Privacy Policy
Last updated: September 21, 2026
1. Information We Collect
We collect information you provide directly:
- Account information: Name, email address, and password when you create an account
- Message content: Text, audio, and video messages you create
- Recipient data: Names, email addresses, dates of birth, and relationships of your message recipients
- Trusted contacts: Names, email addresses, and phone numbers of your designated contacts
- Payment information: Processed securely through Stripe; we do not store full card numbers
We also automatically collect:
- IP address and device information for security and fraud prevention
- Usage data such as login times and feature interactions
2. How We Use Your Information
- To provide the Legacy Letters service, including storing and delivering your messages
- To process payments and manage subscriptions
- To send transactional emails (delivery confirmations, password resets, trusted contact notifications)
- To maintain security and prevent fraud via audit logging
- To improve our service based on aggregated, anonymous usage data
3. What We Never Do
- ✕We never sell your personal data to third parties
- ✕We never use your message content to train AI or machine learning models
- ✕We never share your content with advertisers
- ✕We never read your messages unless required by law
4. Data Security
All data is encrypted in transit (TLS 1.3) and at rest. Passwords are hashed using industry-standard algorithms. Access to user data is strictly limited and logged. We maintain comprehensive audit trails for all data access and modifications.
5. Data Sharing
We share data only with:
- Message recipients: When a delivery trigger is activated, we send the message content to the designated recipient
- Trusted contacts: We contact them only for posthumous delivery verification
- Service providers: Stripe (payments), email delivery services (transactional emails), and cloud hosting providers, all under strict data processing agreements
- Legal requirements: When required by law, court order, or to protect our rights and safety
6. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service. Message content is retained until delivered or deleted by you. After account deletion, we remove personal data within 30 days, except where retention is required by law. Audit logs may be retained for up to 7 years for compliance purposes.
7. Your Rights
You have the right to:
- Access your data at any time through the vault export feature
- Correct inaccurate information in your account settings
- Delete your account and associated data
- Port your data by exporting your vault as JSON
- Object to processing for marketing purposes
8. Cookies
We use essential cookies only — for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics that track you across the web.
9. Children's Privacy
Legacy Letters is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we discover such data, we will delete it promptly.
10. Contact
For privacy inquiries, data requests, or concerns, contact us at privacy@legacyletters.com.