This is short because the system is small. There is no account and no login. Until you pay, nothing you type is written down anywhere but your own browser.
Funeral Suite is run by Northpine Labs LLC, 1021 E Lincolnway #10201, Cheyenne, WY 82001, United States, which is responsible for everything described on this page.
What stays on your device
- Every answer you type is stored in your browser's local storage, on the device you typed it on.
- Every photograph is stored in your browser's IndexedDB, on the same device. The slideshow is assembled and recorded by your own browser, which is why the video takes as long to save as it does to watch. A photograph is sent to us only when you press Improve on it — see below.
- The finished writing is stored the same way, alongside your answers.
Clearing your browsing data for this site deletes all of it, permanently. Save the files you need before you clear anything.
Improving a photograph
If you press Improve on a photograph, that one image is sent to us and passed straight to the image model that does the work — Replicate, running Google's Gemini image model on our behalf, or Google directly — which repairs and retouches it and sends it back. We do not write it to disk, and we keep no copy once the reply has been sent. What you asked to have changed is your choice, from repair only up to a full retouch, and the original is kept in your browser so you can undo it at any point.
Photographs you do not press Improve on are never sent anywhere.
What is sent to us, and for how long
When you ask for a preview, and again after you pay, your typed answers are sent to our server so the writing can be produced. They are passed to Anthropic's API, which performs the writing and, under its commercial terms, does not use the content to train models. For the preview, that is the whole of it: the answers exist in memory for the length of the request — seconds — and are not written down. Photographs are not part of it.
After you pay, we keep a copy
Once a payment goes through we save the order — your answers, the finished writing and the photographs you added — so that you can open it again on another phone or laptop, or after this browser has been cleared. Without that, a cleared browser would be the end of it, and families were losing work that way.
- You get a link on the finished page. That link is the key: there is no account and no password, so anyone you send it to can open the order. Send it only to your own family.
- It is deleted automatically one year after the payment. Holding a family's photographs longer than that is a liability, not a service.
- You can delete it yourself at any time — Delete the copy we hold, on the same page as the link. That removes it immediately and completely; your own browser keeps its copy either way.
- We do not store the payment reference next to it. Your name and your relationship to the person, as you gave them in the interview, are part of the saved order; nothing else about you is.
Payment
Payment is handled entirely by Stripe on Stripe's own pages. We never see or hold your card details. We receive a payment reference, which is how the site knows to unlock. Nothing about the person you are writing about is sent to Stripe.
Counting, and what we deliberately do not count
We use PostHog, an analytics service run by PostHog Inc. on servers in the United States, to see how people find this site and where they stop. Your browser keeps a random identifier for it in local storage — not a cookie — so that one visit can be told from another. PostHog receives the address of each page you open, the site that sent you here and any ad-campaign tags in that link, your browser and kind of device, and the steps described below. Like any server your browser talks to, it sees your network address, and uses it to estimate a rough location. It never receives anything you type or anything written for you: no answer, no name, no photograph, no line of the writing. The link that opens a paid order, and the payment reference, are removed from every address before it is sent. We never tell PostHog who you are.
There is no session recording, no heat map, no record of what you click, and no advertising or remarketing pixel on any page. To stop abuse, our own server keeps a short-lived hash of your network address, made with a key that exists only in memory and is replaced every time the server restarts. It is dropped about an hour after your last request, never written to disk, and cannot be turned back into the address.
We also keep a tally of our own. When a page or a step is reached, the server adds one to a counter — “somebody reached question seven”, “somebody read their obituary”. That is the entire contents of the message: a step name and, at most, a number for which step and how long the writing took. No identifier is generated, none is stored, and your address and browser are not recorded with it, so the tallies cannot be assembled back into a person or a visit. The same step names go to PostHog. We use both for one thing: seeing where people give up — which page, which question — so that it can be fixed.
The site is delivered through Cloudflare, which carries every request between your browser and our server. Cloudflare adds two small scripts of its own to each page: Cloudflare Web Analytics, which reports page loads and loading times to Cloudflare without setting a cookie, and one that decodes our email address on the page so that spam robots cannot collect it.
The only other third-party script on the site is a Google Ads conversion tag on the confirmation page after a successful payment, recording that a purchase occurred. When ad tracking is switched on, that page sets a Google Ads conversion cookie and sends Google the payment reference — no name, and nothing about the person. It is not present on any other page, and it does not follow you.
You are never asked for an email address to use this site, and there is no account to create.
On the preview page there is a button that sends you your own short obituary. If you press it, your address and that piece of text go to our mail provider so the message can be sent, along with one follow-up scheduled six hours later saying the rest is still waiting. Both messages are handed over at that moment and we keep no copy of your address afterwards — there is no list here, because there is no database to hold one. If you would rather not, the Copy button beside it puts the same text on your clipboard and involves nobody.
If you pay, the address you gave is passed to Stripe so your receipt reaches you. We also send the link to your order once, to the address you gave at checkout: without it the link lives only in this browser, and some browsers clear a site's storage after a week without a visit. The address is read from Stripe for that one message; it is not saved with the order and is used for nothing else.
If you write to us, we have your email and whatever you put in it, in an ordinary mailbox, until we delete it.
Children
This is a service for adults arranging a funeral. It is not directed at children.
Your rights
If you are in California, the EU or the UK, the rights you have — access, deletion, portability — apply to data a business holds. Until you pay, we hold nothing but the anonymous visit record described under Counting, which carries no name: everything you type is on your device and under your control. After payment, a copy of the order — your answers, the finished writing and your photographs — is kept on our server for up to a year so the link can be reopened. You can delete it at any time from the suite page, and it is removed automatically after that year. If you believe we hold something else, write to [email protected] and we will find out and tell you.
Changes
If this ever changes, the date at the top changes with it. Nothing here can be applied retroactively to data we never collected.