Your privacy matters.

Updated 16 September 2026.

Who looks after your information

SebTrack runs this remembrance service. Contact us about your information or email info@sebtrack.com.

What we keep and why

We use your name, email and sign-in details to provide your account. Supabase handles passwords and authentication. We store the spaces you create, journey dates and locations, messages, photos, videos, music choices and sharing settings to provide the features you ask for.

Account and service data are processed to provide the service you request. We process limited technical records, reports and moderation decisions for our legitimate interests in protecting people and keeping the service secure. Where required, optional music services load with your consent. Avoid putting sensitive information about living people in a public memory without their permission.

You choose who can see a space

New spaces are public and join A Universe of Energy by default. The creation form explains this and lets you choose a private space instead. Public links can be forwarded. For spaces included in A Universe of Energy: the person’s name, journey, approved written memories and contributor display names can then be discovered publicly. Public pages may also be found by search engines.

Exact chosen coordinates are visible to the space’s owner and their invited family caretakers. Visitors see an approximate location, rounded to a fixed grid of 0.1 degrees and the public area label you choose. This is approximate, but can still reveal a general area. Do not use a street address as the public label. Turning sharing off removes public access here, but cannot recall copies someone has already saved.

Memories and approval

Candles appear immediately without an account. Visitor memories wait for the space owner or an invited family caretaker to approve them before appearing to other visitors. The contributor, space owner and invited family caretakers can see written submissions while they await review. Community moderators can review written contributions, hide content and handle reports.

Private letters, dates and family access

Private letters are visible in the app only to the person who writes them. They never appear on public pages or in another person’s account, including a space owner’s or caretaker’s account. They are stored by the service, not end-to-end encrypted. You can edit, download or delete your letters. If a space is removed, your own letters stay in your account until you delete them or your account.

You can save important dates without email reminders. Reminders are off by default and sent yearly only when you choose them. We use your account email, the date, timezone, memorial name and your chosen label to provide them. You can pause one or all reminders in your account, or follow the pause link in an email. Email providers process this information for delivery. Do not include information you would not want shown in an email.

Owners can invite up to five family caretakers using links tied to the invited email address. Caretakers can view a private space, edit its details and review written memories. Owners retain control of sharing, music, invitations and deleting the space, and can remove access at any time. This cannot recall information a caretaker has already saved. Invitation links expire after seven days.

Files and permission

Photo memories have been removed from the site and new photo uploads are not accepted. Previously stored files remain private and can be removed through account deletion. Video memories are private, even when a space is shared. Only the space owner and the person who uploaded them can view them. New video and music-file uploads are paused while file checking is being set up. Existing files stay under the same access rules. Any file awaiting checks cannot be opened. When uploads are enabled, checks must scan and re-encode accepted files and remove embedded location metadata before they can play. Approved music can be heard by visitors when the owner adds it to a shared space. Images, voices or places in the content itself can still identify people. The operator may review reports and remove content. Automated checks cannot guarantee that every harmful file or image will be detected.

Service providers

Supabase provides sign-in. OpenAI Sites and its hosting infrastructure, including Cloudflare, deliver the website and store application records and files. Configured email and file-processing providers handle the relevant data to operate those features. Optional Spotify and SoundCloud music are governed by the provider’s privacy terms. Provider processing may involve countries outside the UK; contact us for information about the applicable arrangements.

Cookies, preferences and music

Sign-in uses authentication cookies. If you light a candle without an account, we save a random visitor cookie for up to one year so you can remove your candle from the same browser. Your optional name and words are visible to anyone who can visit that space. Space owners receive notifications about candles and memories, with read status saved to their account. Your distance preference is stored on your device. We do not add advertising or analytics trackers. Spotify loads only after you allow it and may receive your IP address, browser information and use its own cookies. SoundCloud search, artwork and playback are enabled only after you allow them. Search terms are sent to SoundCloud through SebTrack’s server. Artwork and music load directly from SoundCloud, which receives your IP address and browser information. You do not need to sign in to SoundCloud. We keep a saved song’s details if you choose it for a space, but do not store the audio or your search history. These music choices are remembered on your device. You can withdraw them using “Music privacy settings” at the bottom of any page, which stops optional music. If enabled, Cloudflare Turnstile processes technical information to help prevent automated abuse.

Retention, exports and deletion

Your spaces remain until you delete them or your account, unless they are removed for a policy reason. Download your data or delete your account in My Memorials. Deletion removes your spaces, their memories, your contributions elsewhere, private letters, reminder preferences, family access and files from active storage. Letters written by other people belong to their accounts and are not removed when you delete a space. If a file cannot be removed immediately, we keep trying. Uploads that were never added to a space or memory are cleaned up after one day; processing failures are retained temporarily so you can understand what happened and retry.

We keep a limited record of deleted account and space IDs to prevent a deleted space or account from reappearing. Resolved reports and moderation records are normally removed after 12 months unless needed for an unresolved dispute or legal duty. Short-lived abuse counters expire automatically. Provider security logs and backup copies follow the provider’s retention rules. Copies kept for recovery must be protected and deletion records must be applied before a restore.

Your rights

You can ask for access, correction or deletion, and where applicable restriction, portability or an objection to processing. You may withdraw consent for optional services. Use the privacy contact form. We may need to verify your identity. You can also complain to the Information Commissioner’s Office.