Privacy

Privacy at Legacy Guard

This page states the commitments Legacy Guard already makes in the way the product is built. The full privacy policy is being finalized with counsel and will replace this page; nothing in it will weaken what is written here.

What we collect

For each household: the household name, each person's name, email, and phone, the plan type (Basic, Complete, trial, Kept, or a 20 year hold), who pays, renewal and expiration dates, storage used as a number, which firm and attorney serve the household, and a few dates and flags such as when the household was created or whether deletion was requested. For a reported passing: the facts verification needs, listed on the security page.

Across the platform we see four story totals (stories saved, pictures saved, hours of video, hours of audio), never a number per person, household, or firm.

What we never see

The contents of any plan: reviews, answers, flags, assets, documents, the plan visual, the people named. The contents of any story: stories, photos, recordings, letters, recipients, the personal message, the guide's questions and answers, Organizer entries, digital asset notes. The database refuses to hand the platform those rows, and the Stories side is encrypted on the person's device besides.

Encryption

Every story, photo, recording, letter, Organizer entry, digital asset entry, and personal message is encrypted in the person's browser before it is saved, with a key only that person's stories password can open. A copy of each person's key is held in escrow, split between two places, and combined in memory only for a release after two verifiers approve a passing or for a password reset the person asked for. Each such moment is written to an audit log that cannot be edited. The plan side is encrypted at rest in storage and is readable by the household and its firm, as it must be.

Who we share with

Your firm sees your Plan side and nothing of your Stories side. Your recipients see only the items you chose for them, when you chose. We use a hosting provider, a database provider, an email provider, and a payment provider to run the service; each holds only what its job needs, and none of them can read a story. We do not sell data, rent lists, or share information for advertising. There is nothing to sell.

How long we keep things

• Recipients can reach what was delivered for two years from release, with a warning at month 20.
• When Complete ends, everything stays readable, exportable, and deliverable for two years (Kept mode), then twelve monthly notices name a deletion date at 36 months unless the plan is reactivated, a 20 year hold is bought, or everything is exported.
• A trial that was never paid keeps its stories readable for 90 days, then the Stories side is deleted.
• Deleted stories sit in Recently deleted for 30 days.
• Nothing is deleted while a verification about the household is open.

Deleting your account

From the Account page, after an export nudge and a typed confirmation. A 30 day undo window with an emailed link. Only the person who asked is removed; the household's plan and the spouse's own stories stay. A single person household is deleted whole.

Your information is yours

Export everything is available on every plan. The archive is built on your own device and works without Legacy Guard.

Questions

Write to hello@legacyguard.app.