Privacy & Security

• (i) User Data: personal information relating to individuals who create an account and use the Service (“Users”).
• (ii) Loved Ones Data: personal information relating to a deceased individual or an individual for whom a User is pre-planning, entered by the User into the Service.
• (iii) Collaborator Data: personal information relating to individuals invited by a User to access a shared checklist (“Collaborators”).
• (iv) Visitor Data: personal information relating to individuals who visit our website without creating an account (“Visitors”).

If you are a User, Collaborator, or Visitor, please read this Privacy Policy carefully. You are not legally required to provide us with any personal information. If you do not wish to provide it, please do not create an account or use the Service.

For information about our use of cookies, please see our Cookie Policy at joinomuna.com/cookies.

Our promise to you

1. Information we collect

A. Information you provide directly

• Account Details: Your name, email address, and location (city/state) when you create an account.
• Information About Your Loved One: Name, date of passing, and other details you choose to enter to personalize your checklist (such as address, employer, or religious preferences).
• Estate and Financial References: References to financial accounts, insurance policies, property, or legal documents entered as part of tracking your tasks.
• Funeral and Memorial Preferences: Details about service plans, burial or cremation preferences, or provider selections.
• Family and Contact Information: Names, relationships, and contact details of family members, beneficiaries, or other individuals relevant to your checklist tasks.
• Collaborator Information: Names and email addresses of people you invite to share your checklist.
• Notes and Comments: Any notes you or your Collaborators add to tasks.
• Community Content: Posts, comments, and other content you share in Community Features (forums, support groups, discussion threads). See Section 8A for details on community data visibility and controls.
• Communications: Messages you send us through support or feedback channels.

C. Information collected automatically

• Usage Data: How you interact with the Service (pages visited, features used, time spent) so we can improve the experience. This data is anonymized and never tied to your personal details.
• Device Information: Browser type, operating system, device type, IP address, and screen size to ensure the Service works properly on your device.
• Cookies and Tracking Technologies: We use essential cookies to keep you logged in and remember your preferences. With your consent, we also use analytics cookies (Google Analytics) and advertising cookies (Google Ads, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, X Pixel) to understand how visitors use the Service and to deliver relevant advertising. For full details, see our Cookie Policy at joinomuna.com/cookies.
• Log Data: Server logs that record your IP address, browser type, referring/exit pages, and timestamps. These are retained for 90 days and then automatically deleted.

D. Information we never collect

• Medical or health records
• Biometric data (fingerprints, facial recognition, etc.)
• Payment information (Omuna is free — we do not collect credit card or banking details for payment purposes)

E. Categories of sources

We collect personal information from:

• Directly from you: When you create an account, use the Service, communicate with us, or provide feedback.
• Automatically: Through cookies and server logs when you visit or use the Service.
• From Collaborators: When a User invites you as a Collaborator, providing your name and email address.

We do not purchase personal information from data brokers or third parties.

2. How we use your information

We use your information only for the following purposes:

1. 1To Operate the Service — Save your progress, sync between devices, and share with Collaborators you've invited.
2. 2To Personalize Your Experience — Tailor checklist phases and tasks to your situation (for example, showing state-specific legal requirements based on your location).
3. 3To Show You the Directory — Use the ZIP code or state you give us to show nearby listings when you open the directory yourself. Omuna does not build recommendations from your checklist, and nothing about you is sent to a business unless you contact one. See “How Omuna stays free” below.
4. 4To Communicate With You — Send account confirmations, password resets, security alerts, and optional progress reminders you have enabled. You can turn off all non-essential emails at any time.
5. 5To Improve the Service — Understand how people use the Service so we can make it better. This analysis uses anonymized, aggregated data only.
6. 6To Protect the Service — Detect, prevent, and address fraud, unauthorized access, or other illegal activity.
7. 7To Comply With Law — Respond to legal process and comply with applicable legal obligations.

With your consent (via our cookie banner), we may use cookies and pixels to deliver relevant advertising and measure campaign effectiveness. You can manage these preferences at any time. See our Cookie Policy for details.

3. How Omuna stays free

Omuna is free for every family, and free for every business we list. This section says exactly what that means today, including the part most companies leave vague: who pays us, and for what.

How it works today

Omuna publishes a public directory of funeral homes, estate attorneys, cemeteries and crematoriums, grief support and hospice services, veteran services, and foreign consulates. Listings are compiled from public sources, and a business can claim its own listing to keep the details current.

Today, nobody pays Omuna anything. Families pay nothing. Providers pay nothing to be listed, nothing to claim a listing, and nothing when a family contacts them. We charge no referral fee, no commission, and no placement fee, and there is no paid tier or sponsored position to buy — so nothing you see in the directory has been ranked or recommended because of money.

That is not a permanent business model, and we would rather say so than imply one exists. If Omuna ever introduces referral fees, commissions or paid placement, we will describe it in this section before it goes live, and any listing or recommendation affected by a commercial arrangement will be labelled where you see it.

What providers receive

How listings get into the directory

Most listings are imported in bulk from public records and public business data. We do not vet, endorse, rate or rank the businesses in the directory, and a listing is not a recommendation from us.

A business can claim its listing by proving it controls the email address on file. An Omuna teammate reviews each claim by hand, and an approved listing shows a Verified badge. Verified means precisely that — the claim was checked — and says nothing about the quality, licensing or pricing of the business.

If a listing is wrong, out of date, or shouldn't be there, email [email protected] and we'll correct or remove it.

Your control

• Contacting a provider is always your choice. The directory is somewhere you go, not something that arrives. Ignoring it entirely changes nothing about your checklist.
• Nothing is recommended to you. The checklist links out to the directory on the “find a funeral home” task. It is a link, not a suggestion of any particular business, and no one paid for it.
• No data is shared without your action. We never proactively send your information to a business. It is sent only when you submit an inquiry through a listing.
• Placement is not for sale. There is no sponsored slot or paid ranking in the directory, so nothing you see there has been influenced by money.

4. Data location and transfers

Omuna's infrastructure is hosted using Neon (database), GitHub (deployment), and Cloudflare (CDN and security), with data centers located in the United States. Your personal information is processed and stored in the United States.

If you are located outside the United States, please be aware that your personal information will be transferred to, processed, and stored in the United States, where data protection laws may differ from those in your jurisdiction.

For Users in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office (ICO), respectively, to ensure adequate protection of your personal information during transfer to the United States. You may request a copy of the applicable SCCs by contacting us at [email protected].

For Users in Canada: Your personal information is processed in the United States, where it may be accessible to law enforcement and national security authorities under U.S. law. By using the Service, you consent to this transfer.

5. Data retention

When personal information is no longer required, we securely delete or anonymize it in accordance with our data retention practices and applicable laws.

6. Data disclosure

We disclose personal information only in the following circumstances:

Service providers

We work with a small number of trusted providers to operate the Service:

These providers are contractually required to protect your data, can only access the minimum needed for their service, and cannot use your data for their own purposes. We maintain Data Processing Agreements (DPAs) with all service providers to ensure they process your data only as instructed and in compliance with applicable privacy laws.

Advertising partners receive data only when you have consented to advertising cookies through our cookie consent banner. For details on how to manage your cookie preferences, see our Cookie Policy at joinomuna.com/cookies.

• Directory listings: As described in “How Omuna stays free,” a business in our directory receives your information only if you affirmatively submit an inquiry through its listing. See that section for exactly what is and isn’t sent.
• Collaborators: When you invite a Collaborator, they can see tasks, notes, and progress within the shared checklist, subject to the access controls described in Section 8.
• Legal Compliance: We will disclose personal information to law enforcement or government authorities only if legally required by a valid subpoena, court order, or other binding legal process. If permitted by law, we will notify you before any disclosure.
• Safety: We may disclose personal information if we believe in good faith that disclosure is necessary to protect the rights, property, or personal safety of Omuna, our Users, or the public.
• Business Transfers: If Omuna is involved in a merger, acquisition, or sale of all or a portion of its assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service of any change in ownership or uses of your personal information.

7. Data security

Encryption

• In Transit: All data sent between your device and our servers is encrypted using TLS 1.2 or higher.
• At Rest: All personal data stored on our servers is encrypted using AES-256 encryption.
• Sensitive Fields: Financial account numbers, policy numbers, Social Security numbers, and legal document details receive additional field-level encryption.

Access controls

• Only a small number of authorized team members can access user data, and only when necessary to provide support or maintain the platform.
• All access is logged and audited.
• Team members with data access undergo background checks and sign confidentiality agreements.
• No team member can access decrypted sensitive fields without a documented support reason and a second team member's approval.

Authentication

• Passwords are hashed using bcrypt and are never stored in plain text.
• Sessions expire after 7 days of inactivity.

Infrastructure

• Omuna is hosted using Neon, GitHub, and Cloudflare with data centers in the United States.
• We perform regular security assessments and vulnerability testing.
• Automated monitoring alerts our team to unusual activity 24/7.

Breach notification

In the unlikely event of a data breach that affects your personal information, we will:

• Notify affected Users by email within 72 hours of confirming the breach
• Notify relevant state attorneys general and regulatory authorities as required by applicable law
• Provide information about the nature of the breach, the data affected, and steps we are taking to address it

While we implement industry-standard security measures, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

8. Collaborator privacy

• Invitation Only. No one can access your checklist unless you explicitly invite them.
• Limited Visibility. Collaborators see only the shared checklist — not your email, account details, sensitive financial fields, or other checklists.
• Revocable Access. Remove any Collaborator at any time. Access is revoked immediately.
• Independent Accounts. Each Collaborator has their own account with their own privacy protections.
• Sensitive Field Control. By default, sensitive fields (account numbers, policy numbers) are hidden from Collaborators. You can choose to make specific fields visible on a per-field basis.

8A. Community features privacy

When you use Community Features (forums, support groups, discussion threads), the following applies:

• Visibility: Content you post in Community Features may be visible to other community members. Your display name and any profile information you choose to share will be visible alongside your posts. Do not share information in Community Features that you would not want other members to see.
• Your Control: You can delete your own posts at any time. You control your display name and profile visibility in your account settings.
• Data We Collect: We collect the content you post, your interactions with community content (such as replies), and metadata (timestamps, post frequency) to operate and moderate the Community Features.
• Moderation: We may review Community Content for compliance with our Community Guidelines (see Terms of Service, Section 11). Content that violates our guidelines may be removed.
• Data Retention: Community Content is retained until you delete it or delete your account. When your account is deleted, your Community Content is also removed.
• No Sharing: Community Content is not shared with any business in our directory, and is not used to generate recommendations.

9. Your rights and choices

Regardless of where you reside, we provide all Users with the following rights:

10. US state privacy rights

If you are a resident of a US state with a comprehensive privacy law — including but not limited to California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Kentucky, Nebraska, Minnesota, Maryland, and Rhode Island — you have additional rights under applicable law. These may include:

• The right to know what personal information we collect, use, disclose, and sell/share
• The right to delete your personal information
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of your personal information (Omuna does not sell your personal information)
• The right to opt out of targeted advertising (Omuna does not engage in targeted advertising)
• The right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects (Omuna does not engage in such profiling)
• The right to data portability
• The right to non-discrimination for exercising your privacy rights
• The right to appeal if we decline to act on your request

To exercise any of these rights, contact us at [email protected].

We will verify your identity before processing your request. We will respond to verified requests within the timeframes required by applicable law (generally 30-45 days, with extensions where permitted).

California residents (CCPA/CPRA)

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Categories of Personal Information Collected: Identifiers (name, email, IP address); geolocation data (city/state); customer records information; internet or other electronic network activity information; and inferences.
• Categories of Sensitive Personal Information: Financial account numbers, Social Security numbers (if voluntarily provided by the User as part of estate tracking).
• Sale/Sharing for Targeted Advertising: With your consent (via our cookie banner), we may share internet activity information, device identifiers, and approximate geolocation data with our advertising partners (Google, Meta, TikTok, LinkedIn, X) through cookies and pixels for purposes of targeted advertising. Under the CCPA, this may be considered “sharing” of personal information. You may opt out at any time by adjusting your cookie preferences through the “Your Privacy Choices” link in our website footer, or by enabling Global Privacy Control (GPC) in your browser.
• Business Purpose Disclosures: We have disclosed identifiers and internet activity information to our service providers (Neon, Cloudflare, Resend) for the business purposes described in this Privacy Policy.
• Do Not Track / Global Privacy Control: Omuna does not track Users across third-party websites. We honor Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we will treat it as a valid opt-out request under applicable law.
• Shine the Light: California Civil Code Section 1798.83 permits California residents to request information regarding the disclosure of personal information to third parties for direct marketing purposes. Omuna does not disclose personal information to third parties for their direct marketing purposes.

Virginia residents (VCDPA)

Virginia residents have the right to access, correct, delete, and obtain a copy of their personal data, and the right to opt out of the processing of personal data for targeted advertising, sale, or profiling. Omuna does not engage in any of these activities. To exercise your rights or appeal a decision, email [email protected].

Colorado residents (CPA)

Colorado residents have the right to opt out of targeted advertising, sale of personal data, and certain profiling. Colorado residents also have the right to access, correct, delete, and obtain a portable copy of their personal data. To exercise your rights or appeal a decision, email [email protected]. You may also contact the Colorado Attorney General at coag.gov.

Texas residents (TDPSA)

Texas residents have the right to access, correct, delete, and obtain a copy of their personal data, and the right to opt out of the processing of personal data for targeted advertising, sale, or profiling. To exercise your rights or appeal a decision, email [email protected].

Other US states

If your state has enacted a comprehensive privacy law not listed above, you may still exercise your rights by emailing [email protected]. We will respond in accordance with applicable law.

11. For European residents (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK):

Legal basis for processing

We process your personal data on the following legal bases:

• Consent: Account creation, directory inquiries you submit, optional communications
• Legitimate Interest: Operating and improving the Service, fraud prevention, security
• Legal Obligation: Compliance with applicable laws

Your rights under GDPR

In addition to the rights listed in Section 9, you have the right to:

• Object to processing based on legitimate interest
• Restrict processing of your personal data
• Lodge a complaint with your local supervisory authority

• Data Protection Officer: Reach our DPO at [email protected].
• Data Transfers: See Section 4 for information about how we protect your data when transferring it to the United States.
• Data Portability: Request your data in a machine-readable format by emailing [email protected].
• Right to Be Forgotten: Request erasure of your personal data, subject to applicable legal exceptions.

12. For Canadian residents

If you are located in Canada, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation. You have the right to access, correct, and request deletion of your personal information. To exercise these rights, contact [email protected].

13. Children's privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from individuals under 18. If we learn that we have collected personal information from a person under 18 without verification of parental consent, we will delete that information promptly. If you believe a child under 18 has provided us with personal information, please contact us at [email protected].

14. Do Not Track signals

We honor Global Privacy Control (GPC) signals as valid opt-out requests under applicable US state privacy laws. When your browser sends a GPC signal, we will treat it as a request to opt out of the sale or sharing of your personal information and targeted advertising via cookies.

We do not currently respond to browser-level "Do Not Track" signals due to the lack of an industry standard for interpretation. You can manage your cookie and tracking preferences through our cookie consent banner and the "Your Privacy Choices" link in our website footer.

15. Communications

• Service Communications: We may send you service-related messages, including account confirmations, password resets, security alerts, and notifications about changes to the Service or these policies. You cannot opt out of these communications while your account is active, as they are integral to the Service.
• Optional Communications: With your consent, we may send progress reminders or other helpful notifications. You can opt out of these at any time through your account settings or by clicking “unsubscribe” in any email.

We comply with the CAN-SPAM Act. All commercial emails include a clear unsubscribe mechanism and our physical mailing address.

16. Changes to this policy

If we make significant changes to this Privacy Policy, we will:

• Notify you by email at least 14 days before the changes take effect
• Post a clear notice on our website
• Update the “Last updated” date at the top of this page

We will never make changes that reduce your privacy protections retroactively without giving you advance notice and the opportunity to delete your account first.

17. Contact us

Follow us: @joinomuna on X, Facebook, and LinkedIn