Privacy policy

1. Scope and controller

This policy applies to the Forever mobile application, its APIs, and the Forever privacy and account-deletion pages. Velar Studio is the controller of personal information processed through Forever.

Memorials may include information about people who have died. Privacy laws generally protect living people, but we apply the same careful access controls to memorial content and ask families to respect the privacy and rights of everyone shown or mentioned.

2. Information we collect

Information you provide

• Account information: name, email address, password hash, account role, display preferences, and account recovery information.
• Memorial and family information: names, dates, relationships, biographies, epitaphs, resting places, timeline events, privacy settings, invitations, membership roles, and family review decisions.
• User content: photos, videos, tributes, reports, moderation notes, hearts, candles, flowers, and related file metadata.
• Reminder information: occasions, dates, optional times, notification settings, and delivery status.
• Support and deletion information: information submitted in privacy inquiries and account-deletion requests.

Information collected automatically

• Session identifiers, authentication events, request identifiers, IP address, user agent, request path, response status, and timing used to operate and secure the service.
• Push-notification token, platform, app version, build version, device name, locale, operating-system name, and version when you enable notifications.
• Storage usage, plan selection, and store transaction or receipt identifiers. Apple or Google processes payment-card details; we do not receive your full card number.

Device permissions

Forever requests access to your camera, photo library, and microphone only when you choose features that need them, such as selecting or recording a photo or video. Selected media is uploaded to Forever; the app does not continuously access these permissions. Notification permission is optional and can be changed in device settings.

Forever does not use third-party advertising trackers, does not collect precise location, and does not sell personal information or share it for cross-context behavioral advertising.

3. How we use information

We use information to:

• create and secure accounts and restore authenticated sessions;
• create, store, display, share, and moderate private memorials;
• process family invitations, access roles, and review requests;
• store and deliver media and keep storage usage accurate;
• send password-reset emails and requested reminder notifications;
• process plan or access-pass transactions through an app store;
• prevent abuse, investigate reports, troubleshoot, and protect the service;
• respond to support, privacy, and deletion requests; and
• comply with legal obligations and enforce our agreements.

Depending on where you live, our legal bases include performing our contract with you, your consent, compliance with law, and our legitimate interests in operating, securing, and improving Forever without overriding your rights.

4. How information is shared

We disclose information only as needed in these circumstances:

• With your family group: people with access to a memorial can see content according to the memorial privacy and membership role chosen by the owner or family administrator.
• With service providers: infrastructure and storage providers such as MongoDB and Amazon Web Services; email delivery through Brevo; notifications through Expo and the Apple and Google notification services; app distribution, sign-in, and payments through Apple or Google; and compliance-site hosting through Vercel. They process information for us under their own security and data-protection commitments.
• For legal and safety reasons: when reasonably necessary to comply with law, protect a person, investigate fraud or abuse, or establish and defend legal claims.
• Business changes: as part of a merger, acquisition, financing, or sale, subject to appropriate confidentiality and notice where required.
• At your direction: when you ask us to share information or give consent for a specific disclosure.

Providers may process information in countries other than your own. Where required, we use contractual and other safeguards for these transfers.

5. Retention and deletion

We retain account and memorial information while your account is active and for as long as needed to provide Forever. Security logs, transaction records, reports, and support records are kept only as long as reasonably necessary for security, fraud prevention, accounting, dispute resolution, and legal compliance. Backup copies are removed through normal backup-rotation schedules.

You can request deletion through Forever or the public account-deletion page. We verify requests to protect accounts from unauthorized deletion. Once an account deletion is approved, Forever deletes the account and data associated with it, including owned memorials and their stored media, the account holder's uploads and contributions to shared memorials, memberships, reminders, notification tokens, sessions, and plan records. Deletion cannot be undone.

We may retain a minimal record of the request and information that law requires us to keep. Information may also remain briefly in encrypted backups until those backups rotate out and will not be restored except for disaster recovery.

6. Security

We use access controls, authentication, encryption in transit, private media storage, short-lived signed media links, role-based permissions, and operational monitoring designed to protect information. No service can guarantee absolute security. Please use a strong, unique password and contact us if you believe your account has been compromised.

7. Your privacy rights

Depending on your location, you may have rights to be informed, access your information, correct it, object to or restrict certain processing, withdraw consent, receive portable data, request deletion or blocking, and complain to a privacy regulator. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

California residents may request to know, correct, or delete covered personal information. Forever does not sell personal information or share it for cross-context behavioral advertising. Philippine data subjects may exercise the rights recognized by the Data Privacy Act of 2012, including access, correction, objection, erasure or blocking, portability, and complaint. EEA and UK users may also complain to their local supervisory authority.

To exercise a right, email us or use the deletion page. We may need to verify your identity and authority before acting. You may use an authorized representative where applicable.

8. Children

Forever is not directed to children under 13, and we do not knowingly collect personal information from a child under the minimum age required by local law without valid parental consent. Contact us if you believe a child has provided information improperly.

9. Changes to this policy

We may update this policy as Forever or applicable law changes. We will post the revised policy with a new effective date and provide additional notice when a material change requires it.

10. Contact us

Velar Studio
Email: velarstudio0828@gmail.com

Please include “Privacy request” in the subject line and identify the Forever account email involved. Do not send passwords or payment card information.