Privacy Policy

Last updated: July 22, 2026

Legacy Vault stores sensitive information about your estate. We treat that responsibility seriously. This policy explains what we collect, why, and how it's protected.

1. What we collect

• Account data: name, email, password hash.
• Vault contents: asset records, attachments, notes, and the contacts you designate as heirs or executor.
• Operational data: check-in timestamps, release requests, audit logs, email delivery status.
• Verification documents: death certificates uploaded by heirs (private, admin-reviewed only).

2. How we use it

• To operate the vault, check-in timer, and release workflow.
• To email you, your heirs, and your executor about events you've configured (check-in reminders, release triggers, unlock notices).
• To verify death certificates before unlocking a vault.
• To protect the service against fraud and abuse.

We do not sell your personal information and we do not use vault contents for advertising or training AI models.

3. Who can see what

• You see everything in your vault.
• Your heirs see only the metadata you allow them to see while the vault is locked, and the full contents only after the vault is unlocked.
• Your executor has the ability to trigger a release but cannot see vault contents unless they are also a designated heir.
• Our admins review death certificates to verify releases. They do not browse vault contents in the normal course of business.

4. Security

Data is stored on managed infrastructure with row-level security policies that scope every read to the owning user (or to an authorized heir after unlock). Attachments and death certificates are stored in private buckets accessible only via signed URLs. Connections are encrypted in transit (TLS) and at rest.

5. Email & communications

We send transactional emails required for the service to function (check-in reminders, release notices, security alerts). These cannot be fully turned off without disabling the corresponding feature. Marketing emails — if any — are opt-in and include an unsubscribe link.

6. Data retention

We keep your vault for as long as your account is active. If you delete your account, we delete or anonymize your data within 30 days, except where retention is required by law (for example, audit logs of past releases).

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data. Email privacy@thelegacyvault.ai and we'll respond within 30 days.

8. Subprocessors

We use vetted providers for hosting, database, email delivery, and authentication. We require them to meet equivalent security and privacy standards.

9. Changes

We'll notify you of material changes by email or in-app notice. Continued use after the effective date means you accept the updated policy.

10. Contact

Privacy questions: privacy@thelegacyvault.ai.