Who we are
2thrive4life runs this website, the memorial pages hosted on it, and the 2thrive4life mobile app. For the purposes of the UK and EU General Data Protection Regulation we are the data controller for everything described here.
You can reach us about anything on this page at privacy@2thrive4life.ca.
What we collect and why
We only ever hold what you have given us. We do not buy data, we do not track you across other websites, and we do not run advertising or analytics cookies. The table below is the complete list.
| When | What | Why we may hold it | How long |
|---|---|---|---|
| You share a memory on a memorial page | Your name, the memory you wrote, any photos or video you attached, and your email address if you chose to give one. | Consent — you typed it into the form knowing it would be published once reviewed. Your email is never published; it is only so a moderator can reach you. | Published memories stay for as long as the memorial page does. Email addresses are deleted when a memory is declined or removed. |
| You join the app waitlist | Your email address, which page you signed up from, and the date. | Consent, for the single announcement you asked for. | Deleted once the launch email has gone out, or sooner on request. |
| You create an account | Your email address and password. Passwords are hashed by our authentication provider and are never visible to us. | Performance of a contract — we cannot give you an account without them. | Until you close your account. |
| You use your account | Your display name, avatar, timezone, what motivates you, the habits and lessons you track, your daily entries, reflections and streaks, and any story you write. | Performance of a contract — this is the service itself. | Until you close your account, then erased within 30 days. |
| You invite someone | The email address you entered for them. | Our legitimate interest in letting members invite friends. We use the address only to send that one invitation, and the person invited can ask us to delete it at any time. | Deleted once the invitation is accepted, revoked, or 90 days old. |
| You use the mobile app | A device identifier and push notification token, your platform, app version and timezone. | Consent — captured only if you turn notifications on. | Until you turn notifications off or sign out on that device. |
| You send feedback | Your message and basic details about the device you sent it from. | Our legitimate interest in fixing what you reported. | 12 months. |
| Any request to our API | The account id, the path called, the response status, and how long it took. We do not log request bodies, headers or IP addresses. | Our legitimate interest in keeping the service up and catching abuse. | 90 days. |
Who else can see it
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Under the California Consumer Privacy Act, neither of those has happened in the last twelve months and neither is planned.
The only third parties involved are the ones that run the service on our behalf. They are contractually bound to use the data only as we instruct.
- Supabase
- Runs our database, sign-in and file storage. All the data above lives here.
- Region set on our project. Covered by Supabase's data processing agreement.
- Cloudflare
- Serves the website and runs our server code at the edge.
- Global network. Covered by Cloudflare's data processing addendum.
- Google Fonts
- Serves the typefaces the site uses. Your browser contacts Google directly, so Google sees your IP address when a page loads.
- Global. Governed by Google's own privacy policy.
Your rights
Wherever you live, you can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Email us and we will send it — signed-in members can also call GET /api/v1/users/me/export for a machine-readable copy, and DELETE /api/v1/users/me to close their account (a self-service settings screen is on the roadmap).
If you are in the UK or the EU you also have the right to object to processing we carry out under legitimate interests, the right to restrict processing while a dispute is resolved, and the right to complain to your national data protection authority — in the UK, the Information Commissioner's Office.
If you are in California you have the right to know what we collect, the right to delete it, the right to correct it, and the right not to be treated differently for exercising any of them.
We answer every request within 30 days. We will never charge you for it, and we will never make you create an account to ask.
A note about memorial pages
Memories submitted to a memorial page are reviewed by a moderator before anything appears publicly. If you have shared a memory and want it taken down, email us and we will remove it and the contact details attached to it.
If you are named in someone else's memory and would rather not be, tell us and we will edit or remove it.
How we protect it
Every table in our database enforces row-level access rules, so one account cannot read another's data even if the application layer has a bug. Traffic is encrypted in transit. Secrets and administrative keys are held server-side only and are never sent to your browser.
No system is perfect. If we ever suffer a breach that puts you at risk we will tell you and the relevant regulator without undue delay.
Children
This service is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal information, email us and we will delete it.
Changes to this notice
If we change how we handle personal data we will update this page and move the date at the top. Material changes to how we use member data will also be emailed to members before they take effect.
Ask us anything
Requests about your data, questions about this page, or a memory you would like taken down — all to the same address.
privacy@2thrive4life.ca