Privacy Policy

Effective date: March 1, 2026  ·  Last updated: August 11, 2026

Rainbow Bridges ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect information about you when you use rainbowbridges.pet (the "Service"). By using the Service, you consent to the practices described below.

1. Information We Collect

Information you provide directly

• Account information: name, email address, and password when you register.
• Memorial content: pet names, photos, dates, quotes, tributes, and any other content you upload to your gardens.
• Contact form submissions: name, email, phone number, and message text when you contact us.
• Profile photo: an optional image you upload to replace your initials avatar.

Information collected automatically

• Technical and analytics data: We use Vercel Analytics to measure use of the Service. Before analytics events are sent, we remove query strings and fragments and replace token- or record-ID paths with general route labels. Vercel processes aggregate usage data such as pages viewed, access times, and browser or device information. IP-address information is processed when web requests are made; our rate-limit records use a one-way salted hash rather than a raw IP address.
• Account activity records: limited timestamps and activity categories for signed-in sessions, garden and memorial changes, owner contributions, and visitor contributions. We use these records to operate the Service, protect memorials, and apply the retention periods described below.
• Cookies and local storage: session tokens and preference data stored in your browser to keep you logged in and remember your settings. Vercel Analytics does not use analytics cookies or cross-site identifiers.

2. How We Use Your Information

• To operate, maintain, and improve the Service.
• To authenticate your account and verify your identity.
• To send transactional emails (e.g., email verification, password reset).
• To send notifications you have opted into (e.g., new tributes or flowers on your gardens).
• To respond to your support requests and contact form submissions.
• To detect and prevent fraud, abuse, or security incidents.
• To comply with legal obligations.

3. How We Share Your Information

We do not sell your personal information. We may share information in the following limited circumstances:

• Service providers: We use Supabase for database hosting and authentication, Vercel for application hosting and website analytics, and Resend for transactional email delivery. These providers process data on our behalf under appropriate contractual and security obligations.
• Legal requirements: We may disclose information if required by law, court order, or governmental authority.
• Business transfers: In the event of a merger, acquisition, or sale, your information may be transferred. We will notify you before any such transfer takes effect.
• Public gardens: Content in public gardens (pet names, photos, tributes) is visible to any visitor. Private gardens are not indexed by search engines and do not appear in public listings, but remain viewable by anyone with the garden's direct link.

4. Data Retention

We retain personal information while your account is active and for as long as needed to provide and protect the Service. We use the following inactivity periods:

• Unconfirmed, empty signups: an account that has not confirmed its email and has no garden, entitlement, support/privacy case, retention hold, admin role, or owned file may be permanently removed after 48 hours. We do not send a reminder before this cleanup.
• Confirmed but unused accounts: a confirmed account that has never created a memorial garden may be removed 90 days after registration. We plan notices about 30 days and 7 days before review.
• Accounts that have created a garden: once an account has created a memorial garden, we do not review it for inactivity until three years after its last meaningful owner activity. We plan notices about 90 days, 30 days, and 7 days before review.
• Visitor flowers: a visitor flower, including the name a visitor chooses to display, is kept for seven days so it can appear in the garden. After seven days, it is no longer displayed and is routinely removed from our systems shortly afterward.

Meaningful owner activity includes an authenticated session, garden edits, uploads, signed-in owner tributes or flowers, and account changes. Contributions made by visitors do not reset the owner's inactivity clock. Recent visitor activity is instead flagged for manual review so we can consider circumstances such as a memorial when an owner may no longer be able to sign in.

We postpone inactivity cleanup when an account has an open support or privacy request, an active account-deletion request, or a legal, security, test-account, or other documented retention hold. We may also retain limited records where required for legal, fraud-prevention, security, dispute, accounting, or compliance purposes.

Inactivity cleanup is separate from account deletion you request. When you request deletion, we verify the request and apply a 72-hour security hold before processing. We aim to permanently delete or de-identify your personal data, gardens, and associated content within one calendar month after deletion processing begins, except where a documented legal or operational retention exception applies.

5. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update inaccurate or incomplete information via your account Settings.
• Deletion: Delete your account and all associated data via Settings, or by contacting us.
• Notification preferences: Manage email notification preferences in your account Settings.
• Optional account notifications: You can manage optional account notifications in Settings. We do not currently send marketing emails. Required account, security, privacy, billing, and account-deletion emails cannot be opted out of.

To exercise these rights, contact us at our contact page.

6. Security

We use safeguards such as encryption in transit (HTTPS/TLS), access controls including row-level security on our database, and authentication provided by Supabase. We do not store plaintext passwords in our application. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

8. International Users

Rainbow Bridges is operated from the United States. If you access the Service from outside the US, your information may be transferred to and processed in the US, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

9. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version and update the "Last updated" date at the top of this page. For material changes, we will notify registered users by email or in-app notice when the changes take effect. Where applicable law requires advance notice or consent, we will provide it before the change takes effect.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at our contact page.