Privacy Policy

Last updated: October 6, 2026 · Beta

Legacy is in private beta, and this policy may change as the product does. We'll update the date above when it does. This page describes what the app actually stores and sends today — written for a person, not a lawyer.

The short version

Almost everything you enter into Legacy — vault notes, accounts, bills, loans, beneficiaries, documents, your readiness checklist, and your obituary — is encrypted in your browser before it ever reaches our servers. We store the encrypted result and cannot read it. A few things are not encrypted, because the product needs to read them to work (your email and your survivor contacts) — they're listed below.

What's encrypted, and what isn't

Your vault passphrase never leaves your browser. It's used to derive an encryption key on your device (PBKDF2 with 600,000 iterations, then AES-GCM), and that key encrypts your data before it's sent anywhere. What we store for these record types is only ciphertext and an initialization vector (IV) — never the plaintext, never your key:

• Vault notes
• Financial accounts
• Bills and loans
• Beneficiaries
• Documents (both the file content and its metadata, like the filename)
• Your readiness checklist
• The message you write for your survivor
• Your obituary answers and draft

One record type is not encrypted, because our servers need to read it to do their job:

• Your survivor check-in setup. The email addresses of the survivors you name, the note you write for them to see when access is released, the first name you want the email to call you, and your hint about where the recovery code is kept (never the code itself) are stored in readable form so we can email them and show them your note when the time comes.

What we store about your account

Beyond your encrypted records, we keep a small amount of account data in readable form:

• Your email address, so you can sign in and so we can reach you.
• A one-way cryptographic hash of an authentication verifier your browser derives from your passphrase — not your passphrase itself, and not something we can turn back into your passphrase or your encryption key.
• If you use Google sign-in or a passkey, the identifiers needed to make that work (for example, a passkey's public key) — never a password or your encryption key.
• Basic account metadata: when your account was created and when you were last seen.

If you make share cards

Share cards are a second way for your family to get in, alongside or instead of the recovery code: you print a few cards, and any two of them (or however many you choose) open your Legacy together. One card on its own opens nothing. Here is exactly what we store:

• How many cards you made, how many it takes to open your Legacy, a random label for the set, and when you made them and when they were first used. These are readable, so we can show you your setup and tell your contacts how many cards to gather.
• One-way checks of the cards, so we can tell a right card from a wrong one. We can't turn those checks back into a card.
• A copy of your encryption key, locked by the cards together. We can't open it.
• The names you give the people holding each card, encrypted. We can't read them.

We never see a card. Your browser makes them, and they go only onto the paper you print. When your family uses them, their browser puts the cards together and sends us only a one-way check, never the cards. That is also why we can't reprint a lost card.

If you're helping after someone's death

Someone who used a survivor recovery code or share cards can choose to join, so they can come back later with their own password instead of the code, and share a family plan with the other people helping. Here is exactly what that stores:

• The email address you join with, when you joined, when you last visited, and, if your access is removed, when that happened (revokedAt) — readable, so the person who named you can see who has joined and remove anyone's access at any time. Removing someone fully also requires the owner to change the survivor code (or make new share cards), because anyone who still has the old code or enough of the old cards could join again.
• A salted, one-way verifier of your password. Your password never leaves your browser, and we can't turn the verifier back into it. We also store a copy of the encryption key, locked by your password in your browser — we can't open it.
• The shared plan itself — which tasks are done, who's handling what, anyone's notes, which helper is the executor, the status and amounts the family writes for each account or policy, and the days the family marks as hard. It's encrypted with the same key as everything else, so we can't read it. Alongside it we keep the plan's version number and when it was last updated, which are readable and are how we tell that two people saved at once.
• Memories the family writes — the words and any photo. A photo is shrunk in the browser and kept inside the encrypted memory, so we can't read the words or see the photo. Alongside each memory we keep, readable, when it was added and which helper wrote it (an internal id, not a name or email). That is only so a helper can remove their own memories and no one else's. Memories are deleted with the account.

People who have joined can also download the documents they were left, using their own sign-in. The files are decrypted in their browser, not on our servers.

After you join, we may send you an occasional reminder. We store the date of your next reminder, how often you'd like to hear from us (normal, gentler, or paused), and when we last emailed you or you last answered a check-in. Reminder emails never contain anything from the plan or records, and every reminder has a link to pause them.

Some reminders also include three links (“I'm okay”, “It's a lot”, “Pause for now”). Opening one shows a page to confirm; confirming changes how often we write and records the time. We don't keep which answer was chosen beyond the resulting frequency. Those links don't expire, but they can only change reminder frequency; they can't open or reveal anything.

We email the person who named the survivors the first time anyone opens their Legacy with the survivor code, and again after they change the code. In the same way, we email them the first time anyone opens their Legacy with share cards, and again after they make new cards. Those emails say that it happened, never what's inside, and never which cards were used.

What we can't do

Because we never receive your passphrase or your encryption key, we cannot read your encrypted records, and we cannot recover them for you. If you lose both your passphrase and your recovery code, that data is permanently unreadable — including to us. This is a deliberate tradeoff of zero-knowledge design, and we'd rather tell you plainly than let it be a surprise.

Who else sees your data

Legacy uses three outside services, and only for what each one needs to do its job:

• Resenddelivers transactional email — sign-in links, check-in reminders, survivor release notices, and the optional reminders for people helping. Resend sees the recipient's email address and the message content (for example, your survivor note), but never your passphrase or encrypted records.
• Anthropicpowers the in-app assistant and the obituary drafter. To generate or revise an obituary, your browser sends your answers to Anthropic as plain text for that one request, since it needs to read them to write with them — the finished draft is encrypted before it's saved. The assistant works the same way: it only ever receives what your own browser decides to decrypt and send for a given question — never a blanket copy of your vault. If you ask it about your accounts, your browser decrypts just those accounts and sends them along with your question; nothing else is shared. The same is true when someone you trusted uses “Ask a question” after you're gone: their question, a list of the steps on their plan (titles and the state, no record contents), and only the parts of your records that question needs are decrypted in their browser and sent to Anthropic for that one answer. We don't store the question, the answer or those records, and we don't log them.
• Microsoft OneDrive stores our nightly backup of the database. Each backup is encrypted before it leaves our server, and the key to open it is kept separately, not on that server and not in OneDrive. Your records are already encrypted by your browser, so a backup holds them in the same unreadable form.

Voice input in the assistant, where your browser offers it, is transcribed by your browser on your own device. The audio isn't sent to us or to anyone else; if your browser can't do that on the device, we don't offer voice input at all.

We don't sell your data, and we don't share it with anyone else for advertising or marketing.

Cookies and tracking

Legacy sets exactly one cookie: a session cookie that keeps you signed in. It's httpOnly(your browser's JavaScript can't read it) and is removed when your session ends or you sign out. We don't use analytics scripts, advertising trackers, or any third-party cookies.

What the beta itself records

Running a private beta adds four small things, none of which touch your vault:

• The waitlist. If you ask for an invite from our home page, we store your email address and the date you asked, readable, for one purpose: to invite you. We remove it by hand when we send your invitation, or whenever you ask, and we never share it or email you for anything else.
• Your invite code.We store a one-way hash of it, plus which account redeemed it, so a code can't be reused past its limit. The code itself is not stored, which is also why we can't show it to you again.
• Email confirmation links.Also stored as a one-way hash, valid for 72 hours and single-use, so a link captured from a proxy log or a browser's history is worthless.
• Crash reports.If a page breaks, your browser sends us three things: an error reference number, the path you were on, and which part of the app caught it. No error message, no stack trace, no page content — deliberately, because on a product like this any of those could carry decrypted information. We don't use a third-party error-tracking service for the same reason. Reports aren't tied to your account, and we delete them after 90 days.

Deleting your data

You can delete your account from your account page. You'll confirm with your passphrase, we'll email you, and you'll be signed out everywhere. For the next 7 days the account is locked, the inactivity check-in is paused, and the recovery code and share cards you gave anyone stop working. Sign back in during those 7 days to keep it. After that, every record tied to it — vault notes, accounts, bills, loans, beneficiaries, documents, your readiness checklist, survivor setup, the shared family plan, the accounts of people who joined to help, and your obituary — is deleted permanently from the live database. Our encrypted nightly backups can still hold a copy for up to 90 days, until those backups are replaced.

You can also download everything first, from the same page. The download is decrypted in your browser, so its contents never reach our servers — and it isn't encrypted once it's on your device.

Questions

This is a beta product and this policy will keep evolving with it. If anything here is unclear, or you want to know more about how a specific feature handles your data, ask — we'd rather explain than have you guess.

Write to support@spinachcreations.com and a person will read it.