Privacy

Last updated 12 November 2026

Digital Ofrenda holds memories, so we keep as little about you as we can. This page says exactly what we keep, who else touches it, and how to remove it.

What we keep

• Your email address. It is how you sign in, so we store it as written (in lower case). There are no passwords. The first time you sign in we send one welcome email and start a basic ofrenda for you, which you can rename or delete.
• When you were last active on the site. It is used for one thing: if you are the owner of an ofrenda and have been away for a very long time, someone you chose as a successor may ask to take it over, and you are told first. Signing in cancels the request.
• Your ofrendas: the name, words, photos and arrangement you save. The words and arrangement are kept in our database and the photos in Cloudflare’s file storage; a photo is deleted when you remove it from an ofrenda or when the ofrenda is deleted. Anyone who has the link to an ofrenda can see it, so share links only with people you want to see it. The owner can instead make an ofrenda private, so only the people who keep it can open it and every link stops working for everyone else. Search engines are asked not to list ofrendas, and a link you paste into a chat shows only a generic picture and the name on the altar, never a photo. If the owner gives an ofrenda a name in its address (like /a/abuela-rosa), it becomes easy to guess, and the original link keeps working too. The page shows what you saved, never who keeps it.
• Who keeps what: which ofrendas you own or help keep, the email addresses of people you invited or named as a successor, and the invitations you sent. Invitations stop working after 7 days, and we delete each one, with the address in it, a day after it is used, cancelled or runs out. The other people who keep the same ofrenda can see your email address on its Keepers page, and you can see theirs. When you share an ofrenda for viewing only, we email the link once and keep just a one-way hash of that address for one day, to stop the same inbox being emailed over and over. The address itself is not stored.
• Visits to an ofrenda, when you are signed in. To decide who should look after an ofrenda if its owner hands it to someone who never signs up, we count how many days you opened it while signed in: one count per ofrenda per day, kept with your account. We never count visitors who are not signed in, and we do not record which pages you read or for how long. The count is used only for that decision, and is deleted with the ofrenda or your account.
• Handovers. If an owner hands an ofrenda to an email address that has no account yet, we keep that address with the waiting handover until the person signs in or the handover ends (at most 90 days), and remind them by email to sign up. To limit how many handovers one account can start in a day, we keep a short log of when you started them (not who to) for one day.
• Sign-in records. The sign-in link or code you ask for, session identifiers and invitation links are stored only as one-way hashes, so we cannot read them back. The email address you typed is kept with the sign-in record, and the record is deleted about a day after it stops working. Codes and links stop working after 15 minutes. A session lasts 90 days from when you last used the site, or until you sign out, and is deleted then.
• Technical logs. Cloudflare, which hosts the site, keeps logs of requests and errors, which can include the time, the page asked for and your IP address, for a limited time. We use them to find and fix problems, and for nothing else.
• Addresses we no longer email. If our email provider tells us a message to an address could not be delivered, or that the person marked it as spam, we remember a one-way hash of that address (not the address) and stop emailing it, except for sign-in and email-change codes you ask for yourself. This keeps our email working for everyone. It is kept even if an account is deleted, because it is about the address, not the account.
• Payment records. Which upgrade was bought and for what, when, the amount and currency, whether it was refunded or disputed, and Stripe’s payment reference. While your account exists the record is linked to it, so you can see your purchase history. No card detail. If you delete your account the link is removed; we keep the rest as a record of the sale.

Cookies

One cookie, which keeps you signed in. It is needed for the site to work, so there is nothing to accept or decline. While you open an emailed link, your browser may briefly keep its one-time token in session storage for that tab until it is used; it is not sent anywhere else. We do not use advertising or analytics cookies and we do not track you across other sites.

Who else handles your data

• Cloudflare hosts the site, the database and the photo storage, and runs the human check on the sign-in page (Turnstile). The check looks at how your browser behaves to tell people from bots, and we pass it your IP address.
• Resend delivers our emails, so it sees the address it sends to and the message.
• Stripe takes payments on its own page. Your card details go to Stripe and never reach us. Stripe emails a receipt to your email address.

We do not sell your data and we do not share it with anyone else.

Your choices

• Change your email address on the My ofrendas page. We send a code to the new address first.
• Download your data on the My ofrendas page: one file with your account, your purchases and every ofrenda you own or keep, including the photos and the email addresses of the people who keep each one. The file is not protected once it is on your device, so keep it somewhere safe.
• Delete your account on the same page. It removes your account, your sign-in records, your place on other people’s ofrendas, and the invitations to or from you. Ofrendas that other people help keep are passed on to them instead of being erased, so what you made is not lost; ofrendas nobody else keeps are deleted, and you confirm that first. Deletion is immediate and cannot be undone.
• Delete one ofrenda from its page, if you own it.
• Ask us for a copy of what we hold about you, or to correct it, at [email protected].

Backups and security

Everything travels over HTTPS. Data deleted here may remain in the host’s backups for a short time before it is overwritten.

Children

Digital Ofrenda is not meant for children under 13, and we do not knowingly keep their data.

Changes

If this page changes in a way that matters, we will say so here and, if we can, by email.

Questions: [email protected]. See also the terms.