Privacy

• We do not read your messages as a matter of course, and nothing here reads them automatically.
• We do not train anything on them, sell them, or analyse them for advertising.
• We can open them, and there are narrow occasions when we will — always with a reason typed at the time, always written down, and you can read that record yourself.
• You can take everything out, or delete everything, at any time.

Your name, date of birth and address — the last two exist for one reason only: so a death certificate can be matched against your account when somebody says you have died. Without them, anyone could unlock any vault.

Your recordings, photographs, letters and documents. The people you have named, with whatever contact details you gave us. A date of birth for a recipient only when you have scheduled something for a particular age.

A record of what happened and when — that a message was sent, that an executor signed in, that a certificate was reviewed. It never contains message content.

You see everything in your account. Your executor sees none of it — they can confirm your death and nothing else. Each recipient sees only the messages you addressed to them, and only after they are sent.

We can open your messages, and we would rather say so than let you believe a thing about your own last words that is not true. We do not do it as a matter of course, no system here does it automatically, and it is not how we run the company. There are three occasions when it happens: you ask us to, a valid court order requires it, or we are investigating something that cannot be resolved any other way — a report of abuse, or a dispute about what was sent.

Every one of those is the same procedure. A member of staff types a reason before anything is shown to them. Their name, the time and that reason go into a record that can be added to and never edited, by them or by anyone here. You can read it — it is at what has happened in your account, and it lists every administrative look at your account, not only the ones that opened a message. Where a court order forbids us from telling you, we cannot; in every other case we will.

Your files are encrypted, access-controlled and audited. They are not end-to-end encrypted. End-to-end means only you hold the key, and you will be dead at exactly the moment the key is needed. Somebody has to be able to open these files without you.

So this is a relationship of trust, backed by access controls and an audit log, rather than a mathematical guarantee. We would rather say that plainly than let you believe something that is not true about your own last words.

• Supabase — the database and sign-in.
• Cloudflare R2 — where your files are stored.
• Postmark — sends the emails.
• Twilio — sends the optional text nudge. It never contains message content.
• Stripe — takes payment. We never see your card number.
• Vercel — runs the website and the hourly delivery job.

Each is used only for the job listed. None of them is permitted to use your material for their own purposes.

Your messages stay until they are delivered, or until you delete them — whichever comes first. After your vault is released we keep delivering for as long as your plan promised.

The record of what happened outlives the account, because it is the only defence if a release is ever disputed. It holds no message content.

Take a copy of everything, correct anything, or delete everything — all from your account page, without asking us and without giving a reason. Messages already delivered are in somebody else’s inbox and cannot be recalled.

Questions, or a complaint: privacy@lastinglove.example.