Privacy

Last updated October 8, 2026

Still Alight is a small service run under its own name. This page says plainly what we collect and what happens to it.

What we collect

• The names and words you type. A candle’s page and its memorial show the name it was lit for, who lit it, the names of the people who joined, and any words left there. Candle pages and memorials are public to anyone who has the link — please don’t write anything you wouldn’t want seen there. Words left beside a candle, and words family and friends add to a memorial’s book, are checked automatically: the words, with the name the candle was lit for, go to Anthropic’s AI model, which says only whether they read as remembrance. Whatever it doubts, or cannot check, comes to us to look at; nothing is taken down because of the check unless one of us decides to. The picture a messaging app shows for a candle’s link carries the name it was lit for and, once they have been checked, the newest words left beside it; a memorial’s picture carries no words.
• A memorial you are still building. Before you make a candle a memorial, what you choose and put in it — its place, what stands there, photos and words for its book — stays in that browser tab, on your device. None of it is saved by us until you make it a memorial, and your photos and words never leave your device before then; our page measurement (below) notes only the steps, such as which place you chose and how many photos you added. If you close the tab first, it is gone. When you do make it a memorial, it is saved as described here, and the copy on your device is deleted.
• Photos put on a memorial. The person who made the memorial, and people who joined it, can add photos. Before a photo is kept we make a new copy of it, at most 1600 pixels, with everything but the picture removed: where it was taken, when, and on what phone or camera. Only that copy is kept, with our database provider, and anyone with the memorial’s link can see it while the memorial is open. Photos never appear in link previews and are never sent to an image-making service. We may look at a photo a guest adds, to keep memorials safe. The person who added a photo, or the memorial’s owner, can take it off, and it is deleted; photos are also deleted with their candle.
• The vigil, only if you say so. The vigil shows the candles burning at this moment. A flame appears there only if the person who lit it ticked the box on its page; we are told, and its name appears within about 15 minutes unless we hold it back. It shows the first name and candle color — and, when someone joins it, that someone came and how long ago — no surname, no link back to the flame, never the name of whoever lit it or of whoever came, and never anything about money. It is not indexed by search engines. Untick the box and it is gone from that page on the next load; write to us and we will remove it ourselves.
• An anonymous device identifier stored in your browser, so joining a memorial counts once per person, and so the candle you light, its memorial, and anything you add to one know they are yours. It is a random string; it is not your name, email, or anything about you. We keep only a scrambled form of it with what it made, except for the encrypted copy an account keeps (below), and except when this browser pays: the identifier then goes to Stripe with the checkout, so the payment is applied as yours. Stripe keeps it with the payment, and we keep it for up to two days while the checkout can be retried.
• How the pages are used. Which pages are opened, what is tapped, and a replay of the screen as you move through it — so we can see where the site confuses people and fix it. Anything typed into a box is hidden from those replays before they leave your device, including the name you type. We use PostHog for this on our pages, and we do not sell it or use it to advertise to you. Some older candle pages, and the billing, checkout return, account, sign-in and Vigil pages, do not load our analytics or advertising tags.
• Whether an ad brought you here. We advertise on Facebook, Instagram and Google. Their tags — Meta’s pixel and Google’s tag — run on most pages of this site, candle and memorial pages included. Like any page’s tags, they receive the address and title of the page they run on, and a candle’s or a memorial’s address and title contain the name it was lit for. We tell them when a candle is lit or a memorial paid for, and Meta also when someone joins or shares a candle, opens a checkout (with the amount), or starts or finishes signing in. When a memorial is paid for, we also tell Meta from our server: the amount, a scrambled form of the email address given at checkout, and the candle’s address. When a candle lit after a Facebook or Instagram ad is joined by someone else, we tell Meta that too, from our server: the click identifiers that visit carried (kept with the candle for this), the candle’s address, and how many people have joined. The payment that keeps your own memorial for good instead of its plan is never reported to advertising platforms. Nothing from those older candle pages — their events, names or words — is sent to advertising platforms. Your browser’s tracking protection or an ad blocker stops the tags, and nothing on this site stops working; it does not stop the two reports we send Meta from our server.
• Card details go to Stripe, not us. We never see or store card numbers. Stripe — through its Link service, the merchant of record for our payments (see the Terms) — collects what it needs to take a payment and the tax on it, such as your billing address, and keeps it under its own privacy policy. Stripe passes us the email address given at checkout — and, for a payment made once, the name — and we keep them with Stripe’s reference for the payment or the customer, so we can send the receipt and the notes that follow a payment (a refund, a declined payment, a plan about to renew, a plan ended because you kept the memorial for good), so a plan can still be found and stopped by someone whose phone has forgotten this site, and so we can send the notice the Terms promise if Still Alight ever has to close. For what is paid once — a memorial kept for good — we also keep a record of the payment: the amount, the candle it was for, the payer’s name and email address, a scrambled form of the paying device’s identifier, and anything refunded, so it can be refunded when that is due. Refunds go back to the card or other payment method that paid, through Stripe. We keep these records as our record of the sale, also after a memorial is taken down. For 30 days paid once, the record is Stripe’s reference for the payment, the candle it was for, the time it bought, and the payer’s name and email address. With each checkout we send Stripe what it needs to apply the payment — the candle’s name and address, the name signed, this browser’s device identifier (above) and, if you are signed in, your account’s reference — and how the checkout was reached, for our own measurement.
• An address given for “tell me when this flame rests”. Candles no longer rest, so that message is no longer sent. An address given for it stays against that one candle and is used for nothing else — not for this change, not for a list, not for a newsletter — and is never given to anyone. The link in any such message we sent deletes it at once, and so does writing to us.
• Server logs (IP address, time, page, and — when something needs our attention — what is needed to deal with it, such as the address and subject of an email we sent, or a candle’s address) kept briefly, for keeping the service running and preventing abuse. When a candle is lit we also keep with it a scrambled form of the IP address it was lit from, so a second candle for the same name from the same connection can be noticed and one connection cannot light candles without limit; a scrambled address is also kept for a day or two to limit how often one connection can join, add to a memorial, pay, or ask for a sign-in code.
• Email you send us at support@stillalight.com — kept in our database and copied to our Telegram (below), so we can answer.

If any of this changes, this page changes first.

Accounts

Lighting a candle, visiting one and joining a memorial never need an account. The person who makes a memorial can sign in, so that the memorial stays theirs on any phone or computer. You sign in with a code we email you or, where offered, with Facebook or Google. Signing in keeps:

• Your email address, if you sign in with a code we email you (or, with Google, the address Google confirms is yours). A code works for ten minutes, once; we keep only a scrambled form of it and of the address it went to.
• From Facebook or Google, only if you sign in with them: the number they give us for you, your name and your email address — nothing else. We never see your friends, we never post anything, and nothing kept with your account is used for advertising.
• An encrypted copy of the device identifier that made or pays for each memorial you choose to keep, so the memorial can be opened when you sign in somewhere else. A memorial is kept only when you ask: when you make it signed in, or when you choose to keep it — signing in on a phone never quietly takes the memorials that phone made. It is locked with a key that is not kept in the database, and it is given back only to a device you are signed in on, when you open one of your memorials. One device identifier belongs to every candle made on the same phone, so the copy given back could open those too: keep your sign-in to yourself, as you would the phone.
• Where you are signed in: for each sign-in, a scrambled form of its cookie, how you signed in, when it started and was last used, and the kind of browser (for example “Safari”) — not the browser’s full details. A sign-in lasts 180 days, or until you sign out; its record is removed at your next sign-in once it has been over for 30 days, and with your account.
• Which first-time tips you have seen — the tips’ own short labels (such as “owner.plan”), never a memorial’s name or anything you typed, and when each was first shown — so a new phone or computer does not show them again.

We use your account only to keep your memorials yours, to remember those tips, to send you sign-in codes, to find a plan paid with the same email address so you can manage it, and to tell you if Still Alight ever has to close — no newsletters, and it is never sold or shared. Signing in is also how a plan can be managed or canceled from any device you sign in on.

Who processes it

The service runs on Stripe (payments and refunds), Supabase (database), Vercel (hosting), Resend (email we send and receive, including sign-in codes), PostHog (how the pages are used) and Anthropic (the automatic check of words, above). We send ourselves short notices on Telegram, a messaging service: that a payment arrived, with the payer’s name or email and the memorial it was for; that a guest added a photo we may look at — a link, never the photo — with the name they signed and the memorial it is on; words the automatic check doubts or cannot check, with the name signed beside them and the name the candle was lit for; a candle’s name when it is put on the Vigil, with who lit it and the newest words left beside it; an email of ours that bounced or was marked as spam, with its address and subject; each email sent to support@stillalight.com, with the sender’s address and what it says; and, when something about a payment or a memorial needs putting right, what is needed to do it. If you choose to sign in with Facebook or Google, Meta or Google confirms who you are and tells us only what is listed under Accounts; if you don’t, they learn nothing about your account. Meta and Google receive only the advertising measurement described above; nothing kept with your account is sent to them. Each receives only what its job requires.

Cookies and device storage

• In your browser’s storage: the device identifier (sa_keeper_key); the candles this browser lit, joined or pays for, so “Your candles” can find them (sa_my_flames, sa_joined_flames, sa_my_subscriptions); and small reminders: the name you sign with (sa_offer_from, sa_note_…), whether you asked to be told when a flame rests (sa_notice_…), the plan you chose while signing in (sa_signin_resume, used for half an hour), the memorials you chose not to keep in your account for now (sa_account_not_now, this tab only), and, if you came from one of our ad tests, which version of the page you saw (sa_acquisition_v1, for a week). They are kept on your device — the identifier reaches us only to recognize what is yours or to apply a payment (above); clearing your browser’s site data removes them.
• While you build a memorial: what you have built so far (sa_draft:…) and which tab it belongs to (sa_tab), kept in that tab only, and its photos, in your browser’s own database (sa-draft) under that tab. They stay on your device until you make it a memorial, and are deleted once you have. If you close the tab first, what you built goes with it, and its photos are deleted the next time you build a memorial in this browser, or when you clear this site’s data.
• The first-time tips: sa_device, another random string that only decides, on this device, whether it is shown the tips — a few devices are not, so we can tell whether the tips help; the string itself never leaves your device, and whether this device was shown the tips is counted with the page measurement (PostHog) — and sa_guide, which tips this browser has seen and each memorial’s getting-started list here.
• While you are signed in: one cookie, sa_account, readable only by our server, that says which sign-in this is; and, for a memorial you opened from your account, its device identifier, kept only in this tab and removed when you sign out or close it.
• While signing in: one short-lived cookie that ties the link in our sign-in email — or, where offered, Facebook’s or Google’s answer — to this browser, so it cannot sign in anyone else’s. It is removed once you are signed in, and after fifteen minutes at most.
• While paying: the checkout you opened, kept in this tab for up to two days, so trying again never opens a second payment.
• Measurement and advertising: PostHog, and the Facebook and Google tags described above, set their own cookies on the pages that load them.

Deleting your account

Sign in, open Your memorials, and choose “Delete my account”. It deletes at once the email address your account kept, your Facebook or Google details, every sign-in, the encrypted copies it kept and the tips it remembered, and gives you a confirmation code. What we keep with a payment (above), and Stripe’s own records, stay as our record of the sale. If you signed in with Facebook, removing Still Alight from your Facebook settings and asking Facebook to delete your data does the same; if you also sign in another way, it removes only your Facebook details and ends the sign-ins made with Facebook, and the account — with the name Facebook gave it — stays until you delete it. Your memorials are not deleted with your account: they belong to your family, and they still open on the devices that made them. Deleting your account cancels nothing either: a memorial’s plan keeps renewing until it is canceled. Choose “Manage billing” before you delete, or afterwards “Manage subscription” on the candle’s page, on the device that paid, or “Recover billing access” there, or write to us. To have a memorial itself taken down, see Removal below, or write to support@stillalight.com.

Removal

Candles persist, and stay alight. If you want a name, a word, a photo, or a whole candle taken down — yours or one lit about someone you have a right to speak for — write to support@stillalight.com and we will remove it.

Children

Still Alight is not directed at children under 13, and we don’t knowingly collect their information.

Changes

If this policy changes, the date above changes with it. Material changes will be noted on this page.