Privacy Policy

Last updated: September 10, 2026 · Beta

Legacy is in private beta, and this policy may change as the product does. We'll update the date above when it does. This page describes what the app actually stores and sends today — written for a person, not a lawyer.

The short version

Almost everything you enter into Legacy — vault notes, accounts, bills, loans, beneficiaries, documents, and your readiness checklist — is encrypted in your browser before it ever reaches our servers. We store the encrypted result and cannot read it. A few things are not encrypted, because the product needs to read them to work (your email, your survivor contacts, and your obituary draft) — they're listed below.

What's encrypted, and what isn't

Your vault passphrase never leaves your browser. It's used to derive an encryption key on your device (PBKDF2 with 600,000 iterations, then AES-GCM), and that key encrypts your data before it's sent anywhere. What we store for these record types is only ciphertext and an initialization vector (IV) — never the plaintext, never your key:

• Vault notes
• Financial accounts
• Bills and loans
• Beneficiaries
• Documents (both the file content and its metadata, like the filename)
• Your readiness checklist
• The message you write for your survivor

Two record types are not encrypted, because our servers need to read them to do their job:

• Your obituary intake and draft.To draft an obituary, we send your answers to our AI provider and store the resulting draft in readable form so you can revise it. Don't put anything in the obituary tool you wouldn't want stored as plain text.
• Your survivor check-in setup. The email addresses of the survivors you name, and the note you write for them to see when access is released, are stored in readable form so we can email them and show them your note when the time comes.

What we store about your account

Beyond your encrypted records, we keep a small amount of account data in readable form:

• Your email address, so you can sign in and so we can reach you.
• A one-way cryptographic hash of an authentication verifier your browser derives from your passphrase — not your passphrase itself, and not something we can turn back into your passphrase or your encryption key.
• If you use Google sign-in or a passkey, the identifiers needed to make that work (for example, a passkey's public key) — never a password or your encryption key.
• Basic account metadata: when your account was created and when you were last seen.

What we can't do

Because we never receive your passphrase or your encryption key, we cannot read your encrypted records, and we cannot recover them for you. If you lose both your passphrase and your recovery code, that data is permanently unreadable — including to us. This is a deliberate tradeoff of zero-knowledge design, and we'd rather tell you plainly than let it be a surprise.

Who else sees your data

Legacy uses two outside services, and only for what each one needs to do its job:

• Resenddelivers transactional email — sign-in links, check-in reminders, and survivor release notices. Resend sees the recipient's email address and the message content (for example, your survivor note), but never your passphrase or encrypted records.
• Anthropicpowers the in-app assistant and the obituary drafter. The obituary tool sends your intake answers as plain text, since that record isn't encrypted. The assistant is different: it only ever receives what your own browser decides to decrypt and send for a given question — never a blanket copy of your vault. If you ask it about your accounts, your browser decrypts just those accounts and sends them along with your question; nothing else is shared.

We don't sell your data, and we don't share it with anyone else for advertising or marketing.

Cookies and tracking

Legacy sets exactly one cookie: a session cookie that keeps you signed in. It's httpOnly(your browser's JavaScript can't read it) and is removed when your session ends or you sign out. We don't use analytics scripts, advertising trackers, or any third-party cookies.

What the beta itself records

Running a private beta adds three small things, none of which touch your vault:

• Your invite code.We store a one-way hash of it, plus which account redeemed it, so a code can't be reused past its limit. The code itself is not stored, which is also why we can't show it to you again.
• Email confirmation links.Also stored as a one-way hash, valid for 72 hours and single-use, so a link captured from a proxy log or a browser's history is worthless.
• Crash reports.If a page breaks, your browser sends us three things: an error reference number, the path you were on, and which part of the app caught it. No error message, no stack trace, no page content — deliberately, because on a product like this any of those could carry decrypted information. We don't use a third-party error-tracking service for the same reason.

Deleting your data

When an account is deleted, every record tied to it — vault notes, accounts, bills, loans, beneficiaries, documents, your readiness checklist, survivor setup, and your obituary — is deleted along with it; nothing is kept behind. During the beta, account deletion is handled by request rather than a self-serve button — reach out and we'll take care of it.

Questions

This is a beta product and this policy will keep evolving with it. If anything here is unclear, or you want to know more about how a specific feature handles your data, ask — we'd rather explain than have you guess.

Write to support@spinachcreations.com and a person will read it.