Privacy Policy

Last updated 23 September 2026

Once Spoken is a small independent project run by one person. This page explains, in plain English, what information it holds, why it holds it, and what you can ask us to do about it.

The short version

• We collect what we need to receive a memorial, check it, publish it and answer your messages. Nothing more.
• We do not sell your personal information, and we do not share it for anyone else’s marketing.
• We use our own limited analytics to count which pages and memorials are viewed, how people arrived, whether a memorial has been shared, and whether somebody who followed a shared link saw or started the memorial invitation, opened the form, then lit a candle, sent in a memorial, contributed or shared one themselves. We count which stages of the optional voice-clip journey are reached, and whether somebody who hears a clip follows the quiet invitation to preserve another voice. We also count that somebody passed Once Spoken itself on from the page that invites them to, which records no memorial and no person. There is no Google Analytics, no Meta Pixel and no advertising tracker. Ordinary site analytics stores no identifier on your device; the separate, tab-only record used when you deliberately follow an approved partner link is explained under partnership referrals.
• A memorial is meant to be public — that is the whole point of it. Your own name and contact details are not.
• To submit a memorial you now have to give us your name and an email address, so that we can confirm we have it, tell you when it has been approved, give you its permanent link and let you know if somebody lights a candle. Neither is shown on the memorial, and giving us an email address does not put you on any mailing list.
• Once Spoken is community-supported. The form asks everyone to choose how the memorial should be funded. We ask those who can comfortably contribute to do so; £0 community-supported is available to anyone who cannot. We record that choice. If you choose a positive contribution, the memorial is safely submitted before Stripe opens, and paying or not paying changes no feature, review, visibility or priority.
• You do not need an account to visit, share, light a candle, contribute or create a memorial. A passwordless account is required to manage one. My Once Spoken uses your verified email to find memorials previously submitted with that same private address, or lets an owner invite you as a co-manager. It also holds saved memorials, management requests and the activity figures shown since your last visit.
• Under those required questions there is a small section headed Email choices — optional, holding three separate ticks: one reminder about sharing this memorial, occasional email about Once Spoken’s memorial features, own products and services, offers and ways to support it, and permission for us to ask you about featuring this memorial’s story. All three start empty, each is independent of the others, and leaving every one of them alone changes nothing about whether the memorial is submitted or published. They are set out one by one under your email choices.
• You may also, if you want to, add a short voice clip — the person’s own voice, taken from an audio or video recording you already have. It is entirely optional; a memorial without one is submitted, reviewed and published in exactly the same way. You can choose the file while submitting, or ask us to email a private, expiring link so that you can add it later. The original file stays private and is never the file anybody hears: a short file can be confirmed as it is, while a longer one lets you choose the section to use, and only the resulting short clip could ever be published. Permission for it is asked separately, in its own words, on its own ticks — it is never taken from the confirmation you gave about the memorial, from the social media permission, or from any of the email choices.
• If you submitted a memorial before those choices existed, you do not have them. We have not read any of them into an earlier agreement, into the address you gave us, or into anything else. Nobody is treated as having agreed to something they were never shown. You can make the current first-party email choice yourself at Email updates & offers; we will not send an unsolicited email merely to ask you to opt in.
• An organisation can apply online to become a referral partner. Partners receive a link and anonymous totals, never family names, contact details or memorial content. There is no application or approval fee; a contribution is optional and never affects approval or moderation.
• You can ask us to correct or remove things, and a person will read your request.

Who operates Once Spoken

Once Spoken is operated from England by Robert Hawes, a sole trader trading as Once Spoken. Robert Hawes is the data controller for the personal information described on this page and reads every message that comes in.

The way to reach the controller — about a memorial, about your own information, or about anything else on this page — is the contact form on Once Spoken. The controller’s geographical and service address is 201 Linley Drive, Hastings, East Sussex, TN34 2BX, United Kingdom.

Information about people who have died

This matters, and it is often misunderstood, so it is worth being precise about it.

UK data protection law — the UK GDPR and the Data Protection Act 2018 — protects living individuals. Information about a person who has died is not that person’s “personal data” under those laws, and the rights described further down this page (access, erasure, and so on) do not belong to someone who has died.

A recording of somebody’s voice sits in the same place. The voice of a person who has died is not their personal data, and we are not treating it as though it were. But a recording is also somebody’s property — there is copyright in a recording, and a performer has rights in their own recorded performance, both of which can outlive the person and belong to whoever inherited them. That is a different question from data protection and it does not disappear because the person has died, which is why the first tick asks whether you have the right or permission to provide the recording at all, and why we may refuse one.

That is a statement about the law, not about how we behave. We treat memorials with care because of what they are, and we will always consider a request from a family member about someone they have lost, whether or not the law obliges us to. See corrections and removal.

Two things do remain personal data, and are covered by this policy in the ordinary way:

• Your information as a submitter, correspondent or visitor — you are living, so the law applies to you.
• Information about living people that happens to appear inside a memorial — for example a living person visible in a photograph, a living person who can be clearly heard on a voice clip, or someone identifiable from the words that were quoted.

What we collect

When you submit a memorial

The submission form asks for the person’s name, the year they were born, the year they died, a short piece of something they said, and a photograph. It also asks you to position that photograph inside the round frame the memorial shows it in, and it stores three numbers describing where you left it — across, up and down, and how far in you zoomed — so that the memorial displays the photograph framed the way you chose rather than however it happened to be cropped automatically. Those numbers describe the picture, not you, and the photograph itself is stored exactly as you sent it. That material is intended to be published, and if we approve it, it will be publicly visible on this site to anyone who comes across it.

A published memorial has its own web address, and search engines can find it. Once a memorial is approved it is given a permanent address of its own — the person’s name, followed by the memorial’s identifier — and that page carries their name, the years, the photograph and the words on it. It is a page on the open web, so search engines are able to list it, and the name, a short extract of the words and the photograph may appear in search results and in the preview shown when the link is posted on social media. That is deliberate: being found by people who were not looking is the purpose of this site, and it is why a memorial is published at all. Nothing about you, the person who submitted it, is on that page or in anything a search engine or social network reads — see the paragraph below. If a memorial is corrected, taken out of public view or removed, its page stops being served within five minutes. We cannot control how long a search engine keeps its own copy or its own thumbnail afterwards, and we will not pretend otherwise; if that matters to you, tell us and we will tell you what we have asked them to do.

The form also asks about you, the person submitting it:

• Your name — required. Not the name of the person being remembered; your own. We ask for it so that we know who sent a memorial in, and so that we can address you properly if we write to you about it.
• Your email address — required. We ask for it so that we can tell you when the memorial has been approved and send you its permanent link, and so that we can reach you if there is a query about the submission. A memorial cannot be submitted without one, because without it there is no way to tell you what happened to something you cared enough to send us.
• Your relationship to the person — optional. A single choice from a short list — partner or spouse, parent, child, sibling, other relative, friend, colleague, other, or prefer not to say. You can leave it unanswered and the memorial is submitted exactly the same way. It is only of use to us if a family later asks who submitted a particular memorial.
• Your confirmation that the details are accurate and that you have the right or permission to submit the memorial and the photograph. This is required.
• Your optional permission for us to feature the memorial on Once Spoken’s social media or promotional material. This is a separate, genuinely optional choice, and leaving it unticked has no effect on whether the memorial is published. We record whether you gave it, when, and the wording you were shown at the time, so that we can honour it accurately. You can withdraw it at any time by contacting us.

Below those, in a section of its own headed Email choices — optional, the form offers three separate ticks. Every one of them starts empty; none is preselected; none is required; ticking or leaving any one of them has no effect on the others, and no effect at all on whether the memorial is submitted, whether it is published, or on which funding choice is available to you. They are described one at a time under your email choices, which also explains how to change or withdraw any of them afterwards.

• One reminder about sharing — about this memorial. If you give it, and if a few days after the memorial is published nobody has shared it using the site’s own share buttons, we may send you one email with the words already written, so that you can pass it on. One email, once, and never again.
• Occasional Once Spoken email — about your email address. This covers the first-party categories named beside the tick: memorial features, Once Spoken’s own products and services, special offers, and ways to support the project. It does not cover third-party marketing.
• Permission for us to ask about this memorial’s story — about this memorial. It lets us write to you and ask; it does not let us publish anything new.

For each of the three, and for the social media permission above, we record whether you gave it, when, the exact wording you were shown at the time, and — if you later withdraw it — that you withdrew it and when. That record is how we honour the choice accurately rather than from memory, and it is not visible to anybody but us.

Your name, your email address and your relationship are private. They are administrative information about the submission, not part of the memorial. They are not shown on the memorial, not shown anywhere else on the site, not included in the pages that search engines and social networks read, and not returned by the public parts of our database — a visitor looking at the memorial, or at the page’s source, cannot see them. Nor is your email address ever used as a memorial’s address or put into its link. Only a signed-in administrator can read them.

We use them to administer the memorial you submitted: to keep a record of who sent it in, to write to you about the submission, to tell you when it has been approved and give you its permanent link, to answer you if you ask us something about it, to review the memorial, and — if it ever becomes necessary — to deal fairly with a question about who has a say over that memorial, or with a dispute or a removal request about it.

Giving us your email address does not subscribe you to anything. It is not a marketing permission, we do not treat it as one, and it does not add you to a mailing list, a newsletter or any promotional list. The only messages we send beyond telling you what happened to your own submission are the optional ones you ticked for, and each is sent only under the tick that asked for it — see your email choices below.

Memorials submitted before this change may have no submitter name, no relationship, and in some cases no email address, because those questions were not asked at the time or were optional. We have not gone back and filled anything in. Nobody who submitted a memorial before one of the optional ticks existed holds that permission, and none has been created for them: not by an earlier agreement, not by the address itself, not by a change to these terms, and not by the fact that they had already agreed to something else. An older permission for memorial features stays limited to memorial features; it does not expand to products, services, offers or support. Anyone can make the current choice themselves at Email updates & offers, followed by a confirmation button sent to their address.

Your funding choice and contributions

For each new memorial we keep the funding option chosen, the amount attached to that option (including zero), the memorial it belongs to, its status and the date. This is how we can see whether the cost of the service is being shared sustainably and whether a payment journey was completed, cancelled, failed or abandoned. The choice is never used in moderation and is not visible on the memorial.

If you choose a positive contribution, Stripe processes the payment. Once Spoken keeps the amount, currency, status, Stripe checkout and payment references, refund information and dates needed to confirm the payment and keep accounts. We do not receive or store your full card number, security code or bank-login details. If you are signed in, the contribution may be linked to your account so My Once Spoken can show your private history and so we do not keep asking you to contribute again. An anonymous contribution remains anonymous unless some other record, such as the memorial submission itself, already identifies you.

When you use My Once Spoken

Accounts use passwordless email sign-in through Supabase. We hold the account identifier, verified email address, sign-in and last-visit times, and the links between that account and memorials it owns, co-manages or saves. We do not create or store a password. You can browse, share, light candles, contribute and submit a memorial without signing in; an account becomes necessary only when you ask to manage one.

When you ask for a sign-in link, Once Spoken’s server asks Supabase to create a one-time verification secret and Resend delivers the service email. Direct public sign-up remains closed. To prevent repeated or automated sends, we keep for no more than 14 days a keyed one-way fingerprint of the normalised address, the request time, whether sending succeeded and an opaque provider message reference. The throttle record contains no readable email address, IP address, cookie or device identifier. The one-time secret is placed after the # in the link so browsers do not send it in an ordinary page request, and it is removed from the address bar as soon as the page uses it.

When you first sign in, we compare the verified address with the private submitter email already stored against memorials. An exact match can link those memorials to your account. The comparison happens privately and does not reveal other addresses or memorials. An owner can also invite a co-manager by email. We keep the invited address, a one-way fingerprint of the invitation link, who sent it, its status and its expiry. Active managers of the same memorial can see one another’s email address and role so they know who shares responsibility for it; none of that appears publicly.

My Once Spoken records memorials you deliberately save, proposed edits and review decisions, ownership transfers, and a baseline of view, candle and share totals when you visit. The next visit can then show only what changed since the previous one. Those are aggregate memorial figures, not the identities of visitors or the people who lit candles—we do not have those identities. Public edits are requests: the existing memorial stays unchanged until a person approves them.

If you add a voice clip

This part of the site is available now, both while a memorial is being submitted and afterwards through the private, expiring link described below.

A memorial may carry a short recording of the person’s own voice. The form asks “Do you have their voice somewhere?” and explains that a voicemail, family video or voice note can work. It is genuinely optional: choosing to do it later, leaving it alone, changing your mind, or abandoning it halfway through has no effect on whether the memorial is submitted, reviewed or published, or on which funding choice is available to you.

What happens to the file you choose. You pick an audio or video file you already have — a voicemail, a video from a birthday, a recording made for you — and listen before you commit to anything. If it is already short enough, the page lets you confirm the whole recording as it is. If it is longer, you choose the few seconds you want privately in your own browser, with a player that lets you listen and adjust. When you confirm, two things are stored: the original file, kept privately, and a short processed clip made from all or the part you chose. The original is never published, never served to a visitor, and never linked to from any page — it is kept so that we can show what the clip was made from if that is ever questioned. The processed clip is the only thing that could ever be public.

What we record with it. The length of your file and of the clip, where in the file the clip starts and ends, the format it was in, the size in bytes, and whether the processing succeeded. A written transcript of what is said — you may type one, and we may correct it, because a memorial that can only be heard is no memorial at all to somebody who cannot hear it. No artificial intelligence or speech-recognition service is involved in any of that. No recording is sent to a transcription service, a speech-to-text service, or any other third party for processing: nothing of the kind is connected to this site.

The permission, which is asked separately. The ticks only appear once you have actually chosen a recording, they sit apart from the optional email choices, none of them is pre-ticked, and all four are required before a recording can be accepted:

• “I have the right or permission needed to provide this recording.”
• “Anyone else who can be clearly heard has agreed, or I have trimmed them out.”
• “I allow Once Spoken to store, process and publish this selected voice clip as part of this memorial.”
• “I understand I can ask for the clip to be removed later.”

Alongside them the page says, in its own words, that your original file is kept privately and is never the file anyone hears; that approving the memorial does not approve its recording, because the two are reviewed separately and we may refuse or remove a recording; that the permission covers this recording on this memorial and does not allow advertising, use by anyone else, voice cloning, AI training, synthetic speech, impersonation, sale or licensing to another company, and that a materially different use would need a new permission asked for and named at the time; and that asking us to take a clip down removes public access promptly but does not rewrite the record of what was agreed before.

What we keep as the record of that. Which memorial and which submission it was, which recording it was, each of the four statements you agreed to, the exact wording you were shown and its version, the moment it happened — timed by our database rather than by your device — which part of the site it came from, and whether it was a permission given, later withdrawn, or disputed. Each of those is written once and never edited: a withdrawal is a new record saying so, never a change to the one that said yes. It holds nothing about your device, your browser or your location, because none of that is evidence of anything.

Nobody is treated as having given it who was not asked. No memorial submitted before this existed has any audio permission attached to it, and none has been created for one. It is not inferred from a file, not inherited from the memorial’s own confirmation, not read out of the social media permission, and not read out of any email choice. If a recording is replaced, the new one needs its own permission; the old one’s record stays as it was.

Other people who can be heard. A recording of somebody who has died is not that person’s personal data — see information about people who have died — but a living person who can be clearly heard on it is a different matter, both in data protection terms and in fairness. That is what the second tick is about. A longer file can be trimmed before you commit; if a short file includes somebody who has not agreed, choose a different file. If you are a living person who can be heard on a clip on this site, contact us and we will take it out of public view while we look at it.

Withdrawing it. You can ask us to take a clip down at any time, whether or not you use My Once Spoken. Ask through the contact form, through your signed-in memorial management area, or use the private link described under corrections, changes and removal. Public access ends when we act on it; the record of what was permitted, and when, is kept, for the reason given under how long we keep it.

When you contact us

The contact form asks for your name, your email address, what your message is about, and the message itself. If you were looking at a particular memorial when you opened the form, a reference to that memorial is included so we can see what you are writing about.

Partnership applications and referral links

When an organisation applies. The partnership form asks for the organisation’s name, type, website, service area, how it proposes to introduce Once Spoken, and the applicant’s name, role, work email address and optional telephone number. It also records the version of the partnership terms accepted, the time of the application, the review decision and any administrative note. We use that information to assess and administer the application, prevent repeated automated applications, and send operational messages confirming receipt and the decision. It is not added to a marketing list. The private status link contains a random capability in its fragment — the part after #, which a browser does not send in its request — and our database stores only a one-way fingerprint of it.

When somebody follows an approved partner link. We create one random referral reference and one random secret for that visit. The secret is held in that tab’s session storage; our database stores only its one-way fingerprint, the partner link used, the time, whether the site was live or a preview, and when the reference expires. It stores no name, email address, IP address, user agent, location or device details. If a memorial is genuinely submitted within 30 days, the reference may be connected to the identifier of that submission or memorial. An abandoned form records no memorial. The secret is removed from the tab when the connection has been confirmed, and closing the tab removes it in any event.

What a partner can see. An approved partner’s private status page shows only aggregate totals: visits through its link, memorials created, memorials published, candles lit on those memorials, and the total of its own voluntary contributions. It never shows who visited, a family’s name or contact details, which memorial was created, its photograph, words or recording, whether a particular family contributed, or any moderation note. A partner cannot contact a family through this system, influence moderation, or change what a family pays. Administrators can see the application and the underlying records needed to review misuse or correct the figures.

Optional organisational support. If an approved partner makes a contribution while using its private status page, we may associate that contribution with the partner so its own support total can be shown. The payment remains governed by the payment terms below; the association is not considered when an application is approved, when a partner is kept active, or when any memorial is moderated.

Moderation records

Every memorial is reviewed by a person before it appears. We keep the record of that review — whether a memorial was approved or rejected, and any note made about it — along with the submission itself.

Analytics — how the site is used

Once Spoken uses limited first-party analytics. It is ours, it runs on our own database, and the information does not leave it. As pages are used, we may record:

• which page was viewed — the address of the page, without the query string or anything after a #. A memorial’s own page has the person’s name in its address, so that one is recorded as /memorial and nothing more: what is stored is that a memorial page was seen, not whose;
• which memorial was viewed, where the event is about a memorial;
• the hostname of the site that linked you here — facebook.com, say, and never the full referring address. Moving around Once Spoken itself is not a referral and is not recorded as one;
• campaign labels — the utm_source, utm_medium and utm_campaign values, if the link you followed carried any;
• whether that was the page you arrived on, so a referral or a campaign is credited once rather than to every page you go on to see;
• an approximate country — the country your visit appears to come from, and nothing narrower than that;
• which stage of the optional voice journey was reached — whether the offer or voice page was seen, “do it later” was chosen, a private link was requested or opened, a file was selected or became ready, a clip and its four rights statements were confirmed, an upload started or finished, a clip began playing, or the follow-on invitation was used. Failure stages are counted too, so that we can see where the journey is not working.

For those voice events, the page sends only the allowlisted event name and the page path. The same analytics routine adds the approximate country and the short-lived visitor and visit hashes explained below. It does not send or store a filename, email address, memorial name or identifier, recording, transcript, owner link or owner token; the path has no query string and a memorial address is reduced to /memorial.

About that country. It is worked out on our side of the connection, from a country signal that the edge network in front of the site has already attached to the request. Nothing looks your address up in a geolocation or IP-location database, and no third-party service of that kind is involved anywhere in it. Your browser is never asked for permission to use your location — that permission is switched off for this site altogether. No city, region, postcode, precise location or coordinates are collected, and there is nothing more precise than the country for us to hold. It is an approximation, and we treat it as one rather than as a verified statement of where you are: a VPN, a proxy, or simply the way a network routes traffic can all make it wrong. We use it only for aggregate analytics and reporting — how many visits came from which country — and never to decide anything about you. It is not used to sign anyone in, not to grant or refuse access, not for fraud prevention, not for consent, not for moderation, and not for any other security decision. The retention and the lawful basis described for analytics below apply to it unchanged.

Counts of visitors and visits are worked out inside our database from short-lived pseudonymous hashes that it derives from the request itself. Your IP address and your browser’s user-agent string are used in passing to produce those hashes and are not stored: they are not written into the analytics records and cannot be read back out of them. We call this pseudonymous rather than anonymous deliberately. A hash is calculated from information about your connection rather than invented at random, so — although we cannot turn one back into you, and do not try to — calling it completely anonymous would be overstating it.

Nothing is stored on your device for this. There is no analytics cookie, no local storage entry and no session storage entry, and nothing here attempts to fingerprint your device — no screen size, no font list, no device model. Nor is there any Google Analytics, Meta Pixel or cross-site advertising tracker anywhere on this site. Analytics information is not sold, not shared for anyone else’s marketing, and not combined with anything you have sent us.

Sharing a memorial. Every memorial has a share button beneath it, and the page shown after you send one in offers you its permanent link to copy. The share button opens a few ready-made words about the memorial, which you are free to change, rewrite or delete, together with buttons for WhatsApp, for Facebook, for your phone’s own share sheet where it has one, and for copying the words and the link. What those words say never reaches us. They are put together in your browser, they go only where you send them, and nothing you type or edit there is sent to Once Spoken or stored anywhere by us. When somebody actually uses one of these controls — not when it is merely on the screen — we record three things: which memorial it was, which part of the site it was shared from, and whether the link was copied to your clipboard or handed over to another application. We do not record where you then sent it. That includes the WhatsApp and Facebook buttons: pressing one of them simply follows an ordinary link, and all we keep is that a share happened and which of those two things it was — not which button you pressed, not which application it went to, and nothing about who received it. If you use your phone’s share sheet, the browser tells the page that it finished and nothing more, so we cannot know whether you chose WhatsApp, Messages, email or anything else — and we do not guess. There is no record of a recipient, an address, a phone number or a message. Neither WhatsApp nor Facebook has any code on this site: nothing of theirs loads here, nothing of theirs watches you here, and neither of them learns anything until you choose to open one of them yourself.

There are two places where we have to be straight with you about the limits of that. On an Android phone, the share sheet your browser opens is part of the phone rather than part of this site, and the browser reports the same result to the page whether you picked something from it or changed your mind and dismissed it. We cannot tell those two apart, and we are not willing to read your clipboard to find out. So on Android, opening the share sheet and then closing it without sharing is counted here as a share. It records nothing more than an ordinary share does — the memorial, the moment, and which part of the site it came from — and it still records nothing about you. It means only that our count of Android shares is a count of times the share sheet was opened, and so is a little high. On a computer or an iPhone the browser does tell the page the difference, and closing the sheet without sharing records nothing at all. Simply looking at a memorial, or opening its link, still records no share on any device. The WhatsApp and Facebook buttons sit under the same honest limit: they count at the moment you press them, because that is where this page’s part in it ends. Whether you then press send in WhatsApp, or finish the post on Facebook, is between you and them — we are never told, so these are counts of shares started rather than shares delivered.

When you share a memorial using one of those controls, the link they hand over carries one extra word on the end of it — &via=share. The permanent link shown to you on the screen does not: it stays exactly as it has always been, so selecting it by hand, bookmarking it or typing it in carries no extra word and is counted as nothing. If somebody follows a link carrying that word, we record that a visit arrived at that memorial through a shared link. That is the entire purpose of it: to tell us whether the memorials bring anybody here, which we otherwise have no way of knowing. It is the same single word on every share of every memorial by everybody, so it identifies no share and no person, and there is nothing in it to tell two people apart. It is not required for the link to work — the ordinary permanent link to a memorial is unchanged, every link shared before this existed still works exactly as it did, and stripping the word off changes nothing but our ability to count. Once the memorial is on the screen the word is removed from your address bar, and it is not written anywhere on your device at any point.

One email we send carries a link with that word on it as well: the single sharing reminder described under the emails we send you, which exists so that you can pass the memorial on. It is the same constant word there as everywhere else — not unique to you, not unique to the message, not generated per recipient, and carrying nothing that could tell us who followed it. It is not a tracking pixel, not a redirect through anything of ours, and not click tracking. The link points straight at the memorial, so opening that email, or not opening it, still tells us nothing, and if somebody follows the link all that is recorded is the same anonymous row as any other shared arrival.

These two sharing records are the smallest thing that could answer the question. They hold a memorial, a moment in time, and for a share which button was pressed. Unlike the page and memorial views described above, they carry no visitor or visit hash at all — nothing derived from your connection, and nothing that could group your sharing with anything else you did. We describe them as containing no identifier rather than as anonymous, because they are timestamped and sit in the same database as the pseudonymous view records, and we would rather be accurate than flattering. They are used to count sharing in aggregate, and — as the next paragraph explains — to count what happened next when somebody arrived through a shared link. They are not used to contact anybody and not used to decide anything about you.

What happens after a shared link. Knowing that a shared link brought somebody here does not tell us whether it mattered, so we also count whether that visit went on to do something. When a visit arrives at a memorial through a shared link and that memorial is actually shown, the arrival record described above is stamped with a reference invented at random by our database for that one arrival. It is not derived from your address, your browser, your device or anything else about you; it is not stored on your device; and it cannot be read back by anything running in your browser. The page holds it in memory only while it is open. If, within two hours of that arrival, a candle is lit, a memorial is sent in, a contribution is actually paid, or a memorial is shared again, we record a single further row: which memorial had been shared, that reference, which of those four things happened, the memorial or contribution it was, and when — and, for a contribution, its amount and currency, so that we can total what sharing brings in. Nothing else. There is no name, no email address, no IP address, nothing about your device, and no record of a person: the reference belongs to one arrival at one memorial, not to you, and there is nothing in it that could be matched to another visit, another day or another site.

We should be plain about the one thing this does do that the sharing records on their own did not: it connects a candle, a memorial submission, a paid contribution or a further share to the fact that a shared link was followed first. Where you sent in a memorial or made a contribution, we already hold that record and explain it elsewhere on this page; this adds only the note that it followed a shared-link arrival. The two hours is a deliberate limit rather than a technical one — after it, the reference counts nothing, and the arrival is simply an arrival. A candle that is only a repeat tap, a submission form that is abandoned, a payment that fails or is cancelled, and a share that does not complete all record nothing here, because nothing happened to count. Following a link that carries the &via=share word to a memorial that does not exist, or adding that word to an address by hand, establishes nothing at all. We use these figures only in aggregate, to see whether sharing brings people who then take part, and whether that starts another round of sharing. They are not used to contact anybody, not used to build a profile, not used to decide anything about you, and never shared with an advertising network — as with everything else here, there is no third-party analytics or advertising tracker involved in any part of it.

The invitation you may be shown after a shared link. If you arrived at a memorial through a shared link and stayed with it for a moment, or lit its candle, the page may quietly ask whether there is somebody you would want the world to remember. Whether to show that is decided inside the open page and nowhere else. Nothing is recorded because you were shown it, nothing is written to your device for it, no cookie, local storage entry or session storage entry is created, and there is nothing left of it once you close or reload the tab. If you go on to send a memorial in, what is recorded is the single row already described above — the same one that would have been recorded if you had found the form yourself.

Passing Once Spoken itself on. There is a page for people who would like more families to find the site. It offers the same kind of ready-made words, which you are free to change, and the same buttons. When somebody actually uses one of them, we record a moment in time and two facts: which part of the site it was shared from, and whether the words went to your clipboard or were handed to another application. Pressing WhatsApp hands the words over; pressing Facebook copies them for you to paste, because Facebook will not accept words from a link, and that is recorded as a copy — which is what actually happened. There is no memorial in that record, because no memorial is involved: it cannot appear in any memorial’s figures and it takes no part in the shared-link counting described above. It holds no visitor, no visit, no referral code, no country, no referring site and no identifier of any kind, and there is no advocate account, no sign-up, no code to quote and no reward anywhere in it. Nothing is stored on your device for it. The same honest limit described above applies on an Android phone: opening the share sheet and then dismissing it is counted here as a share, because the phone does not tell the page the difference.

We use all of it for six things: to understand how the site is being used, to see whether our own outreach is reaching anybody, to understand how people discover the memorials, to see whether sharing a memorial brings anybody here, to see whether the people who want to help us reach more families are able to, and to improve the optional voice journey by seeing where people stop or encounter a failure. Raw analytics events are kept for 180 days and then deleted; the aggregate counts worked out from them remain. The sharing and attribution records above are kept for the same 180 days, and the reference that links them is deleted with them; so are the records of the site itself being passed on.

Technical information

Separately from the above, like any website, this site cannot be delivered to you without your device contacting the servers that serve it. Our hosting and database providers keep their own technical logs as part of running their services, which will ordinarily include IP addresses, timestamps and details of the request. We do not use those logs to build any profile of you. Each provider keeps them for its own limited period, under its own policy, and we do not export them, copy them anywhere else, or combine them with anything you have sent us.

Why we use it, and our lawful basis

We do not ask for, and do not want, information that reveals a living person’s health, religion, beliefs, sexuality, politics or ethnic origin. A memorial is a name, two years, a photograph and something the person said — nothing on the form asks for more than that. If you believe a published memorial reveals something of that kind about a living person, tell us and we will take it out of public view while we look at it.

We do not use your information to make automated decisions about you, and we do not profile you.

The emails we send you

There are two quite different things an email address can be used for, and Once Spoken keeps them apart. A few messages sit between them, and every one of those is optional, asked for separately, and set out here and under your email choices.

Messages about something you did. If you submit a memorial, we may write to you about that submission — to confirm we have received it, to tell you it has been approved and give you its permanent link, to let you know when somebody has lit a candle for the person you submitted, to ask you something we need to know in order to review it, to tell you if we cannot publish it, or to reply to a message you sent us. These are service messages about your own submission. They are the reason we ask for an address at all, and they are not optional in the way marketing is: if you would rather we did not write to you about a memorial you have submitted, tell us and we will note it, though it may mean we cannot tell you what happened to it.

Partnership application messages. If you apply on behalf of an organisation, we send a receipt containing its reference and private status link, then an approval or decline message after a person reviews it. These are operational messages answering the application, not marketing. They carry no tracking pixel or click tracking. You do not need to agree to promotional email in order to apply, and applying does not create that permission.

Marketing. Once Spoken may send its own occasional promotional email only where the address holds a current, confirmed permission covering the subject of that message. Giving us an email address to submit a memorial is not that permission. We do not sell or rent addresses, pass them to a partner, advertiser or agency for their marketing, or treat acceptance of the terms as consent. No permission on this site covers third-party marketing.

The optional first-party choice. The relevant tick names the categories it covers: Once Spoken’s memorial features, its own products and services, special offers, and ways to support the project. It starts empty, is separate from the terms and from submitting a memorial, and requires a second, deliberate confirmation through the email address before it becomes sendable. Every promotional message includes a preference link. The exact wording and version are recorded, and an older, narrower version stays narrow.

A private link to manage a recording — only when you ask for it. A signed-in manager can request a single-use, expiring link from My Once Spoken. The existing route for an original submitter also remains: if the memorial and email address match our private submission record, the link is sent to that address. The public reply is identical whether a pair matched or not, so it cannot be used to test who submitted a memorial. Following a link changes nothing by itself; adding, withdrawing or removing anything needs a deliberate action, so a mail scanner or preview cannot act for you. This is a service message about a memorial you manage, not marketing and not sent under an optional marketing tick.

Candles. If somebody lights a candle for a person you submitted, we may tell you — the first time it happens, and then only at a few widely spaced totals after that. There is no message for every candle. We never tell you who lit it, because we do not know: a candle is counted, never signed. If you would rather not hear about candles at all, tell us and we will stop.

One reminder about sharing — only if you asked for it. The submission form carries an optional tick asking us to remind you about sharing the memorial. If you ticked it, then a few days after the memorial is published, and only if nobody has yet shared it using the site’s own share buttons, we may send you one email with the words already written so that you can pass it on. Everything about it is deliberately narrow:

• Once, ever. One reminder for that memorial, for the life of that memorial. It is not a series, not a sequence and not a list, and there is no second message if you do nothing about the first.
• Only if you ticked the box. If you left it unticked, or you submitted a memorial before the tick existed, it is not sent. We have not read the permission into any earlier agreement, and we have not read it into the fact that you gave us an address.
• It stops being due the moment somebody shares. If the memorial has been shared through the site by the time we would have written, no reminder is sent at all — not then and not later.
• It asks nothing of you. It does not say the memorial needs shares, does not suggest you have done anything wrong, does not tell you how many people have seen it, and does not ask for money: there is deliberately no contribution section in it.
• Nothing in it watches you. No tracking pixel, no click tracking, no redirect through anything of ours. Its link points straight at the memorial and carries the same single &via=share word that every share of every memorial carries — identical for everybody and unique to nobody. Opening the message, or not opening it, tells us nothing.
• Stopping it. Reply to it with the word STOP, or tell us through the contact form, and we will not write to you about sharing again. Your address is then kept on a short do-not-write list which is checked before any email to a submitter is sent, so a request to stop cannot be missed by one part of the site and honoured by another.

We call this a reminder you asked for, rather than a service message, and we ask for it separately instead of reading it into the address you had to give us. We are not going to tell you it is certainly outside the rules that govern marketing email; the honest position is that a message inviting you to share something sits close to that line, however gently it is written. So it has been built as though the stricter rule applied: asked for in advance, in its own words, on its own tick that changes nothing else; never sent to anybody who did not tick it; sent once; stoppable from inside the message; and never sent to an address that has asked us to stop. If you would rather it had not been sent to you, saying so is enough — we will not ask you to justify it.

Who carries these messages. All of them, including optional marketing and the sharing reminder, are sent for us by Resend, an email delivery provider. For each send they receive the destination address and the message. We keep the consent ledger ourselves, do not upload an audience or contact list to Resend, and send one addressed message at a time. Our messages carry no tracking pixel and no click tracking, so opening one, or not opening it, tells us nothing.

If Once Spoken ever wants permission for a materially different purpose — including any third-party marketing — it will be asked for as a new, separate choice, in its own words, at the time. It will never be taken from a permission given for something else, an earlier wording version, acceptance of the terms, or silence. The database records which topics each wording version covers and checks that scope before a promotional send. We also stop treating marketing consent as sendable at its two-year review point unless it has been refreshed, and we honour a withdrawal immediately.

The optional social media permission on the submission form is a separate thing again, and is not an email choice at all: it is about using the memorial in our own promotional material, not about sending anything to you. You can give it, decline it, or withdraw it at any time, and none of that affects whether the memorial is published.

Your email choices

The submission form has a small section headed Email choices — optional holding three ticks. This is what each one means, who or what it belongs to, and how to change it. Two things are true of all three:

• Every one of them starts empty and stays empty unless you tick it. None is preselected, none is required, and they are not bundled together — you can take one, two, all three or none. Declining any or all of them has no effect whatsoever on whether your memorial is submitted, whether it is approved, whether it is published, how it looks, or on which funding choice is available to you. There is no version of Once Spoken that you get by agreeing to be emailed.
• You can withdraw any of them at any time, and withdrawing is meant to be easier than agreeing. One click in any email we send under them, or a line to us through the contact form. You never need an account, a password or a sign-in to withdraw an email choice.

One reminder about sharing — this memorial

“Send me one reminder to share this memorial if I haven’t shared it after three days.”

This one belongs to the memorial you were submitting when you ticked it, not to you. If you submit two memorials, you make the choice twice, and the answer for one says nothing about the other. What it permits is a single email, once, and only while it is still true that nobody has shared that memorial through the site — set out in full, with every limit on it, under the emails we send you above.

Occasional Once Spoken email — your email address

“Email me occasionally about Once Spoken’s memorial features, its own products and services, special offers, and ways to support the project. Once Spoken only. No third-party marketing. We never sell your email address. I can unsubscribe at any time.”

This one belongs to your email address rather than to a memorial. It is the only choice on the form that works that way, and it means you give it once rather than once per submission: if you have sent in several memorials, ticking it on one is a permission for the address, and withdrawing it withdraws it for all of them at once. It is not attached to any memorial and does not appear in any memorial’s record as a permission about that memorial.

What it does permit:

• Ours, and only ours. Once Spoken memorial features, Once Spoken’s own products and services, special offers from Once Spoken, and ways to support this project.
• Occasional. There is no schedule, no regular send, and no newsletter. If there is nothing new worth telling you, you hear nothing, and that is the expected state.

What it does not permit, and cannot be read as permitting:

• Any advertising, offer or promotion for another company, product, service, charity or campaign — including anything described as a partner, a sponsor, a selected third party or a recommendation.
• Passing, selling, renting, sharing or disclosing your name, your email address or anything else about you to anybody for their own marketing. That is not a thing we do, and this permission does not create a route to it.
• Anything about a memorial in particular. It is not permission to ask you about a memorial, to feature one, or to publish anything.

There are further protections built into it. Because a permission held by an email address is only as good as our knowledge that the address is really yours, we do not make it sendable merely because a link was opened. The landing page repeats the exact choice and somebody must press its confirmation button; an automated mail scanner’s visit changes nothing. Until that happens the permission is recorded but not acted on. We keep older wording versions separate: the permission used from 7 September 2026 covered memorial features only, so it does not authorise products, services, offers or support. A current choice can also be made directly at Email updates & offers.

Permission for us to ask about a memorial’s story — this memorial

“You may contact me if Once Spoken would like to hear more about this memorial or consider featuring its story.” With, underneath it: “This allows us to ask. We would still agree the details with you before using anything new.”

This one belongs to that one memorial. If you have submitted more than one, you decide separately for each, and giving it for one is not giving it for another.

It is worth being exact about how narrow it is, because “featuring its story” could be read broadly and should not be:

• It is permission to ask you a question. Nothing more. It lets us write to you, about that memorial, to ask whether you would tell us more about it or whether its story might be featured. You are free to say no, to say nothing, or to say yes and then change your mind.
• It is not permission to publish anything. It does not allow us to publish additional words, a recording, a photograph, private correspondence between us, or any personal detail about you or about the person remembered. It does not turn what you might tell us in reply into something we may use.
• It does not replace the permission we would need afterwards. If we ever did want to use something new, we would agree what, where and how with you at that point, separately and in its own words. This tick is the door, not the room.
• It changes nothing about the memorial as published. The memorial stays exactly as it is whether you tick this or not.

Changing or withdrawing any of them

Every ongoing Once Spoken marketing message carries a link to an email-preference page. Opening it shows what the address currently permits, lets you turn the permission off, and offers one control that stops all optional email for that address. The single sharing reminder instead explains how to reply STOP or contact us. Preference links need no account or password, expire and can be revoked; memorial-specific choices appear only when the link also proves authority over that memorial.

You do not have to use it. Telling us through the contact form works just as well and reaches a person. Either way we do not ask you to explain yourself, and we do not make you confirm it twice.

Stopping optional email does not stop the necessary messages about a memorial you submitted — that it was received, that it was approved, that we need something from you. Those are the answer to something you did rather than something we are selling, and they are described under the emails we send you. If you want those stopped too, say so and we will, with the honest warning that we may then be unable to tell you what happened to your own submission.

What we keep, and what stays private

For every one of these choices we record the permission itself, whether it is currently given or withdrawn, whether it belongs to your address or to a particular memorial, the date, the exact wording and version shown, the source of the choice, the privacy-notice version, and — for address-level marketing — when that exact grant was confirmed. If you withdraw it, we record the withdrawal and its date and keep the record of the original permission. The law requires us to be able to demonstrate what consent existed when an earlier message was sent. The historical record does not keep permission alive: the send boundary reads the current answer, confirmation, topic scope, age and suppression status, never merely the history.

None of it is public. Consent records, your email address, and the preference links are not shown on any memorial, not in the page a memorial is built from, not in what search engines or social networks read, not in the sitemap, not in our analytics, not in anything our payment provider is given, and not returned by the public parts of our database. A visitor cannot read them. A memorial manager can see the email addresses and roles of that memorial’s other managers, but not its consent ledger or unrelated submitter details. Only an administrator can see the current permissions for a memorial, and that view is limited to what is needed to honour them.

Who else is involved

We do not sell personal information and we do not share it for anyone else’s marketing. We do rely on a small number of service providers to make the site work at all:

No recording goes anywhere else. There is no transcription service, no speech-recognition service, no artificial-intelligence service and no media-processing company anywhere in this list, and none is used behind it. A recording you send is stored by Supabase, listened to by one administrator, and served — if it is approved and published — by this site’s own servers reading it out of that private storage. It is not handed to anybody to train anything, and nothing on this site is capable of doing so.

We may also disclose information where the law requires it, or where it is necessary to establish, exercise or defend a legal claim — for example where someone alleges that a photograph was published without their permission.

There is nothing else. Once Spoken keeps its own limited contact-and-consent ledger so it can prove and enforce each choice; it does not maintain a promotional audience inside Resend or another newsletter, campaign, customer-relationship or advertising platform. Messages you send through the contact form are stored with Supabase and read in the administration area of this site. If we reply by email, that reply and your address will also sit in the ordinary email account it was sent from, like any other correspondence.

Where information is held

Our providers are international companies and may process information outside the United Kingdom, including in the United States.

Before we use a provider for restricted transfers, we record the provider, data, destination and the account-specific safeguard in our processor register. Depending on the provider and destination, that may be a UK adequacy regulation, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate security measures. We retain the applicable agreement and review provider and subprocessor changes. Ask through the contact form if you want information about the safeguard applying to your data.

How long we keep it

A published memorial is intended to be permanent. That is what people are asking us for when they submit one, and it is the point of the site: that someone might still come across that face and those words many years from now.

Everything else is kept only as long as it is useful:

• Submitter details — the name, the email address and the relationship, where one was given — are kept alongside the memorial they relate to, so that we can reach the person who sent it in and answer fairly if anyone later asks who did. Because a published memorial is intended to be permanent, so in practice is the record of who submitted it. If you would rather we no longer held yours, ask, and we will tell you what we can remove without losing the record of who was entitled to submit the memorial in the first place.
• Account and memorial-management records — the verified account, ownership and co-manager links are kept while the account or memorial needs them. Expired, accepted or withdrawn invitations are retained for a reasonable period so we can explain how access was granted and investigate misuse; the plaintext invitation secret is never stored. Saved memorials can be removed by you. Change requests and ownership transfers are kept with the memorial’s administrative history so we can account for what changed and why.
• Funding choices and contribution records — the choice attached to a memorial is kept with that memorial so we can report honestly on how the service is funded. Completed payment and refund records are retained for the period required for tax, accounting, fraud prevention and disputes. Failed, cancelled and abandoned attempts are kept only while needed for reconciliation, duplicate-payment protection and aggregate reporting, then removed or reduced to non-identifying totals.
• Consent records are kept for as long as we hold the memorial or address they relate to, and afterwards only while needed to demonstrate what was agreed and honour a withdrawal. They include the exact wording and version, date, source, scope, confirmation and withdrawal. Withdrawing a permission does not delete the evidence of it; the record proves why an earlier message was lawful, but cannot make a withdrawn permission sendable. Optional marketing also stops being sendable at its two-year review point unless it is refreshed.
• Preference links — the links in our emails that open the email-preference page — are kept only as a one-way fingerprint, never as the link itself, alongside when each was issued, when it was last used, and whether it has been turned off. Each expires, and a replacement turns its predecessor off. Once one has expired or been turned off it opens nothing, whoever has it.
• A request not to be written to — if you ask us to stop sending the sharing reminder, or to stop writing to you altogether, your email address is kept on a short do-not-write list indefinitely, with the date and, where you gave one, the reason. That is deliberate, and it is the one place on this page where keeping something for longer is the answer that respects you: forgetting the instruction after a few months would let the thing you stopped start again. It is used for nothing else, it is checked before any email to a submitter is sent, and it is not readable through the public site.
• A voice recording — while the memorial carries it, the private original and the short public clip are both kept: the clip because it is what people hear, the original because it is the evidence of what the clip was made from. When a clip is withdrawn, disputed or taken down, it stops being publicly reachable at that moment, before anything is deleted and without waiting for any sweep or schedule. The files then sit on a retention clock — a year by default — after which they are handed to the same clean-up process that removes any other unreferenced file, and the paths to them are cleared. The record of what was permitted, and of the withdrawal, is kept: it holds no audio. Nothing about that retention keeps a clip available — availability was decided and refused the moment it was withdrawn.
• An abandoned recording — if you start choosing a clip and do not finish, or you cancel, nothing is attached to a memorial and the file is queued for deletion by the same clean-up process. A submission with an abandoned recording is still a complete submission.
• Links we email to manage a recording — kept only as a one-way fingerprint, never as the link itself, with when it was issued, whether it has been used and whether it has been turned off. Each expires, each is good for one purpose only, and once used or expired it opens nothing, whoever has it.
• Contact messages are kept while we deal with them, and for a period afterwards so that we have a record of what was asked and what we did — particularly for removal requests and complaints.
• Partnership applications and review records are kept while an application is pending and while a partnership remains active, then for a reasonable period afterwards so that we can account for the decision, deal with a concern and prevent immediate repeat misuse. If an application is declined and no concern remains, its contact details are removed when they are no longer needed. The event record may be kept without unnecessary contact detail so that the administrative decision is auditable.
• Partner referral capabilities stop being usable after 30 days. The plaintext secret is never stored by us. Privacy-minimal referral and conversion records are kept while the partnership is active so that its aggregate impact remains accurate; after a partnership is archived they are removed after 180 days. They contain no name, email address, IP address, user agent, location or device detail and are never shown individually to the partner.
• Rejected submissions, including the photograph, are removed once the decision has been made and any query about it has been resolved.
• Raw analytics events are kept for 180 days and then deleted, including the sharing records described above, the attribution records that count what followed a shared link, and the records of the site itself being passed on. The aggregate counts worked out from them — how many times a page or a memorial was viewed, how often memorials were shared, and how often each voice-journey stage was reached — are not information about a person and are kept.

Apart from those 180 days, we have deliberately not put a fixed number of months against each of these, because a figure invented for the sake of looking precise is worth nothing to you. The rule is the one above: something is kept while there is a reason to keep it, and deleted when there is not. If you want to know what we still hold about you, ask, and we will tell you.

Cookies and storage on your device

This site does not set any cookies. There is no advertising and nothing that follows you between websites. The analytics described above is our own and stores nothing on your device at all — no cookie, no local storage entry, no session storage entry, and no identifier of any kind — so there is nothing about it to ask your permission for. That includes the sharing measurement: the &via=share word travels in the link itself, is read once as the page opens and is then gone, and is never written to your device. It also includes the reference used to count what happens after a shared link — it is held in the memory of the open page and nowhere else, so closing the tab or reloading the page discards it, and no cookie, local storage entry or session storage entry is created for it at any point. The same is true of the invitation you may be shown after arriving through a shared link, and of the page for passing Once Spoken on: neither writes anything to your device and neither reads anything from it. That is why you have still not been shown a cookie banner: consent of that sort is about storing or reading things on your device, and the measuring we do neither stores nor reads anything there.

A small number of items are stored in your browser’s own local or session storage, so that the site remembers what you have done on it or can complete a partner-link journey you deliberately opened. None of them is a cookie, none is shared with another website, and none is used to advertise to you or to follow you anywhere:

We consider each of these strictly necessary for the thing you are choosing to do — lighting a candle, submitting or managing a memorial, completing a chosen contribution, checking an application or using an approved referral link — which is why none is used for advertising or cross-site tracking. You can clear them at any time through your browser settings; the site will simply start again next time, though clearing a sign-in or private capability means you will need to sign in or reopen its link again.

Your rights

If you are a living individual whose personal data we hold, you have the right to:

• ask what we hold about you, and get a copy of it;
• have inaccurate information corrected;
• ask us to delete information, in the circumstances where that right applies;
• ask us to restrict how we use it, or object to our use of it where we rely on legitimate interests;
• withdraw consent — for example the optional social media permission, or the optional sharing reminder — at any time, without that affecting anything done before you withdrew it;
• ask for a copy of information you gave us in a portable form, where that right applies;
• complain to the regulator.

These rights have limits and exceptions in the legislation. If we cannot do what you have asked, we will tell you why.

We do not charge for dealing with a request, and we aim to respond within one month.

Corrections, changes and removal

Separately from the legal rights above, you can simply ask. Please contact us if you would like a memorial corrected, a photograph changed or taken down, or a memorial removed altogether — or if you believe something has been submitted that should not have been, or was submitted by someone with no right to do it.

Tell us the name shown on the memorial and, if you can, your relationship to the person. It helps us act quickly and helps us be fair to everyone involved. Every message is read by a person.

A voice clip. Ask us to take one down and we will, whether you submitted the memorial, appear on the recording yourself, or hold the rights in it. There are two routes and both work: the contact form, or — if you submitted the memorial — a link emailed to the address already recorded against it, described under the emails we send you. Public access ends when we act, not on a schedule. Where a family disagrees about a recording, we will normally take it out of public view while we work out what is right rather than leave it up and argue about it.

Where a request concerns a memorial submitted by someone else, we may need to weigh up more than one person’s wishes. We will be straightforward with you about what we decide and why.

Children

Once Spoken is not designed specifically for children, but children may visit public memorials or receive a family invitation to contribute. We therefore use the same child-safe, high-privacy defaults for everyone: contributions are private and pending, contact details are not public, there is no behavioural advertising or profiling, and harmful material can be reported by a child or responsible adult. We assess the service against the ICO Children's Code. If a child has shared personal information or may be at risk, contact us; we will restrict harmful exposure promptly and decide correction, retention or deletion in the child's best interests and in accordance with any safety or legal evidence duties.

Security

Managing a memorial and entering the administration area both require verified sign-in. Row-level access rules limit an ordinary account to memorials it manages, its own saved memorials, contribution history and requests; administrator-only information — such as raw submitter details, consent records and the list of people who asked us not to write — is not readable through the public site. Invitation and private-link secrets are stored only as one-way fingerprints. Photographs and memorial records are held with Supabase, and the site is served over an encrypted connection.

We have described only what we can point to. No website can promise that information will never be compromised, and we would rather say that plainly than make a claim we cannot stand behind.

Complaints

If you are unhappy with how we have handled your information, please tell us first — it is usually the quickest way to put something right.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office. Its route for a complaint about how an organisation has handled your personal information is ico.org.uk/make-a-complaint/data-protection-complaints, and its helpline is 0303 123 1113.

Changes to this policy

If this policy changes, we will update the date at the top of the page. If a change materially affects how we use information you have given us, we will make that clear rather than quietly editing the text.

How to contact us

You can reach us through the contact form on Once Spoken. Choose the option that best matches what you need — including asking for a memorial to be removed — and a person will read it.