Privacy notice
How EverRemember handles personal information. Last updated 30 October 2026.
In short: memorials are private by default. Nothing a guest sends appears anywhere until the family has seen it and approved it. A message sent privately stays private, even if the memorial is later made public.
Who is responsible
The family or administrator who creates a memorial decides what is collected and what is shared. EverRemember provides the platform and stores the information on their behalf. For a specific memorial, contact the family member who invited you.
What is collected
- From account holders: name, email address, and a securely hashed password.
- From guests: whatever you choose to send — a message, your name or an anonymous marker, optionally your relationship to the person and your email address, and any photographs.
- Automatically: an irreversible hash of your IP address, used only for rate limiting and abuse reports. The address itself is not stored.
Lawful basis
Account information is processed to perform the agreement to provide the service. Guest contributions are processed on the basis of the consent you give when you submit them, and the family's legitimate interest in keeping a record of condolences. You may withdraw consent at any time by contacting the family or the platform administrator.
Photographs and people who are living
Photographs often show people other than the person being remembered, including children. Please only send photographs you are comfortable for the family to keep and show. Location data is removed from every copy shown on screen. If a photograph of you or your child appears and you would like it taken down, contact the family or the platform administrator and it will be removed.
How information is shared
- Family members and administrators of that memorial can see everything submitted to it.
- A message or photograph becomes publicly visible only when you allowed it, a moderator approved it, and the family published it.
- Private photographs are never placed in a publicly readable folder. Every request passes an authorisation check first.
- Information is not sold, and is not used for advertising.
How long it is kept
A memorial is kept until the family archives or deletes it, or asks for it to be removed. A family may set a retention period. When a memorial is deleted, its records and media files are removed from the live system; copies may remain in encrypted backups for a limited period before those backups expire.
Your rights
Under UK GDPR you may ask for a copy of your information, ask for it to be corrected or erased, object to processing, or complain to the Information Commissioner's Office. To exercise these rights, contact the family administering the memorial or the platform administrator.
Security
Connections use HTTPS. Passwords are hashed. Access links are high-entropy, stored hashed, and can be revoked at any time, which takes effect immediately. Moderation decisions and access changes are recorded in an audit log.