensitive material to support without being asked, it is treated as support correspondence rather than added to the handover record; they can contact us to request deletion, subject to any fraud-prevention, dispute or legal obligation that requires limited retention.

A credible conflict, fraud report, living-person privacy concern or competing authority claim can cause a request or released memorial to be disputed, revoked or returned to private status. We preserve the minimum audit and content records needed to review or comply with a lawful direction, and do not use the handover process to decide an estate or family dispute.

Funeral-home acknowledgements

If a family receives Premium access through a funeral-home invitation, we keep an acknowledgement record containing the partner’s approved public business name, an optional approved logo and website, and the family’s choice to show or hide it. When shown, the acknowledgement appears only to people who can already view that memorial. The family can change this choice at any time.

The funeral home can see whether the invitation it sent was accepted, but its partner account does not reveal the family’s password, private content, stories, photographs, tributes, memorial visibility or acknowledgement choice. Showing its approved name or logo does not give it access to the memorial or visitor information.

Approved logos are delivered from Held in Memory rather than loaded from the funeral home’s website. If a visitor chooses an optional link to the funeral home’s verified website, they leave Held in Memory and that website’s privacy practices apply. Held in Memory does not add the memorial’s name or identifier to that link.

Photos and storage

Photos may be stored on the website server or, if configured, through Cloudflare Images. Uploaded photos are used only to display the memorial and its management screens.

Premium writing assistant

The writing assistant is optional. When an account holder chooses Draft with assistant, the memorial details shown in that tool, including any favourites or interests they have chosen to include, and any extra notes they enter are sent to OpenAI to produce a suggested life-story draft. The draft is not added to the memorial automatically: the account holder reviews it and chooses whether to replace or add to their existing story.

Do not put information into the writing assistant that is not needed for the draft or that you do not have permission to share.

Analytics and advertising

Held in Memory keeps limited, first-party funnel totals on its own server to understand whether the service is working. These include the daily number of safely tagged advertisement landings, people reaching account creation, verified accounts, committed private memorial drafts, checkouts begun and completed purchases. The stored report contains daily counters with bounded campaign dimensions. It does not contain event rows, IP addresses, browser or device details, Meta click identifiers, email addresses, names, account or memorial identifiers, page addresses or referral addresses.

For a safely tagged paid-advertisement landing, the existing necessary Held in Memory session may temporarily carry only closed source, medium and Meta placement values, plus campaign and creative codes selected from a small list maintained by Held in Memory. Free-form campaign, advertisement and audience names are not retained for this report. Numeric campaign, ad-set and ad identifiers, including any phone- or payment-card-like value, are also discarded. The session never carries the Meta click identifier for this report. This coarse campaign payload expires within 30 days, does not identify a person and is used only to add later completed steps to daily aggregate counters. If checkout begins, the same limited dimensions are copied into Stripe’s Checkout and PaymentIntent metadata so a verified Stripe webhook can add the purchase to the correct aggregate campaign counter; this payload contains no Held in Memory account, memorial or visitor identifier of its own. Aggregate files cover a rolling 400-day period: older files are removed on the next successful aggregate write or private administrator report. Automated crawlers, link previews, prefetch requests and repeated reloads are excluded where practical.

This internal aggregate counting operates with either privacy choice and does not contact an advertising provider. Choosing Necessary only blocks all Google and Meta marketing tags, their fallback tracking images and the existing detailed advertising attribution. It does not turn off the disclosed aggregate service-improvement counters kept only by Held in Memory.

Only when you choose Allow, selected marketing and conversion pages load Google’s advertising tag and the Meta (Facebook) Pixel to understand how people find the service and whether advertising leads to actions such as beginning a memorial or completing a Premium purchase. These providers may then receive the page address, referral source, browser or device information, approximate location derived from an IP address and interaction or conversion events, and may use cookies or similar identifiers. Choosing Necessary only means those tags and their fallback tracking images are not loaded.

Advertising tags are limited to selected marketing and conversion pages and are not loaded on memorial pages, grief-support resources, verification or invitation-token pages, the account dashboard, memorial manager or administration screens. We do not deliberately include memorial stories, photographs, tributes or memorial form fields in advertising conversion events.

If you arrive through a tagged advertisement and choose Allow, Held in Memory may retain approved campaign details such as UTM values, the Meta click identifier, campaign, ad-set and ad identifiers, and placement. These values are kept in the first-party session and may be attached to account, memorial or payment audit records so advertising outcomes can be measured. The allowlist does not capture memorial or account form fields, and advertising tags are blocked when a tracked page address contains an unapproved or sensitive query field.

Your choice is stored for 180 days in a short first-party cookie containing only allow or necessary. The choice form uses a signed value tied to the same-site return address, rather than creating an additional consent-form cookie. You can change your choice below at any time. Switching to Necessary only stops further tag loading and removes recognised Google and Meta identifier cookies from the Held in Memory domain; Google or Meta cookies on their own domains remain under those providers’ control. Browser cookie controls, ad blockers, your Google ad settings and your Meta ad preferences provide additional controls.

Marketing measurement

Allow lets Google Ads and Meta measure visits and conversions. Necessary only keeps all vendor marketing tags and detailed ad attribution off. With either choice, Held in Memory keeps daily aggregate funnel counts with closed campaign dimensions on its own server. These counts contain no person or content identifiers. Both choices give full access, and you can change this anytime.

Necessary only Allow

Service providers

We use service providers where needed to host and deliver the website and images, prevent automated abuse, process payments, send account emails, generate an optional writing draft, and measure marketing. Depending on the feature used, this may include the hosting provider, Cloudflare, Stripe, OpenAI, Google and Meta. These providers receive only the information involved in providing their part of the service and handle it under their own terms and privacy practices.

Some providers may process information outside Australia. Avoid adding unnecessary sensitive information, particularly when using the writing assistant or contacting support.

Email

Held in Memory sends necessary service emails from noreply@heldinmemory.com.au, including verification, password reset, account safety and private tribute-review notifications. These messages are part of providing and protecting the service, not marketing. For support, contact support@heldinmemory.com.au.

How long information is kept

Account and memorial information is kept while it is needed to provide the account and service. Trusted-contact and handover records are kept while the relationship or self-memorial remains active and for a reasonable safety, audit or dispute period afterwards. Invitation and action tokens expire and are stored as hashes. The handover feature is not designed to collect verification documents; unsolicited material sent to support follows the support-correspondence rule above. First-party funnel aggregate files cover a rolling 400-day period, with older files removed on the next successful aggregate write or private administrator report. A memorial deletion request hides the page immediately. Permanent deletion is currently paused while recoverable memorial storage is introduced, so content, photographs and tributes remain available for restoration. Transaction, security or support records may be kept where reasonably needed for accounting, fraud prevention, dispute handling or legal obligations.

Deleting or correcting information

Account holders can edit memorial content and visibility from the memorial manager and schedule a memorial for deletion from their account page. For account deletion, access, correction, ownership or other privacy requests, email support@heldinmemory.com.au from the account address where possible so we can verify the request.

Security

Passwords are stored as hashes rather than plain text. Uploads are checked for permitted file types, size and image dimensions, and sensitive configuration is kept outside the public web directory. No online service can promise absolute security, so use a unique password and contact us promptly if you believe an account has been accessed without permission.

Policy updates and questions

If this policy changes, the updated date will be shown at the top of this page. Questions or privacy concerns can be sent to support@heldinmemory.com.au.