Terms of Service

The short version

• You must be 18 or over.
• Gentle Handover passes your words and your credentials to people you choose. It is not a will and it does not transfer anything to anyone.
• We hold the encryption keys, kept in a separate key service, so that your box can be opened for the people you chose after you die.
• A release starts only after your death is confirmed: by at least two of your trusted verifiers, or by a person at Gentle Handover who has reviewed the case. A missed check-in, a single report or a report from a partner organisation never starts one on its own. Once it is confirmed and any waiting period has passed without a check-in from you, the release starts on its own: when your trusted verifiers confirmed it, nobody at Gentle Handover has to approve it. By default, crypto wallet details, passwords, account logins and financial details also wait for a death certificate read by a person, or for a fallback period if none arrives. Only a few urgent wishes, such as funeral plans, can open sooner, if someone you allowed reports your death and you do not answer in time.
• You can export a readable copy of what you keep here and leave at any time. The privacy policy says what the export leaves out.

1. Agreeing to these terms

Opening an account means you accept these terms. If you do not accept them, do not open one. If we change them in a way that matters, we will email you before the change takes effect.

2. Who may use it

You must be at least 18 years old and legally able to enter into a contract where you live. You confirm your age when you register. If we learn that an account holder is under 18 we will close the account and delete what it holds.

You are responsible for keeping your own contact details and the contact details of the people you name accurate. A letter cannot arrive at an address that no longer works.

If you name someone under 18 to receive something, give the email address of their parent or guardian, not the child's own. We deliver to the address you give.

3. What the service does

Gentle Handover stores encrypted content, watches whether you check in, and, when the conditions you configured are met, delivers what you left to the people you named.

Every delivery happens on your own instruction. By naming a person for an item, you authorise us to deliver that item to them once the conditions you configured are met, and to nobody else. We never sign in to, open or take over an account you hold with another service: we deliver only what you wrote down. Whether a recipient may use a login you leave them is governed by that service's own terms.

A release starts only once your death has been confirmed, in one of two ways: at least two of your trusted verifiers confirm it, whether we asked them because you stopped checking in and your grace period ran out or because somebody reported your death to us (the person who reported it never counts, and when fewer than two of them can answer, a person at Gentle Handover has to confirm it as well); or a person at Gentle Handover reviews the case and confirms your death, which does not require a death certificate or any other document. A registered partner organisation, such as a funeral home, may tell us about a death only for an account holder who named it, and no account can name one yet. Its report only opens a case: it never confirms your death and never starts the wait. After either confirmation, we email you and wait 48 hours, and confirming with your password during that wait stops everything.

Some things ask for more. Crypto wallet details, passwords, account logins, financial details and the credentials in your Digital Estate start on a stricter check: a death certificate or the equivalent official document has to reach us and be read by a person before they are handed over. If none arrives, they open anyway 180 days after we start handing your estate over, so that a family without a document is not locked out for good. You can move any one of them to the ordinary check, and put any other secret on the stricter one.

Do not store a full recovery phrase or a private key with us, in a crypto wallet entry or in any item. Record where it is kept and how the people you name can reach it. We do not offer to keep the means of access to crypto-assets.

One narrower path does not wait for a confirmation. If you allowed someone to report your death and they do, we tell you at once, and a single check-in from you closes the report. If you do not answer in time, only what cannot wait opens, and only where you wrote it: funeral and organ donation wishes, and notes for whoever looks after the children, the pets, people in care or the home. Each part opens only to the people allowed to read it. Nothing else opens this way: secrets, passwords, financial details, letters, recordings and your ethical will still wait until your death is confirmed as described above.

Delivery depends on things outside our control: email getting through, an address still working, a person still being reachable. We will keep trying and we will show you and your family what happened, but we cannot guarantee that any particular message reaches any particular person.

You can rehearse the whole thing at any time and see exactly what each person would receive. We recommend doing it.

Texts are optional and are switched on country by country. We text only a phone number its holder proved with a one-time code. An owner is texted only about their own account and what they asked to be told, such as sign-in and verification codes, check-in reminders and alerts. A person an owner chose is texted only about that owner, only after they agreed to our texts themselves, to check that we can reach them and to tell them when something may have happened. If someone texts our number, we may answer that text once, for example to say we could not accept it. We never send marketing by text, and agreeing to texts is never a condition of buying a plan. How many texts arrive depends on the settings and on what happens in the account. Your mobile provider's message and data rates may apply. Reply STOP to end our texts to that number, START to have them again or HELP for help, or write to us at the address under Contact. Mobile carriers are not liable for texts that arrive late or not at all. We send texts only to countries our texts can reach, and where you add your number we say so if yours is not one of them.

You choose your trusted verifiers, and you carry the risk that one of them tells us something untrue. They act for you, not for us. What we answer for is following our published verification process with reasonable care. Where we followed it, we are not liable for the harm a verifier's false statement causes. Where we did not, nothing in these terms limits our liability for that.

By naming a person for an item you give your lawful consent, as the person who stored it, for us to hand that item to them, and to nobody else, once the conditions you configured are met. We also ask for this consent as a separate step in your account, and we keep a record of the version you agreed to and when.

Your choices about who receives what, and when, are your delivery instructions. They are a separate agreement between you and us, apart from these terms, and you can change or delete them at any time: edit or remove an item, change who receives it, or delete your account.

Read the delivery instructions agreement

4. This is not a will, and we are not lawyers

Nothing you create in Gentle Handover is a will, a codicil, a testament, a trust deed, a power of attorney, an advance healthcare directive or an organ donation registration. Nothing here transfers ownership of anything. Wills have formal requirements (witnesses, signatures, sometimes registration) that a web application cannot satisfy on your behalf.

Use Gentle Handover for what it is good at: getting your own words, your passwords and your instructions to the right people at the right moment. Use a qualified lawyer in your own state or country for anything that has to bind somebody. If what you write here contradicts your will about who inherits something, the will governs that. What we hand over, and to whom, follows your delivery instructions (section 3).

We do not provide legal, financial, tax or medical advice, and nothing in the product or its documentation is advice of that kind. This is not a substitute for the advice of an attorney.

5. Your account and your keys

Keep your password to yourself, turn on two-factor authentication, and tell us straight away if you think somebody else has got in.

We hold the keys so that the service can open your box when you are no longer there to unlock it. That is a real trade-off (it is the price of a dead man's switch working at all), and you should make it knowingly.

Every box is encrypted with keys we hold, kept in a separate key service (AWS KMS). We hold them so that your box can be opened for the people you chose after you die, when you are no longer there to supply a password; nothing you store here is sealed in a way only you could open. If we offer a way to seal chosen items so that only the recipient can read them, it will be described here before it is offered to you.

6. What you may not store or do

You may not use Gentle Handover to:

• commit or support a crime under the law where you or we are, including storing or sending child sexual abuse material of any kind, or intimate images of a person without their consent, even when they are set to go out only after your death
• arrange harm to a person after your death, or leave instructions intended to harass or threaten somebody
• store another living person's credentials without their knowledge
• add somebody as a contact in order to send them unwanted mail
• attack, probe or overload the service, or try to reach another account
• resell access, or run the service on behalf of third parties, without a written agreement

If an account is used for any of this, we may hold or cancel a delivery, remove the content, suspend or close the account, keep what the law requires us to keep, and report it to the police or another authority. We report child sexual abuse material whenever we learn of it, as the law requires. Section 7 says how we decide, how we tell you and how you can appeal. Except for content the law makes us remove, we do not destroy what an account holds while a decision about it is disputed.

To report misuse of the service, write to [email protected].

The acceptable use policy says the same in more detail.

7. Content rules: what we remove, how to report it and how to appeal

These rules cover everything stored with us, everything we deliver and every public memorial page. We remove or hold content that breaks section 6 or the law, in particular child sexual abuse material, intimate images of a person shared without their consent, threats or harassment aimed at a person, content that infringes somebody else's copyright, and other content that is illegal where you, the person receiving it or we are.

We do not look through what you store. We look at content only when somebody reports it, when a court or an authority with jurisdiction over us orders it, or when we must to keep the service and the people in it safe. A person at Gentle Handover reviews every report and makes every decision. No program decides on its own.

Anyone can report content. A person who received something from Gentle Handover can use "Report this" under it in the portal, and anyone can use "Report this page" on a public memorial page. You can also write to the contact address at the end of these terms. Say what the content is, where it is and why you believe it breaks these rules or the law.

While we look at a report about something that has not gone out yet, we may hold that item, or every delivery of the account, so that it reaches nobody. A hold stops a delivery and cancels nothing. If we find the content is allowed, it goes out as it would have.

When we remove or hold content or restrict an account, we tell the account holder what we did, which rule or law it rests on, whether we acted on a report, and how to appeal, unless the law forbids it or telling them would put somebody in danger. We tell the person who reported it what we decided.

You can appeal a decision by replying to our message or writing to the contact address below. A person looks at it again, a different person from the one who decided whenever we have one, and tells you the result. You keep every right to go to a court.

If a report suggests that somebody's life or safety is in danger, we tell the police or another competent authority at once.

8. Paying for it

Paid plans are sold by the month or by the year and renew for another month or year until you cancel. Our payment provider, Paddle, sells them as the seller of record: it takes the payment, charges any sales tax or VAT and sends the receipt.

Prices can change. If the price of your plan changes, we email you at least 30 days before your first payment at the new price, and you can cancel before it. If you cancel within 14 days after the first payment at a higher price you did not agree to, we refund the unused part of that payment.

You can cancel at any time from your account or from the link in Paddle's e-mails. Cancelling stops the next renewal, and the plan keeps running to the end of the month or year you paid for.

If a renewal payment fails, nothing changes for 14 days while our payment provider tries again, and we send you no more than 3 e-mails about it. When a plan ends, because it was cancelled, refunded or could not be charged, the account moves to Kept. Nothing is deleted and nothing is released because of it: everything you saved stays readable, editable and exportable, every feature your plan had stays open for what already exists, and everything you set up still goes out as you set it. Only new things are limited to what the Free plan allows, and paying again restores the plan at once.

You can have the whole payment back within 14 days of the first payment of a plan, whether you pay monthly or yearly, and within 14 days of every yearly renewal, wherever you live. Monthly renewals are not refunded. Outside those times we refund part or all of a payment when the fault is ours: an outage or a defect that stopped the service doing what it promised. If you live in Canada and cancel a yearly plan after it renewed, we also refund the unused part of that year, counted by the days left after the day you cancel, within 15 days. Refunds are paid by Paddle to the card or account you paid with. This money-back guarantee can be used once per account.

Gift codes, when we sell them, give a plan for a period of time, such as one year of Plus. A code is not an amount of money and has no cash value: it cannot be exchanged for money or used to pay for anything else. A code has to be redeemed within 12 months of being bought. Once it has been redeemed, or that time has passed, it cannot be refunded. The person who bought it can have an unused code refunded within 14 days of buying it.

Read the refunds and cancellation policy

9. What happens when you die

The account is marked deceased. Billing stops, and any payment taken on or after the day the case about your death was opened is refunded. Check-in reminders stop. What you left is delivered to the people you named, and they get access to a portal showing only their own part of it.

An executor or another personal representative of the estate can ask us to close the account and to confirm what was delivered. That confirmation is a log with the date and time of each delivery and the recipient's contact address only, never the contents, the text or the names of private files, and we give it only once we have a certified death certificate and the court's papers appointing them. They can stop a delivery that has not gone out yet only if the account holder allowed it in the setup, which is off unless the account holder turns it on, and we always follow a court order. We will ask for proof of death and for the papers that give them that authority, such as a court appointment or a small estate affidavit. A relative's request alone does not stop a delivery or close the account. We will not give anyone access to content you did not leave them.

When the estate closes the account we delete the account, its box records and the files uploaded to it, unless a legal hold requires us to keep them, and we keep the record of what was delivered. Until then, a document sent to prove the death is destroyed 365 days after it is decided, and a certificate uploaded with the first report of the death is destroyed automatically 365 days after the case is closed.

10. Availability

We do not publish an uptime guarantee and we do not offer a service credit, because a one-person operation that promised either would be promising something it cannot enforce. We do run the release system on a schedule. A check every five minutes looks for a schedule that has stopped and for releases that are stuck, and sends an alert to the person who runs Gentle Handover. It cannot report the whole server going down by itself, so for that it also pings an outside monitor, when one is set up.

If we ever have to shut the service down, we will give at least 90 days' notice by email, keep exports working throughout, refund the unused months of every yearly plan, pro rata, and tell the contacts you have named that they should expect nothing further from us.

11. Limits

Our total liability to you, and to anyone who claims through you or on your behalf, such as your estate, your executor or your heirs, for all claims together, whatever their legal basis and including claims based on our negligence, is limited to the greatest of these amounts: 50 US dollars, the fees paid for your account in the twelve months before the event that led to the claim, and the fees paid in the last twelve months in which payments were made. Payments made through Paddle count.

This limit does not apply to liability for fraud, for harm we cause on purpose, recklessly or through gross negligence, for death or personal injury caused by our negligence, or for our own violation of law. It does not reduce any refund that section 8 or section 9 promises you. It also does not take away any right that a consumer protection law of the state or country where you live says you cannot give up.

These limits never reduce a remedy that a consumer protection law, a privacy law or a medical privacy law gives you, including the California Confidentiality of Medical Information Act, and they never limit our liability where the law forbids such a limit, as section 1668 of the California Civil Code does.

A mistaken handover is a release while you are alive, or to a person you did not name, caused solely by a fault in our own software or an administrative error of ours. For a mistaken handover we refund all the fees you have paid us, to you or to your estate, and reimburse the direct costs you actually paid because of it and can show, up to 50 US dollars in total. The 50 US dollars is a ceiling on proven costs. It is never paid automatically, and it is not liquidated damages.

It is not a mistaken handover, and we are not liable for it, when a release results in whole or in part from a false, mistaken or collusive confirmation by you or by your trusted verifiers. The same applies when it results from unauthorized access, hacking, phishing, social engineering, malware or SIM swapping that affects your own or your verifiers' own email accounts, phone numbers or devices, or from your not receiving or not answering our warnings because of outdated contact details, spam filters, device settings or a carrier outage. We stay responsible for the security of our own systems, as the law requires.

If you are a consumer, you keep every right that the law of the state or country where you live gives you and does not let you give up. These terms do not take any of them away.

If you live in New Jersey, the limit in this section does not apply to the extent it would limit our liability for intentional wrongs, reckless conduct, gross negligence or willful injury to a person or property, or the remedies and attorney's fees that New Jersey law expressly provides.

If a court finds that one of these limits cannot be enforced for a particular claim, only that limit falls away, and only for that claim. Each limit in this section is separate and independent of the others, so the others still apply to that claim, and every limit still applies to every other claim.

12. Ending it

You can delete your account at any time from your settings. There is a grace period before it is destroyed permanently, so that a deletion made in a bad week can be undone. During that period nothing is released to anyone.

We can end an account for a serious or repeated breach of section 6, or if we are legally required to. Except where the law prevents it, we will give you notice and time to export.

13. Which law applies, and where disputes are heard

These terms, and any dispute about them or about the service, are governed by the law of the State of Delaware, United States. If you are a consumer, the consumer protection laws of the state or country where you live also apply to you, and these terms do not take away any protection those laws say you cannot give up.

Delaware law governs this contract, including payments, disputes and liability. The legal effect of your handover directions, and the authority of an executor, a personal representative or another fiduciary after your death or incapacity, follow the law on digital assets and estates (the Revised Uniform Fiduciary Access to Digital Assets Act or its equivalent) of the state, province or territory where you lived at your death. If you lived in Delaware, that is chapter 50 of title 12 of the Delaware Code (12 Del. C. chapter 50). Our handover setup is an online tool in which you can change or delete your directions at any time. To the fullest extent the law allows, a direction you give there about what we hand over, and to whom, prevails over a contrary will or other document.

Disputes are decided by courts, and these terms have no arbitration clause. You can bring a claim against us in the courts of the state where you live or in the courts of the State of Delaware, and you can always use a small claims court for a claim it can hear. If you live outside the United States, you can also bring it in the courts of the country you live in. If we ever have to bring a claim against you, we bring it only in the courts where you live.

Before going to court, please write to us at the address under Contact and tell us what went wrong and what you would like us to do. A person reads it and answers, and most problems can be put right that way. This is a request, not a condition, and it does not stop you from going to court.

14. Contact

Questions about these terms are read by a person. Write to [email protected].