Privacy Policy

1. Information we process

• Guest will drafts stay in browser local storage unless you create an account or save information to the service.
• Account data includes name, email, verified phone number, password hash or Google sign-in identifier, sessions, and security records.
• Legacy Delivery identity verification is hosted by Stripe. My Last Word receives the verification result, timestamps, provider session ID, and a keyed non-reversible duplicate-detection token. We do not store the raw Social Security number or identity images.
• Saved wills include the family, guardian, executor, asset, and instruction information you enter.
• Legacy Delivery includes message text, recipient and verifier details, release settings, photos, videos, delivery attempts, and audit events.
• Stripe supplies transaction identifiers, amount, currency, status, and entitlement dates. We do not store full card numbers.
• Logs may include IP address, browser/device information, request metadata, authentication events, and errors.

Do not place Social Security numbers, government ID numbers, passwords, recovery codes, cryptocurrency keys, safe combinations, or other secrets in wills, messages, uploads, support requests, or ordinary account fields. If you activate Legacy Delivery, submit the requested identity number only inside Stripe's hosted verification flow.

2. How information is used

We use information to generate documents, maintain accounts, verify phone ownership and Legacy Delivery eligibility, prevent duplicate paid identities, process purchases, store and deliver messages, run check-ins and verifier requests, retry failed delivery, prevent abuse, provide support, comply with law, and improve reliability. We do not sell personal information.

3. Automated Legacy Delivery

Scheduled messages may release automatically on the selected date. After-death delivery uses owner check-ins, a 14-day grace period, and at least two independent trusted-contact confirmations. Message content is not reviewed or manually sent by our team as part of delivery; the system carries out release automatically under the account holder's settings. We do not currently query Social Security or government death databases. Identity verification controls account eligibility and is not used as proof of death. A verifier decline blocks the current automated release until the owner confirms they are alive and resets the delivery cycle. A missed check-in alone never releases content.

4. Service providers and locations

We use Vercel for web hosting, Supabase for the application database and private attachment storage, Resend for transactional email, Stripe for payments and hosted identity verification, Twilio for phone verification, Google for optional sign-in and consented analytics/advertising measurement, and Sentry for error monitoring. Production database data is currently hosted in Canada. Other providers may process data in the United States, Canada, and other locations described in their own policies.

5. Security and access

Connections use HTTPS/TLS. Hosting providers encrypt stored data at rest, and passwords are hashed. Message content is not routinely reviewed, and no employee manually sends each delivery. Limited authorized access may occur only to operate, secure, support, or comply with lawful requests. Raw identity numbers and images remain in Stripe's hosted flow; after successful verification, My Last Word requests Stripe redaction and keeps only minimal verification state and a keyed digest. My Last Word is not end-to-end encrypted or zero-knowledge; the server must process stored content to provide the service.

6. Retention and deletion

Active account content is retained while the account remains active or as needed to provide requested delivery. Deleting an account removes active content and cancels future automated delivery, subject to limited transaction, fraud-prevention, legal, and backup records that may remain until provider backup cycles rotate. Delivery and security logs may be retained to investigate release decisions and abuse. The keyed duplicate-detection digest is stored with the active account and cannot be used to recover the original identity number.

7. Cookies and analytics

Essential storage supports sessions, security, drafts, and preferences. Google analytics or advertising measurement and Meta Pixel, if configured, load only after consent through the Cookie Preferences control. See the Cookies Policy.

8. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, portability, restriction, or information about processing. Account settings provide profile, session, password, and deletion controls. For verified privacy requests, email privacy@mylastword.net.

9. Children and changes

The service is for adults with legal capacity and is not directed to children. We may update this policy when providers or product behavior change and will revise the date above.

10. Contact

My Last Word LLC, Las Vegas, Nevada, USA. Support: support@mylastword.net.