Privacy Policy

1. What We Collect

Account information

Your email address, your name if you give it, and a password you choose. Your password is handled by our authentication provider, which keeps only a one-way hash of it. Neither they nor we can read it back. You can sign in with that password or with Google instead.

Billing information

Handled by our payment processor. We keep a record of your plan and its status. We never see or store your full card number.

What you put in your vault

Your vault can include:

• Government identifiers — Social Security numbers
• Personal details — date of birth, parents' names and birthplace, and state of residence
• Medicare and health insurance details
• Funeral wishes — and who decides them
• Where a DNR or POLST form is kept
• Religious affiliation
• Regular payments — who you pay, what it is for, how much, how often, and the last four digits of the account paid from
• Financial accounts — account numbers and the institutions that hold them
• Insurance policies
• Where documents are kept — and how to get at them
• Uploaded documents — copies of wills, deeds and similar
• Property and possessions — details of what you own
• People you nominate — names and contact details
• Organ-donor preference
• Any letter you choose to write

Your vault no longer has fields for driver's license or passport numbers. The values stored in those fields were deleted.

What we never ask you to record

Your vault has no field for a password, PIN, security-question answer or two-factor code. We ask only where you keep such things, never what they are.

Technical information

IP address, browser and device type, pages viewed, and approximate country. Analytics are subject to your consent — see section 5.

2. Where It Comes From

Almost all of it comes from you. Some comes from your device automatically. Billing status comes from our payment processor. If you sign in with Google, we receive your email address and basic profile from them.

3. How We Use It

• Service provision: storing your vault and showing it to you and the people you have chosen
• Business operations: billing and account management
• Communication: sending you messages the service requires, including the notices described in section 7
• Safety and security: keeping the service secure and detecting abuse
• Legal compliance: meeting our legal obligations

We use the minimum amount of information required to do this.

We do not sell your personal information, and we do not use your vault contents to train machine-learning models. We read your vault contents only to operate the service, investigate a fault, or comply with the law.

When we send a document to Google to read it, we rely on Google's own commitment not to train on what it's sent. Google does not keep it either.

4. Who We Share It With

We share personal information with service providers who help us run LegacyArk, in these categories:

• Hosting and infrastructure — running the application
• Database and file storage — where your vault and uploaded documents live
• Authentication — signing you in
• Payment processing — taking payment and managing subscriptions
• Email delivery — sending the messages the service requires
• Product analytics and error reporting — understanding how the product is used and detecting faults, subject to section 5
• Address lookup — suggesting addresses as you type one
• Document reading — reading a document's contents with Google, only when you ask, one document at a time
• Marketing measurement — tools that measure whether an advertisement brought you here, only if you allow marketing (section 5)

These providers may only use the information to provide their service to us. We list categories rather than named companies, except where one is named above. You can request the current list at support@legacyark.co.

We disclose information to the people you have chosen, in the way you have chosen. We also disclose it if the law requires it. We disclose it to protect someone's safety or our rights. Section 13 covers disclosure if the business changes hands.

Address lookup, specifically. When you type an address into your vault, the partial text is sent to a third-party address-lookup service to suggest completions, before you save it.

Document reading, specifically. When you ask us to read a document, we send its contents to a third-party document-reading service. It finds and returns the details you asked for. This only happens when you ask, one document at a time.

5. Analytics, Cookies and Session Recording

Two separate choices. Analytics covers understanding how the product is used, including the session recording described below. Marketing covers measuring whether an advertisement or campaign brought someone to us. You can allow one and refuse the other.

What we set. A cookie recording your privacy choices, lasting a year. A sign-in session cookie. If you allow analytics, our analytics provider sets an identifier. If you allow marketing, our tag manager may set its own.

Session recording. Our analytics tool can replay how a page was used. We mask it by default: every form field and every piece of text is hidden in the recording unless we have specifically marked it safe.

Your choice. If you are in the EU, the EEA, the UK or Switzerland, or if we cannot tell where you are, we ask before loading anything. Nothing loads until you say yes. Elsewhere we do not ask first: marketing tags may load, and you can turn them off at any time. Analytics and session recording never start anywhere until you have actively agreed. Closing the banner is not consent.

Global Privacy Control. If your browser sends a GPC signal, we treat it as a refusal, and it overrides any earlier acceptance.

Changing your mind: Privacy Choices, any time, signed in or not.

6. How We Protect It

LegacyArk uses administrative, technical and physical security controls to protect your information.

The most sensitive values are individually encrypted before they are stored:

• Your Social Security and financial account numbers
• Your date of birth
• Your parents' names and birthplace
• Where a crypto recovery phrase is kept
• The federal tax ID of a trust
• Insurance policy numbers
• Usernames for your digital accounts
• Serial numbers of valuables
• Where an original document is kept
• Where a signed DNR or POLST form is kept
• How to get into a safe or safe deposit box
• Where a vehicle or valuable is stored
• Where a device's recovery key is kept
• Who monitors an alarm

When you ask us to read a document, we send its contents to Google in plain text. That includes anything on the list above, before it is encrypted into your record. It only happens when you ask, document by document.

Each record has its own encryption key, and those keys are themselves encrypted with a key that is not kept in the database. Social Security numbers are never shown in part, including the last four digits.

When the product reveals a sealed value, we record it: who, what and when. If that record cannot be written, the value is not shown. Uploaded documents are held in private storage and can only be reached through short-lived links that expire minutes after they are created.

What is not encrypted:

• Names of the people you name
• Their relationship to you
• Their phone numbers
• Their email addresses
• Notes you record about them
• Any letter you write
• Account numbers recorded against debts and utilities
• The regular-payments table: payee, what the payment is for, amount, how often, and the last four digits of the account paid from
• Co-signers and co-borrowers
• Your state of residence
• Funeral wishes and who decides them
• Whether you have a power of attorney, when it takes effect, who must confirm that you cannot decide, and whether it stays valid if you cannot make decisions
• What you want to happen to a business you own
• Religious affiliation
• Insurance details other than policy numbers: policy type, provider, beneficiaries, agent and notes (including Medicare and health insurance)
• Vehicle identification and license plate numbers
• Names of institutions
• The last four digits we display
• Estimated values
• Your answers to the initial setup questions

We cannot ensure or warrant the security of any information you provide to us. If a breach affects your information, we will notify you and regulators as the law requires.

Who at LegacyArk can see it. A small number of staff can access the systems that store your vault, including its contents. We do so only to operate the service, investigate a fault, or comply with the law. Every reveal through the product is recorded. We do not operate a formal access-control function.

7. Access After Death

You choose who can see your vault, and how much. There are three levels: view now, which shows everything except values you have sealed. Edit now is the same, plus editing. After death shows nothing until someone reports your death. It then shows only what the handoff below describes, and after the wait, everything, including sealed values, without editing. Only you can grant, change or revoke access. Paying for your vault, or including it in a Family plan, gives no access to it.

The handoff starts when someone reports that you have died. Anyone you have given access to, at any level, can report once they have accepted. We do not verify the report, and we do not require a death certificate or court document.

Access does not open immediately. We email you when the report is made, and again on days three, seven and thirteen. We also show a notice in the app that cannot be dismissed. Access opens after fourteen days.

If you sign in during the wait, we also ask whether the report is wrong. You can leave that question until later. Signing in does not stop the report by itself.

When a report is made, we also email everyone else who has accepted access to your vault. If the report is stopped, we email them and the person who reported. These emails name the person who reported.

Until access opens, anyone with after-death access can see only your funeral wishes and whether a prepaid funeral plan exists.

You can stop a report by signing in. You can also stop it without signing in, using the link in the most recent email we sent you about it. After you stop it, you can choose to remove the person who reported. Removing them ends their access, and they cannot report again. You can still stop it by signing in after access has opened.

Once access opens, everyone who has accepted access sees the whole vault, including sealed values, except a final letter you never submitted, which stays hidden from everyone. If you share a record with another living person and your handoff activates, they can also see that co-owner's share of it. The co-owner is not notified.

This policy continues to apply to your information after you die. What changes is who can see it, as described above.

8. People Who Are Named in a Vault but Do Not Use LegacyArk

A vault can name people and organizations, such as an executor, attorney, beneficiary, emergency contact, guardian, co-signer, doctor or hospice, clergy, funeral home or employer. For each, we store the name, the relationship to the vault's owner, and the organization. We also store their phone number, email address, and any notes written about them. That information is provided by the vault's owner, not by the person it describes, and it is not encrypted.

If you believe you are named in someone's LegacyArk vault, write to support@legacyark.co. We will confirm your identity before we tell you anything.

We will then tell you what is recorded about you. We will pass a request for correction or removal to the vault's owner. We do not edit or delete their records ourselves except where the law requires it. A note in a vault is the owner's description of you, not a statement of fact by LegacyArk.

9. How Long We Keep It, and What Deletion Does

We keep your vault for as long as your account exists. We do not currently delete inactive vaults. We do not delete a vault because its owner has died. A vault is deleted only when someone asks us to remove it.

When you delete your account, we cancel your subscription, delete your uploaded files, delete your sign-in identity, and delete your vault and its contents. These should complete within 30 days.

The 30 days does not cover what our analytics provider holds about your visits. It exists only if you agreed to analytics. Removal can fail, and we complete the other four steps regardless. What the provider holds may remain.

Two kinds of record survive account deletion. A record you share with another living person transfers to them, along with any file attached to it. Entries in another person's access history that record your activity are kept, with your account link removed.

Your payment processor keeps its own transaction records, which we do not control.

10. Your Choices and Rights

• See and correct what is in your vault, at any time, directly in the product
• Export your vault as a printable document
• Delete your account from account settings
• Change your privacy choices at Privacy Choices
• Ask us anything at support@legacyark.co

We will not treat you differently for exercising any of these. We commit to responding to your request within 45 days.

11. California Residents

California law gives you no rights beyond those in section 10. We do not sell your personal information. If you allow marketing, our advertising provider may set an identifier and use it to measure whether an advertisement brought you here. California law calls that sharing for cross-context behavioral advertising. Refuse marketing and it does not happen; allow it and change your mind at Privacy Choices. We honor Global Privacy Control automatically, with no action from you.

12. Children

LegacyArk is for adults. You must be 18 to have an account, and we do not collect information from children.

A vault may contain information about a child, such as a grandchild named as a beneficiary or a guardianship nomination, recorded by an adult. We never collect it from the child, and a child cannot have an account.

If you become aware that a minor has provided us with information, please notify us at support@legacyark.co.

13. If LegacyArk Is Sold or Shuts Down

If LegacyArk is sold, merged, or its assets transferred, including in bankruptcy, we will not transfer your information except to a party that has agreed in writing to be bound by commitments at least as protective as this policy. For this purpose, "your information" means everything recorded in or uploaded to your vault, and all information about the people you name in it.

If we shut the service down, we will give at least 30 days' notice where we reasonably can, and a way to export everything in your vault during that time.

14. Changes to This Policy

We may periodically revise this policy. If there are material changes, we will provide at least 30 days' prior notice by email or through a notice in the product. We will update the date at the top of this page whenever it changes.

15. Contact

Contact us at support@legacyark.co.

LegacyArk LLC
1209 Mountain Road Pl NE, Ste N
Albuquerque, NM 87110, USA

See also our Terms of Service.