Privacy

Your email address and a hash of your password. Whatever you choose to record: profile details, documents, assets, possessions, contacts, beneficiaries and recordings. Session records, so you can be signed in. Nothing is collected that you did not enter.

There is no analytics, no advertising, and no third-party tracking on this site.

Your identity documents — Social Security, driver's licence, passport and national ID numbers — every uploaded file and recording, the transcripts you type alongside a recording, and any tax or reference number you record against a beneficiary, are encrypted with a key unique to your account, before they are written to disk. That key is itself encrypted by a master key held outside the database.

A copy of the database on its own therefore reveals none of it. Identity numbers are never included in a page; they are decrypted only when you explicitly ask to see one, one field at a time.

Passwords are hashed with Argon2id and are not recoverable. Session tokens are stored hashed, so the session table cannot be used to impersonate anyone.

Stated plainly, because the distinction matters: names, addresses, phone numbers, dates and document titles are stored unencrypted. They are displayed and sorted constantly, and encrypting them would turn every screen into a decryption exercise. That applies to a beneficiary's name and contact details too — but not to their tax number, which is encrypted and is never shown to a trusted contact at all, because it belongs to someone who never agreed to it being stored.

Transcripts used to be in that list and are not any more. A transcript contains the same words as the recording it describes, and the recording was already encrypted — so leaving the text beside it in the clear protected the harder half of the same secret.

What that does and does not buy, since the difference is easy to overstate: a copy of the database reveals nothing of it. But a transcript is the written alternative to listening, so when you open a recording it is decrypted and sent to your browser like any other text on the page. It is protected at rest, not hidden from the screen.

You, and only the people you name. A trusted contact sees exactly the categories you tick and nothing else, and only where you have marked an item as visible to trusted contacts. Sharing a document with someone grants them that document, not your account.

An emergency-only contact sees nothing until a request has been made and the seven-day window has passed without your refusal.

The people who operate this service can see your account and its contact details — your name, email, phone and address — in order to administer accounts and answer support requests. Every such action is logged. They cannot read what the account protects: your identity document numbers, uploaded files, recordings, beneficiaries and everything else stay encrypted for you and are not readable by an administrator.

Email is used for verification codes, password resets and emergency-access notices. When a delivery provider is configured, the recipient address and message are handled by that provider.

Deleting something moves it to Deleted items, where it can be restored. Deleting it permanently from there removes the record and, for documents and recordings, the encrypted file itself. That cannot be undone.

Deleting your whole account erases everything inside it permanently — profile, identity documents, files, recordings, beneficiaries and the keys that protect them. It cannot be undone. We keep only a minimal record of the account itself — your name, email, phone and address, and the dates it opened and closed — for our administrative and legal records. Nothing from inside the account is kept.

This instance runs on hardware controlled by its operator, and the data stays on it. Backups, if taken, contain the same encrypted values described above.