Privacy

Your data, plainly

The short version: we store exactly what a family gives us to keep a flame, a star, or a voice — nothing scraped, nothing inferred, nothing sold. Here's precisely what that means.

What's stored, field by field

A memory flame: the name(s) you give (Hebrew and/or English), your relationship to them ("father," "daughter," in your own words), an optional one-line memory (140 characters or fewer), your email, and the date of death — converted to and stored as a Hebrew calendar date (the original Gregorian date you typed is kept alongside it for your own reference). If you dedicate the flame, a dedication line is stored too.

A simcha star: the honoree's name, the occasion (a birth, a bar/bat mitzvah, a wedding, and so on), an optional dedication line, and — if it's a gift — the recipient's email so we know where to send the reveal.

A voice (Act IV, "Voices"): the audio recording itself, whose voice/story it is, the question that was asked, who recorded it, and your explicit confirmation that the person being recorded knows and agrees. No interview "session" state is kept beyond the recording itself.

Tending a flame or inviting a keeper: the email and message you provide for that action.

Where it lives

Text and metadata are stored in Cloudflare D1; voice recordings are stored as audio files in Cloudflare R2. Both live in a single Cloudflare account under US jurisdiction, encrypted at rest by Cloudflare's platform-level encryption. We don't run our own servers and don't replicate your data anywhere else.

Who can see what

Every flame and star has a privacy choice, made by the family, one light at a time:

• Public field (the default): a given name and last initial, visible to anyone in the sky.
• Full name: the family can choose to show a complete name instead of the initial.
• Fully private: the flame still counts in the nightly total (so the sky's numbers stay honest) but is never listed, searchable, or shown by name to anyone browsing.

Voices default to keepers-only — visible only to people the family has invited as keepers of that flame — and can be switched to public only by an explicit, one-at-a-time choice; the default never flips the other way automatically. Any voice can be permanently deleted by the family that recorded it, any time, from their family voice shelf — deletion removes both the audio file and its record, not a soft-delete flag.

How your email is used

Your email is used only for what you asked it to do: the one reminder before a flame's yahrzeit (VALUES.md's single permitted push — never a streak, never a guilt notification), keeper invitations you send or receive, confirmations for tending/reports/purchases, and — only if you separately opt in on the wave page — the weekly Shabbat wave email, which is its own opt-in and completely independent of any yahrzeit reminder. Never marketing. Never sold. Never shared with advertisers.

Want a flame or star removed?

Use the "Request this be removed" button on the flame or star's own page — it reaches our team directly through the same pipeline as a report, and holds the light out of the public sky immediately while a person handles it, usually within a day.

What we never do

We never scrape or import names from any list. We never sell or share your data with advertisers.

Moderation

All public text is checked by an automated filter before it appears. Anything flagged is held for a person to review before it's shown. Every flame has a report link; a report also holds the flame for review.

Rate limiting

To keep the sky safe from abuse, we limit how many flames, tendings, and reports can come from the same connection in a day. This is about protecting the space, not about tracking you — we don't use the data for anything else.

Payments

Dedications and keepsakes are processed by Stripe. We never see or store your card details.

Questions or a takedown request

Use the "Request this be removed" button on the flame or star itself, or the report link on any flame — both reach our team directly.