Privacy Policy

The short version

• We hold what you write, the names and contact details of the people you choose, and a record of every time you check in.
• Your box is encrypted. We hold the keys, kept in a separate key service, because that is how your box can be opened for the people you chose after you die.
• When a death is confirmed we send what you left to the people you named. Most of them never signed up for anything, and we hold their contact details because you gave them to us.
• We keep a record of what was sent to whom and when, and of who opened it. That record outlives you, because it is the only evidence your family has that your wishes were carried out.
• We do not sell personal information. Counting visits to our pages waits for your yes. The only counts we keep without it are about your account: that it was created, with the sign-up method, your language and a rough source such as search or a referral, and that your email was confirmed.

What we hold

Your account

Your name, your email address, your phone number if you add one, the country you live in (we ask for it when you register), a hash of your password (never the password), your language, your time zone, your check-in schedule, a hash of your check-in PIN if you set one, and your subscription state. If you turn on two-factor authentication we hold the secret or the passkey that verifies it. Every attempt to sign in is recorded with the email address that was typed, the IP address it came from and whether it worked, so that password guessing can be stopped.

What you put in the box

Secrets, passwords, letters, voice and video recordings, photographs, recipes, stories, medical notes, funeral wishes, business succession plans and anything else you save. The application encrypts most of it with AES-256-GCM before it is stored: the titles, text and attached files of your secrets, the text of your letters and the files attached to them, your voice and video recordings, time capsules, medical details, funeral wishes, digital estate credentials, the documents you attach to a business succession plan, the written parts of your stories, recipes, plans and instructions, and your photographs: those in albums, recipes, stories, final posts, the family tree, pets and memorial pages, and the preview image of a video. Your blood type, your organ and body donation choices and the situation you choose for high-risk mode are encrypted as well, with the application key (AES-256 with an integrity check), and so are any notes you add to your donation choices. Some things are not encrypted by the application: the names, birth dates and biographies in your family tree, the names, relationships and notes you keep about your contacts (their email addresses and phone numbers are encrypted), box names and descriptions, the names, types and sizes of files, the titles of letters, stories and recipes, and the picture you choose for your profile, which anybody with its link can open. Uploaded files are kept on private storage that is not served from the web, whether or not they are encrypted; the profile picture is the one exception.

The encryption keys are kept in a separate key service (AWS KMS), and we hold them for every account. That is what makes it possible to open your box for the people you chose after you die, when you are no longer there to supply a password. Holding them is a responsibility, and we would rather say so openly than describe an option the product does not offer today. So that losing our AWS account could never lock your box for good, every key also has a second, sealed copy that only a separate key can open. The person who runs Gentle Handover keeps that key offline, never on a server, and opening a key with it does not go through AWS KMS, so AWS does not log it. If we offer a way to seal chosen items so that only the recipient can read them, this paragraph changes with it.

The people you name

For every contact, trusted verifier, recipient, executor, business successor and pet caretaker you add, we hold the name, email address, telephone number and relationship you typed in, plus whatever you wrote about them. Most of these people have no account with us and never asked to be in our records. Whether we tell them depends on how you added them. The phone app, the setup steps and the tonight plan send an invitation email as soon as they add a contact. The contacts form sends one unless you untick "Send verification invitation now", and you can send one later from the contact's page. People you mention without adding them as contacts hear nothing from us at that point: someone you write a letter to at an address you typed in first hears from us when that letter is delivered, and the members of your family tree and the children in your tonight plan are never contacted.

Before a person you chose first opens what you left them, answers as a trusted verifier or reports a death, we show them a few short lines once. When they accept them, we keep which lines and which version they saw, how and when they accepted, and the network address and browser it came from. The record is deleted with that person's entry in your account.

Your check-ins

Every check-in, the method you used, the time, the IP address it came from and, when we can tell, the country of that address. This is the record the whole service turns on, so it is kept for the life of the account.

Evidence of a death

When a death is reported we may hold a scanned death certificate, a funeral director's notice or a similar document, uploaded by a relative or by our own staff. These documents contain personal data about the person who died and usually about the person who uploaded them. We also hold what each trusted verifier answered when we asked them, along with the time, IP address and browser they answered from, because a release cannot be justified afterwards without it.

A death certificate normally states a cause of death, which is health data. We ask for one in two situations: when a death is reported to us outside the ordinary check-in process, and when something the account holder left is on the stricter check (crypto wallet details, passwords, account logins, financial details and Digital Estate credentials start there) because a person has to read it before those are handed over. A family that cannot send one is not locked out: those things open after a fallback period instead. With a document sent to prove a death we also hold anything written with it, which may be a covering note or a written statement in place of a document, and the sender's name and email address. The document is stored encrypted on private storage that is not reachable from the web, and what was written with it is encrypted too; only the operator deciding the case can open the document, and every opening is recorded. All of it, the sender's details included, is destroyed automatically 365 days after it is decided, and a submission still waiting for a decision on an open case is kept until it has one. A certificate uploaded with the first report of a death, or by a trusted verifier, is also kept on private storage that only the operator can open, and it is destroyed automatically 365 days after the case it belongs to is closed.

The delivery record

For every letter, secret, album, recording and document that goes out we record who it was addressed to, what it was, when it was sent, whether the email was accepted, how many attempts it took, when the recipient first opened it and how many times they have looked since. Your family can see that something reached them. The operator can see that nothing was stranded.

The audit trail

Signing in, signing out, changing a password, adding or removing a contact, opening a secret, exporting your data, and every action our own staff take on an account are written to an audit log with the time, the IP address and the browser. It is what makes it possible to answer "who did this, and when".

Technical data

IP address, browser, operating system and the pages you visit. Server logs are kept for security and to work out why something broke. Page-by-page analytics are only recorded if you agree to analytics cookies, and not at all if your browser sends a Global Privacy Control signal.

Payments

Paid plans are sold by our payment provider, Paddle, as the seller of record. Your card or other payment details go to Paddle and never reach us. From Paddle we keep your name, your e-mail address, your Paddle customer number, the plan you bought and the state of your subscription, and for each payment its invoice number, amount, currency and date, including payments that failed or were refunded. Paddle's messages to us also carry your billing address, which we do not keep. Paid plans are not on sale yet, so nobody has paid anything so far.

AI assistants

AI features are off unless you switch them on. If you do, each assistant sends the AI provider we have configured (Anthropic or OpenAI) only what it needs to produce a reply. The message writer and the interview send the text you write and, when you ask again in the same conversation, what was said before in it. The document helper sends the document text you paste into it, up to the limit the page shows, and the name you give it. The memorial writer sends the name, dates, biography and dated entries of a memorial page you own, and your own life stories and the values from your ethical will only if you tick the box for them. The box advisor and the legacy planner send only facts from Plan check as counts and settings (whether check-in is on and how often it asks, how many trusted verifiers have confirmed and how a death would be confirmed, how many people you named and how many have something set to reach them, how many boxes, items of each kind and letters you have, which problems Plan check found, whether the last integrity check passed, how many people may ask for emergency access and after how long, and whether your plan is free or paid), never a name, a title or what is in them. We do not send your box contents unless you put them into the conversation yourself.

Why we are allowed to hold it

To do what you asked

Running your account, encrypting what you store, watching for missed check-ins, and delivering what you left to the people you named. Without this there is no service.

Our legitimate interests

Keeping accounts secure, preventing abuse, keeping a delivery and audit record so releases can be accounted for afterwards, and answering support requests.

Your consent

Analytics, marketing email and AI assistants, and keeping health details, passing them on, and keeping account numbers and logins. Each one is off until you agree to it, and each can be taken back without affecting anything else.

A legal obligation

Tax and accounting records, and responding to a lawful order from a court or an authority with jurisdiction over us.

Someone's vital interests

Passing on the care instructions for a dependent animal to the person you named, at the moment they need them. Health details are passed on only with your yes, as described above.

What happens to your data after you die

This is the part of the policy that matters most here, and it is the part most privacy policies do not have.

The account changes state

Once a death is confirmed the account is marked deceased. Nothing is deleted. The check-in clock stops, reminders stop, and the account is no longer watched. It is not billable, it cannot be signed into by anyone using your credentials, and any session still signed in to it, on a computer or in the phone app, is ended.

Your content goes where you sent it

Each item goes to the person or people you named for it, and to nobody else. What happens when you named nobody depends on the kind of item. A box secret, a letter, a voice or video message or a photo album with nobody named goes to nobody. Your funeral wishes and organ donation wishes are the exception: until you choose who reads them, everyone on your contact list who opens their page can read them, because somebody has to arrange the funeral. Your ethical will reaches nobody until you name somebody.

The people who receive it

They get an email, and an access code or a password of their own that opens a portal showing only what you left them. We hold their email address, whether they opened it, and when. They can ask us to delete their contact details, and we will. But a request from a recipient cannot remove the record that a delivery was made, because that record is the evidence that your wishes were carried out.

What your family can ask for

Data protection law in most of Europe does not give the dead the rights it gives the living, and some countries give the next of kin specific rights instead. In practice: An executor or another personal representative of the estate can ask us to close the account and to confirm what was delivered. That confirmation is a log with the date and time of each delivery and the recipient's contact address only, never the contents, the text or the names of private files, and we give it only once we have a certified death certificate and the court's papers appointing them. They can stop a delivery that has not gone out yet only if the account holder allowed it in the setup, which is off unless the account holder turns it on, and we always follow a court order. Before we act, we will ask for proof of death, proof that they are who they say they are, and the papers that give them that authority, such as a court appointment or a small estate affidavit. A relative's request alone does not stop a delivery or close the account. We will not hand over box contents to someone you did not name for them.

Closing a deceased account

When the estate asks us to close the account we delete the account, the box records that belong to it and the files uploaded to it, including any death certificate, unless a legal hold requires us to keep them. Until then, a document sent to prove the death and a certificate uploaded with the first report of the death or by a trusted verifier are destroyed automatically on the timer described below, and anyone can ask us to destroy them sooner. We keep the delivery record and the audit trail, because they are the only proof that what you left arrived, and destroying them would leave your family with no way to show it.

Your instructions, and what your heirs may still ask

While you are alive you agree, as a separate step, to how we handle your data after your death: that each item goes to the people you chose, and that we may process your data after your death as your instructions say. Some laws ask a person to give this consent before death, or else the heirs decide. Armenian data protection law is one of them. Your instructions do not override every law, and we say plainly where they may not: in Spain your heirs may have a right to see financial information and content that forms part of your estate, and in Italy a ban you set cannot take away rights that other people gained from your death. If an heir shows us such a right, we may have to give them some of what you kept, even something you did not leave to them.

Why the people you name hear from us only at release

We do not write to the people you name as recipients while you are alive. Telling them early would show what you plan to leave and to whom, which is often exactly what you want to keep private until the time comes, and it would defeat the purpose of the service. So we tell them what this policy says about their data when we first write to them about your release. The law allows this delay when telling them earlier would seriously impair the purpose of the processing, and we publish this explanation for that reason. People we write to while you are alive are not covered by this delay: a trusted verifier is told about their data in our first message to them.

How long we keep it

Every period below is read directly from the setting that enforces it, so what this page says and what the software does cannot drift apart.

• Your account and everything in it, for as long as the account exists.
• After you ask us to delete your account we hold it for 30 days so you can change your mind, and then it is destroyed permanently. Nothing is released to anybody during that period.
• A document sent to prove a death, and anything written with it: destroyed automatically 365 days after it is decided, or after it arrived if its case closed without a decision. One still waiting for a decision on an open case is kept until it has one, because it may be what lets a family in. A certificate uploaded with the first report of a death, or by a trusted verifier, is kept while the case it belongs to is open and is destroyed automatically 365 days after that case is closed. A legal hold, placed when the law requires us to keep something (for example a court order or a dispute over the estate), keeps these documents past those dates until it is lifted. You can ask us to destroy them sooner at any time and we will.
• AI conversations: 30 days, or sooner if you turn AI off or delete your AI history.
• A confirmation link sent to a trusted verifier stops working after 14 days.
• An approved emergency access grant lasts 7 days and then closes by itself.
• A background job that fails can briefly hold the decrypted text of a letter. Failed jobs are destroyed after 7 days.
• An email address you give us without an account, to join the waitlist or to be told when the app is ready, is confirmed by a link first and deleted after 30 days if nobody confirms it, and one given to be told when the app is ready is used only for that one email, is never added to another list, and is deleted as soon as that email is sent.
• A minimal record of each release, saying what went to whom, when and on whose confirmation, is kept even after an account is closed, because it is the evidence we and your family need if anyone ever questions a release. We keep as little personal data in it as we can.
• The record that you agreed to a plan's automatic renewal is kept even after your account is deleted, because some state laws ask us to be able to show it. It keeps only the version of the words you saw, a fingerprint of them, when you agreed and the reference our payment provider gave you, never your name or address, and it is deleted three years after you agreed or one year after your account was deleted, whichever is later.
• Backups: the database keeps automatic backups for 35 days, and an encrypted copy taken before each update is kept for 30 days. What you delete leaves the live service at once and leaves the backups as each one reaches the end of its normal cycle. We do not edit backups to remove one person's data, and we use them only to restore the service.
• The delivery record and the audit trail are kept for the life of the account and survive a deceased account being closed, for the reason given above.
• Server and security log files are deleted after 30 days at most. E-mail addresses and phone numbers are masked before anything is written to them, and the files are never used to build a profile of anyone.

Who else can see it

We do not sell personal information and we never have. We never share a phone number, or anyone's agreement to receive our texts, with any company for its own marketing. We share personal information in exactly five situations.

• The people you named, when the conditions you set are met. That is the point of the product.
• Companies that run part of the service for us, listed below. Each one only gets what it needs to do its job.
• A court or an authority with jurisdiction over us, when we are legally obliged. We will tell you unless we are forbidden to.
• A company that takes over Gentle Handover, or the part of the business that runs this service, if it is ever sold or merged. It would receive what it needs to keep running the service for you and for the people you named, under this policy, and it would tell you within one month. If the law requires your consent again for any of it, such as health notes, the new company will ask for it.
• The person who operates Gentle Handover, who can see account records and delivery records. Because the service holds the keys, this person is trusted with box contents too: no screen in the admin console shows them, and every staff action is written to the audit log.

Our processors

These are the services the software actually talks to. A service that is not configured is not used.

• Amazon Web Services (AWS): the servers, the database and everything else the service runs on, in AWS's Frankfurt region in Germany (eu-central-1), with backup copies of the live database and disks in AWS's Ireland region (eu-west-1). AWS holds everything the service holds. Most box contents are encrypted by the application before they are written, and the keys that open them are locked by AWS's own key service (AWS KMS).
• Amazon S3, part of AWS in the same Frankfurt region: uploaded files such as photos and documents, in a private bucket that is not served from the web, once they are moved off the application server.
• Cloudflare: every visit to our website, our app and our staff panel passes through Cloudflare's network first. It answers for our domain names, encrypts the connection, blocks attacks and repeated attempts, and checks our staff before they reach the staff panel. Cloudflare sees your IP address, your browser details and the addresses you ask for; it opens the encrypted connection at its own servers to filter it and passes it on to ours over an encrypted tunnel.
• Our email providers (Amazon SES, with Mailgun as a backup): every message the service sends, including the ones your family receives.
• Google Workspace: our company e-mail. When you write to one of our addresses, such as support@, privacy@ or security@, your message, your name, your e-mail address and any attachment are kept in our Google Workspace mailboxes. A death report or a privacy request sent by e-mail arrives there too.
• Firebase Cloud Messaging (Google): notifications to the Gentle Handover phone app, only while we have switched it on. It receives a device token and the short text of each notification.
• Telegram: reminders and alerts to people who link their Telegram account, only while we have switched it on. It receives the Telegram chat id and the text of each message.
• Twilio: text messages and phone calls for check-ins and alerts. This is built into the software but not switched on for the whole service, and no account can switch it on, so no text message or call goes out and nothing is sent to Twilio.
• WhatsApp (Meta Platforms), reached through Twilio: WhatsApp messages for check-ins and alerts. This is built into the software but not switched on for the whole service, so no WhatsApp message goes out and nothing is sent to WhatsApp.
• Sentry: error reports, when it is configured. An error report can contain the URL and your user id, never box contents.
• Plausible Analytics, an EU company: counts visits to our public pages (the home page, pricing, the blog, help and these legal pages). It sets no cookies and never runs inside your account, a portal or a memorial page. It loads only after you agree to analytics, and never if your browser sends a Global Privacy Control signal.
• Google: only if you choose "Continue with Google", and only while we have switched that button on. Google tells us your Google account number, your name, your e-mail address and whether Google has confirmed it. We keep the account number and the address (encrypted) so you can sign in with Google again. Google learns that you use Gentle Handover. Nothing from your boxes is sent to Google.
• Apple: only if you choose "Continue with Apple", and only while we have switched that button on. Apple tells us your Apple account number, your e-mail address (which may be a private relay address that forwards to you) and, the first time, your name. We keep the account number, the address (encrypted) and whether it is a relay address. Apple learns that you use Gentle Handover. Nothing from your boxes is sent to Apple.
• Cloudflare Turnstile: only while we have switched it on, on the sign-in, sign-up, password reset, contact and call back request forms, to check that a person and not a program is sending them. Cloudflare receives your IP address and browser details, and we send it the check's one-time answer and your IP address to confirm it. It never runs inside your account.
• ipapi.co: only while we have switched it on, and it is off by default. It would receive the IP address of each check-in and of each sign-in from a new device, to name the country and city shown in your account history and in the new device e-mail. While it is off nothing is sent to it: the country shown is the one the network in front of our site reports with your request, when there is one, and otherwise none.
• Cal.com: only while we have switched it on, and only on the work with us page, where partners, organisations and the press can book a call with the Humanful team. Cal.com receives what you enter when you book (your name, e-mail address, the time and any note) and your IP address and browser details while its calendar is open. A family asking us to ring back after a death uses our own form, and nothing from it goes to Cal.com.
• Anthropic and OpenAI: only while we have switched AI on. For your account, only if you switch AI assistants on, and only what that assistant needs (see "AI assistants" above). Our team can also switch on three drafting tools, each separately: blog articles from topics and public links our team chooses, and social posts from our own published articles (neither sends anything about you); and replies to support messages. For a support reply we send the words of your message with e-mail addresses, links and long numbers hidden, and the help centre answers that match it; we do not add your name, your account details or anything from your boxes. A message about a death, from a family member or about a crisis is never sent. A person reads every draft, and nothing is sent to you until a person sends it.
• Slack: when something breaks, a short alert goes to the Slack workspace of the people who run Gentle Handover, only while alerts are set up. An alert can include an account id or a ticket reference.
• Paddle: sells our paid plans as the seller of record (the merchant of record). Paddle takes the payment, charges any sales tax or VAT, sends the receipt and pays refunds, and it does this as a separate controller under its own privacy notice, not as our processor. When you buy, Paddle receives your name, e-mail address, billing address and payment details. It tells us your name and e-mail address, what you bought, when, the amount, and whether a payment went through, failed or was refunded (see "Payments" above). To have Paddle delete what it holds, ask Paddle as well as us; Paddle keeps some transaction records for five years. Only while payments are open: until then nothing is sent to Paddle.

See every company, what it receives and whether it is switched on

Data leaving your country

Some of these processors are based in the United States. Where personal data is transferred outside the EEA or the UK we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, together with the fact that box contents are encrypted before they are stored. We do not claim certification under any transatlantic framework.

If you live in Canada, your personal information is stored and processed outside Canada, in AWS's Frankfurt region in Germany, with backup copies in its Ireland region, and in the United States by the processors named above. While it is there, it is subject to the laws of those countries, and their courts and authorities may access it under a lawful order. We protect it by contract with each processor and by technical safeguards, such as encryption.

Your rights

Wherever you live, you can do the following. Most of them you can do yourself, straight away, from your settings.

• Ask what we hold about you and get a copy of it.
• Export a copy of what you saved, and your account records, in a machine-readable file you can read without us: secrets, letters, wishes, plans and everything else you wrote come out as plain text. Left out are the records the service keeps to run and secure the account (for example sign-in codes, sessions, keys and tokens, security alerts, delivery, billing and referral records, site analytics and staff records), what other people wrote or did (for example a guestbook visitor's address, the notes your family adds after a death, when a recipient opened something, and proof of death someone sent), and copies the service makes itself, such as photo thumbnails. Uploaded and recorded files are listed by name; only the encrypted ZIP format carries the files themselves, and a file too large to open in one go is left out of it and named in the export.
• Correct anything that is wrong.
• Delete your account and everything in it.
• Ask us to stop processing while a dispute is sorted out.
• Object to processing based on our legitimate interests.
• Withdraw consent for analytics, marketing or AI at any time, without losing anything else.
• Complain to us, and to a data protection authority, such as the Information Commission in the United Kingdom.

How to use them

Export and deletion are in your settings. For anything else, write to the privacy contact below. We answer within 30 days. We will ask you to prove who you are first, because these requests are a well-known way to steal somebody's box.

When we answer a request for a copy ourselves, the copy leaves out passwords and other sign in details, financial account numbers, government ID numbers, health insurance and medical ID numbers, and security questions and answers, so that it can do no harm in the wrong hands. It says which of them we hold, and your full copy is in Settings, then Export, after you sign in.

If we refuse a request, or answer only part of it, reply to our answer and say you want it looked at again. A different person from the one who decided looks at it whenever we have one, and we answer your appeal within 45 days. If we still refuse, we tell you how to complain to the Attorney General of your state, or to the data protection authority of your country if you live outside the United States.

If you were named by somebody else

If you are in our records because someone added you as a contact, verifier or recipient, you have the same rights. Write to the privacy contact below and we will tell you what we hold and remove you if you want us to. Removing yourself means what that person left you will not reach you.

If you are in the United States

Residents of California, Colorado, Connecticut, Virginia and other states with comparable laws have specific rights.

We do not sell personal information and we do not share it for cross-context behavioural advertising. There is no money changing hands over your data and there never has been.

We do not use personal data to train large language models, and we do not sell it to anyone who does.

You may ask what we have collected, ask for a copy, ask us to correct or delete it, and ask us not to share it. We will not treat you differently for asking.

Global Privacy Control

If your browser or an extension sends the Sec-GPC signal we treat it as a valid opt-out request. Analytics and any advertising category are switched off for that browser before the page is built, the opt-out is recorded, and the banner tells you it has been honoured rather than asking you again.

Do not sell or share my personal information

You can exercise this at any time from the cookie and privacy choices panel, without an account and without telling us who you are.

Open my privacy choices

Do Not Track

If your browser sends a Do Not Track signal, we treat it the same way as Global Privacy Control for that browser: analytics and any advertising category stay off, whatever was chosen before.

Health details

The health details you keep here have a policy of their own: what we keep, why, who receives them and how to use your rights over them.

Read the Consumer Health Data Privacy Policy

How it is protected

Box contents and most other things you write are encrypted with AES-256-GCM before they are stored; what is not is listed under "What you put in the box" above. Traffic runs over TLS. Passwords are hashed, not stored. Two-factor authentication and passkeys are available and we recommend both. Death certificates and uploaded media live on private storage that is not served from the web. Staff actions are logged.

We hold no security certification, we publish no uptime figure, and we have not commissioned an external penetration test. When that changes, this paragraph will change with it. No system is perfectly secure, and a service that tells you otherwise is not being straight with you.

If a breach affects your personal data, we tell you without unreasonable delay and within the time the law where you live sets, which in some US states is 30 days from when we find it. We tell the authorities that law names. We tell you directly whenever the risk to you is high, even where no law requires it.

Age

Gentle Handover is for adults. You must be 18 or over to open an account, and we ask you to confirm that when you register. If you believe a child has an account, write to us and we will close it and delete what it holds.

The product does hold information about children when you enter it. The tonight plan keeps each child's name and birth date, with their allergies, doctor, school, routines, what comforts them, what they already know and a letter for them (those details are encrypted by the application). The family tree keeps names and birth dates, and you can write a letter or leave something else for a child or a grandchild. Nothing in the product marks a recipient as a child, so for anyone under 18 our Terms ask you to give the address of a parent or guardian, and a delivery goes to the address you entered for that person.

Changes to this policy

If we change something that affects you, we will email you before it takes effect and put the date at the top of this page. Older versions are available on request.

Contact

Privacy questions, requests and complaints all go to the same place, and a person reads them.