Privacy Policy

Template — review before launch; not legal advice.

Last updated: September 28, 2026. This policy takes effect when payments open; the parts about the waitlist, the site and the editor apply now.

In short

Your photos never leave your device. We never see them.
If you join the waitlist, we keep your email and anything you choose to type, only to tell you when payments open.
We count a few anonymous events (like “a guide was viewed”) with no cookies and no identifier, and we don’t store your IP address with them.
The optional writing helper sends the facts you type (never photos) to Anthropic, which may keep them for up to 30 days. We don’t sell anything to anyone.

Candlefold (“we”, “us”) is run by [LEGAL NAME], a sole proprietorship based in [STATE], with a mailing address at [MAILING ADDRESS]. This page explains what we collect, what we don’t, and why. If you have questions or want to exercise any of the rights below, email help@candlefold.com.

Your photos stay on your device

Candlefold builds your funeral program, slideshow and prayer cards inside your web browser. In the current version, the photos you add are not uploaded to us or to anyone else — we never see them. Your project (form answers, photo files, and any music you add) is kept in your browser’s own storage (IndexedDB) on your device, until you delete it, clear your browser’s site data, or your browser clears it on its own (some browsers, like Safari, can clear storage after long periods of inactivity).

Keep your own copies: because your work lives only in this browser on this device, save the finished PDFs and video to your phone, Google Drive or iCloud after you download them.
If we ever add a way for other family members to send you photos (for example, a link you share with siblings so they can contribute pictures), we will update this policy first and explain exactly what that feature can and can’t see before it goes live.

What we do collect

Because there are no accounts, we collect very little:

Order records. When you pay, we keep a record tied to your order (an order/session identifier, the amount paid, the date, and status such as paid or refunded) so we can process refunds, respond to support requests, and meet our accounting and tax obligations. We keep these records for as long as the law requires (typically several years for tax purposes).
Payment information. Handled entirely by Stripe (see below) — we never see or store your full card number.
Basic technical data. Our host, Cloudflare, processes standard technical data (like IP address and browser type) to deliver and protect the site, the same as any website.
Support emails. If you email us, we keep that email and our reply like any small business would.
The waitlist (now, before payments open). If you ask us to tell you when payments open, we keep your email address and anything you choose to type in the optional questions (for example, what the program is for), the page language, which page or link you came from (such as “home” or a guide’s name), your country as reported by our host, and the date. We use it only to send that one message and to improve Candlefold, and we delete it after launch unless you buy. The signup is stored in our Cloudflare account or in a Google Form that only we can see, depending on how the waitlist is set up at the time.
Anonymous usage counts. To see which pages help families and where the editor is confusing, the site sends a short note to our own server when certain things happen: a page or guide is viewed, a “make the program” button is clicked (and which one), the language is switched, and the editor reaches a step (for example the preview). Each note holds only the event name, the page, the language, a short source label (like “google” if you arrived from an ad or search link that says so) and, for the editor, the chosen tradition. There is no cookie, no identifier, and no IP address or browser details stored with it, so the notes can’t be joined into a visit history or tied to you. The source label is kept in your browser tab’s session storage until you close the tab.

We do not collect names, dates, photos, or other details about the person you’re memorializing, except for the small amount that appears in an order record (see above) or that you choose to send us in a support email.

The optional AI obituary helper

If you use the obituary-writing helper, only the facts you type — never your photos — are sent to our AI provider, Anthropic, through our own server, so that it can draft obituary text for you. We do not store what you type or the drafts it returns; they pass through and are shown to you, and then it’s up to you to edit and use them.

As of [DATE THIS WAS LAST CHECKED], Anthropic’s published terms state that, by default, it does not use data submitted through its commercial API (which is what powers this feature) to train its models, and that API inputs and outputs are automatically deleted from its systems within 30 days, except where it must keep something longer for legal, safety, or abuse-prevention reasons. This is Anthropic’s policy, not ours, and it can change — see Anthropic’s Privacy Center and Commercial Terms of Service for their current wording. We will re-check and update this section if we notice Anthropic has changed its terms.

Music and text you add

If you upload your own song or paste in your own text (a poem, a favorite saying), that file or text is used and mixed on your device, the same as your photos — it is not uploaded to us in the current version. You’re responsible for having the right to use anything you add; see our terms of service.

Payments (Stripe)

Payments are handled by Stripe. Stripe collects your payment details and email address to process the payment and send your receipt. We can see the email address, amount, date, country, and the last four digits of the card in our Stripe account, and we keep these records as required for accounting and tax purposes. See Stripe’s privacy policy.

Hosting (Cloudflare), fonts and analytics

The website is hosted on Cloudflare, which processes standard technical data (like IP address and browser type) to deliver and protect the site. See Cloudflare’s privacy policy.

Our pages load nothing from other companies’ servers: the fonts, images and scripts all come from our own site, so no font service or tag manager sees your visit.

We don’t use cookies, Cloudflare Web Analytics, Google Analytics, advertising pixels or any analytics tool that identifies you personally. The only counting we do is the anonymous usage counts described above. There is no cookie banner because there’s nothing here that needs your consent under cookie laws.

No accounts, no advertising

Candlefold has no user accounts and no login. We don’t run advertising on the site, and we don’t sell, rent, or share your personal information with advertisers.

We share information only with the service providers named on this page (Stripe for payments, Cloudflare for hosting and waitlist storage, Google Forms if the waitlist is set up that way, and Anthropic for the optional obituary helper, as described above), or when the law requires it. We don’t sell your personal information.

Children’s privacy

Candlefold is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at help@candlefold.com and we will delete it.

California residents (CCPA/CPRA)

California’s privacy law (the CCPA, as amended by the CPRA) applies in full only to businesses that meet certain size thresholds — for example, more than $26,625,000 in annual gross revenue, or buying/selling/sharing the personal information of 100,000 or more California consumers or households a year. Candlefold, as a small, single-owner business, does not meet these thresholds. Even so, we aim to follow the spirit of the law: we collect the minimum information described above, we don’t sell your personal information, and you can contact us at help@candlefold.com to ask what we hold about you or to request deletion, and we’ll do our best to help.

Canadian residents (PIPEDA)

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) applies to us regardless of our size, because we collect personal information from Canadian customers for commercial purposes. In plain terms:

What we collect and why: see “What we do collect” above — mainly order records needed to process your payment, handle refunds, and meet legal obligations.
Where it comes from: directly from you (through checkout) and from Stripe.
Whether it’s shared: only with the service providers named on this page, or as the law requires.
Who’s accountable: [LEGAL NAME] is the person accountable for privacy at Candlefold. Contact: help@candlefold.com.

Where we sell, and why not Quebec (yet)

Candlefold is available to customers in the United States and Canada, except Quebec, at launch. Quebec’s Charter of the French Language (as amended by Bill 96) generally requires that consumer-facing contracts, terms of sale, and related commercial content be available in French for people doing business in Quebec. Building and maintaining a compliant French version of the site is more than we can do at launch, so we’ve excluded Quebec for now rather than offer a product that doesn’t meet that requirement. We hope to add Quebec later — see contact if you’d like to be notified.

Security

We use standard safeguards (like HTTPS) to protect the small amount of data we do handle, and we rely on Stripe’s and Cloudflare’s own security programs for what they process. No method of transmission or storage is 100% secure, and we can’t guarantee absolute security.

Your choices and rights

To ask what information we hold about you, to correct it, or to have it deleted where the law allows, email help@candlefold.com. Because we don’t have accounts, most of what we can look up is tied to your order/session ID or the email address you paid with.

Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version.

Contact

Questions about privacy: help@candlefold.com.