The privacy page

What we keep

The account: the email address you leave at the gatehouse (the address is the credential — sign-in is a single-use letter, no passwords), the profile you choose to write, and a session record in our ledger. The graves: the obituaries, images and dates you inter — public by design. The casket: stored as received, never unpacked, never read; we keep only its own filename, size and fingerprint. At rest, a second seal of ours rides yours; we still cannot read your contents.

The custody record

Every custody event is recorded — in both directions: each upload, replace, remove and download of a casket lands in an append-only ledger with its timestamp and the acting IP address, and each exhumation is confirmed from your mailbox and notified back to it. We keep this record to prevent abuse of the vault (an encrypted store with a download door could otherwise be used as an anonymous drop box) and to give you an honest account of your own casket's story — that abuse-prevention purpose is its lawful basis, and the record outlives the casket it describes.

The pre-publication machine check

At interment (and at every later edit of obituary content, when editing exists), the grave's title, obituary text and links are read once by a machine check before publishing — processed for this purpose by Anthropic (the Claude API) as a third-party processor. The check sees the obituary's text, never your account details and never any casket. Its verdict (and rationale, if flagged) is recorded; a flagged or uncheckable interment waits unpublished for a human. Caskets and images are never sent to the check — images are re-encoded at most, never content-read.

Reports and moderation

A report filed through the report door is kept whole — the content named, the ground, your contact address, the time, and the filing IP address — so the review can be honest and frivolous reporting can be seen. Moderation acts (holds, freezes, restores, declines, and whether an owner notice was sent) are recorded append-only. Nothing is deleted as a moderation act.

The mail practice

Transactional letters (sign-in, exhumations, notices) go to your account address through our mail relay (MailerSend) as a processor. The announcement list is separate, opt-in, and keeps its own consent records — the practice already run for mail: when you subscribe, the consent (address, time, source) is recorded, and unsubscribing is one click. The list itself runs on the list instance at mailorum.com: a sign-up lands there, and the list's confirmation page and letters come from there. Its letters leave through MailerSend too, and MailerSend reports bounces and spam complaints back to the list, which records them against the address. We never sell or share addresses beyond these processors.

Where it rests, and who carries it

The site and its ledger run on a server we rent from Hetzner, which hosts it as a processor; the list instance at mailorum.com runs on a second Hetzner server. The domain's name records (DNS) and the inbound mailboxes at projects.rip (care@ and rip@) are kept by GreenGeeks as a processor: a letter you write to us rests there.

Cookies

One session cookie, first-party, httpOnly — the key to your own plot. No analytics cookies, no trackers, no third-party embeds.

Retention, and leaving

Accounts, graves and caskets rest until you leave or remove them. Custody, consent and moderation records are retained on the consent-record pattern: kept as records of what happened, even after the thing they describe is gone. Write to care@projects.rip to leave — we release your account and everything it tends — or to ask for a copy of what stands under your address.