Privacy Policy

What we collect

What you write

Your profile, timeline entries, stories, photographs, audio recordings, family tree, and Vault contents. All of it is provided by you, and none of it is required — an account with nothing in it is a perfectly valid account.

Account information

Your email address and a hashed password, held by our authentication provider. We never store your password itself. If you set a Vault PIN, we store a hash of it, not the PIN.

What we do not collect

Legacy carries no advertising trackers, no analytics pixels, and no third-party scripts that profile you. We do not buy data about you, and we do not sell or rent what you give us. There is no advertising-driven profile of you anywhere in this product.

How your content is protected

Every piece of content carries a visibility setting — Private, Limited to an audience you name, or Public — and new content is Private until you change it.

That setting is enforced in the database itself, on every single read, rather than by the screen that happens to be displaying it. A mistake in a page cannot show your private entries to someone with no right to them, because the database returns nothing for them in the first place.

Data is encrypted in transit. Vault contents carry a layer of encryption on top of that. Photographs and recordings live in private storage and are served through short-lived links rather than public URLs.

What we can see

Legacy is not end-to-end encrypted, and we will not claim otherwise. Your content is encrypted with keys our systems hold, which means our systems can technically read it — including your Vault. This is not an oversight; it is what allows your Vault to be released to the people you designated after your death, which is the entire point of storing it with us rather than in a drawer.

In practice, access is restricted to the small number of people who operate the service, and only where it is needed to run it, fix it, or comply with a legal obligation. Treat this as a statement about who we are and how we behave, not only about what the software makes impossible.

Who else sees your information

People you choose: anyone you add to your audience, anyone you invite into your family tree, and — for content you have marked Public — anyone at all, including search engines, once you publish your Legacy page.

Publishing works as two separate decisions, and it is worth understanding the difference. Choosing a page address makes your Legacy reachable by anyone who has the link. Marking yourself discoverable additionally makes you findable by name in search. You can do the first without the second.

The companies that host the service on our behalf also process your data in order to provide it — principally our database and storage provider, and our email provider for the messages Legacy sends you. They act on our instructions and are not permitted to use your content for their own purposes.

Businesses listed in the Marketplace are independent third parties. If you contact one, what you tell them is governed by their privacy practices and not by this policy.

We disclose information to authorities only where we are legally required to, and we will tell you when we are permitted to tell you.

After your death

Content you marked Public becomes a memorial page. Content you marked Private or Limited does not, and does not become public by default at any point.

Your Vault is released only to the people you designated, and only through a review step with a record of what happened — never by an automatic switch that a single person can flip. Someone claiming you have died is not sufficient on its own.

How long we keep things

Your content stays until you delete it or your account is closed. Deleting an entry removes it; deleting your account removes your content, subject to a short period during which backups still contain it before they age out.

A published memorial page is intended to persist after death — that is what it is for — and can be taken down at the request of the person you designated, or of a close relative who can establish their relationship to you.

Your choices

• Change the visibility of any item, at any time, individually or in one sweep across everything.
• Remove someone from your audience, which takes effect at once.
• Unpublish your Legacy page, or stop being discoverable by name.
• Delete any entry, story, photograph, recording or Vault item.
• Delete your account, from Settings. Your Legacy stops being visible to anyone else immediately, and everything in it — including every photograph and recording — is permanently destroyed 30 days later. Signing back in during those 30 days cancels it. You can also request a copy of your data by email.

Depending on where you live you may have additional rights over your personal data, including access, correction, deletion, portability, and objecting to certain processing. Ask and we will honour them; we do not require you to cite a statute to be taken seriously.

Children

Legacy is not intended for people under 16, and we do not knowingly create accounts for them. You may of course write about children in your own Legacy — that is your account and your content, and the same visibility rules apply to it.

Changes to this policy

If we change it in a way that materially affects you, we will tell you rather than quietly updating the date at the top.

Contact

Questions about any of this, or a request about your data, go to our contact page.