Privacy Policy

This Privacy Policy explains how LGCY LTD (“LGCY”, “we”, “us”, “our”) collects, uses, shares and protects personal data when you use the LGCY service at lgcy.box (the “Service”).

We are the data controller for the personal data described in this policy, except where we act as a processor on your behalf (see section 4). We are committed to protecting your personal data and handling it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are and how to contact us

We have not appointed a statutory Data Protection Officer, as we are not required to. Privacy questions and data-subject requests should be sent to privacy@lgcy.box.

2. Who this policy applies to

LGCY involves three kinds of people, and we process data about each:

• Owners — people who create an account, build events, and store content.
• Guardians — people an Owner nominates to confirm, by voting, that a triggering event (such as the Owner’s death) has occurred.
• Recipients — people an Owner designates to receive access to stored content after an event is confirmed.

If you are a Guardian or Recipient, your email address and name were provided to us by the Owner who nominated you. Section 3 explains what we then collect, and section 11 explains your rights.

You must be 18 or over to use the Service.

3. The personal data we collect

3.1 Data you provide as an Owner

• Account data: your email address and (optionally) your name.
• Authentication data: if you sign in with a password, it is stored by our authentication provider in hashed form — we never see it in plaintext. You may also register a passkey or sign in with Apple or Google.
• Encryption key material: your public encryption key (stored in plaintext, as public keys are meant to be shared) and encrypted (“wrapped”) copies of your private key. Your private key is only ever unlocked in your browser, using your passkey/biometric, a device-local PIN, or your recovery code. We store the wrapped copies but cannot unwrap them — we do not hold your passkey secret, your PIN, or your recovery code.
• Event and content metadata: the names of your events, boxes and items, file types and sizes, and configuration such as your chosen release method and, for scheduled events, the release date/time and timezone.
• The content itself: files, messages and credentials you upload. This is end-to-end encrypted — see section 3.5.
• Billing data: we use Stripe to process payments. Stripe stores your card details; we receive and store only a customer identifier and your purchase records, and can retrieve your invoice history. We do not store your card number. When you pay for an event, the payment also carries your account identifier, the event’s identifier and the size you bought, so that we can apply it to the right event; Stripe never receives the event’s name or anything inside it.
• Check-in activity (quorum events): to operate the “dead man’s switch”, we record when you last checked in and when your next check-in is due, and keep an audit log of check-in events.

3.2 Data about Guardians and Recipients

For each Guardian or Recipient an Owner adds, we process:

• Email address and name, as provided by the Owner.
• Encryption key material: a public key and wrapped copies of a private key, unlockable only by the Guardian or Recipient themselves — using either the invite link they were sent or a recovery code shown to them once. No account, password or third-party login is involved.
• Confirmation identifiers (Guardians): the signing address a Guardian’s browser derives from their own key when they confirm. Nobody issues it to them, and it is not linked to any external account.
• Activity data: for Guardians, whether and when they voted and a reference for the recorded confirmation; for Recipients, when they were invited and first accessed content.
• Anti-abuse counters: how many times a replacement access link has been requested and when, and how many reminders we have sent, so that we can apply rate limits and stop reminding indefinitely.

3.3 Data we collect automatically

• Analytics: we use two analytics tools. One is cookieless and always on; it gives us aggregate figures such as page views and performance, and does not collect personally identifiable information for cross-site tracking. The other sets cookies, so it runs only if you accept them — see section 9. Before any page view is recorded we strip the query string and the part of the address after a #, and that tool is not loaded at all on the pages used to claim an invite, open an event, vote, or reset a password. So invite links, recovery links and payment references are never sent to it. Neither tool ever receives anything from inside your events.
• Product usage within your account: which steps of account setup and event creation you reach, which suggestion you started from, which kinds of content you choose to add, how long each step takes and whether creating the event succeeded — tied to your account so we can improve the experience. It never includes anything you write, upload, or anyone you name. Kept for 12 months, and deleted with your account.
• Advertising measurement: if you accept optional cookies, we also use the Meta Pixel and Meta’s Conversions API to tell us which of our ads lead people to sign up or pay for an event. The Pixel receives the page address, device and browser data and its own cookie identifiers. When you sign up or buy, our servers also tell Meta, sending the event (with the price, for a purchase), a hashed copy of your account email address and of your account identifier, your IP address, your browser’s user agent and Meta’s cookie identifiers. A hashed email is pseudonymised, not anonymous: Meta uses it to match the event to a Facebook or Instagram account you hold. Because this is sent from our servers, blocking Meta’s script does not stop it once you have accepted; rejecting or withdrawing on that browser or device does. The Pixel sends nothing from a page whose address contains an invite link, a recovery link or a payment reference, and what our servers send never includes those addresses or references. For a payment for an event, the page address our servers report is a fixed one, the same for every purchase, which contains no event identifier. The Pixel is not loaded at all on the pages used to claim an invite, open an event, vote, or reset a password. Meta never receives anything from inside your events.
• Technical and security data: our hosting and infrastructure providers process technical information (such as IP address and request details) as a normal part of delivering and securing a web service, and to enforce rate limits. If you accept optional cookies, your IP address is also shared with Meta as described above.

3.4 Sensitive metadata

Although your content is encrypted and unreadable to us (section 3.5), some of the metadata you provide is stored in readable form in our database — chiefly the names you give your events, boxes and items, along with your chosen release method and, for a scheduled release, its date and time. Names are free text, so they can be revealing, and in some cases may indicate health-related or otherwise sensitive circumstances. We ask you to bear this in mind when naming items, we restrict access to this data (section 12), and we process it only to operate the Service for you. We do not ask for, and ask that you do not place, special-category personal data (such as detailed health, racial, political or religious information about identifiable people) into item or event names — keep such material inside the encrypted content, where we cannot see it.

3.5 Content we cannot read (end-to-end encryption)

Files, messages and credentials you store are encrypted in your browser with a unique key before they are uploaded. That key is itself wrapped so that only you, and the Recipients you authorise, can ever unwrap it. As a result:

• We never receive or hold the plaintext of your content.
• We cannot decrypt your content, and we cannot recover it if you lose all of your unlock methods (passkey, PIN and recovery code).
• We store only the ciphertext, plus the metadata listed in section 3.1.

We think this is the right design for a service that holds people’s most sensitive material — but it has consequences for data requests, explained in section 11.

4. When we are a processor, not a controller

When you, as an Owner, provide us with the personal data of your Guardians and Recipients (their names and email addresses), you determine why and how that data is used within your event. In respect of that data you act as a controller, and we act as your processor, handling it on your instructions to deliver the Service. You are responsible for ensuring you have a lawful basis to give us that data and to have us contact those people on your behalf.

For our own operational purposes — securing the platform, billing, communicating with account holders, and complying with law — we are the controller. This also includes certain processing of Guardians’ and Recipients’ data whose means we determine ourselves — such as providing their authentication, securing their access, and the permanent records described in section 8 — for which we act as a controller rather than as the Owner’s processor.

5. How we use your data and our lawful bases

Where we rely on legitimate interests, we have considered your rights and freedoms and believe our use is proportionate. You can object to processing based on legitimate interests — see section 11.

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not sell your personal data.

Providing your account data and, where relevant, your Guardians’ and Recipients’ details is necessary to enter into and perform our contract with you. If you do not provide it, we will not be able to create your account or deliver the Service.

6. Who we share your data with (sub-processors and recipients)

We share personal data with the following categories of service provider, each of which processes it on our behalf under contract (except Meta, see below), and with the categories of people the Service is designed to reach:

Meta as joint controller. For advertising measurement, Meta Platforms Ireland Limited and LGCY are joint controllers for collecting and sending this data to Meta. We are responsible for asking your consent and telling you about it; the arrangement between us is Meta’s Controller Addendum. Meta is an independent controller for how it then uses the data, including transferring it to Meta Platforms, Inc. in the United States under its own safeguards; see Meta’s Privacy Policy and send requests about Meta’s own use to Meta.

A current list of the named providers behind these categories is available on request from privacy@lgcy.box.

We also share data with other users of the Service as the Service is designed to work — for example, an Owner can see the names, email addresses and status of the Guardians and Recipients they added. Guardians and Recipients do not see each other’s details.

We may disclose personal data where required to comply with the law, a court order, or a lawful request from a public authority, or to protect our rights, users or the security of the Service.

7. International data transfers

Our primary data store is located in the EEA (Ireland). Some of the providers described in section 6 are based outside the UK and EEA, principally in the United States. Where we transfer personal data outside the UK, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement / Addendum or the EU Standard Contractual Clauses, or on a valid adequacy decision (including the UK Extension to the EU–US Data Privacy Framework where a provider is certified). You can request more detail on these safeguards by emailing privacy@lgcy.box.

8. Permanent records — please read carefully

Two parts of the Service are, by design, permanent and cannot be edited or deleted by anyone, including us:

• Encrypted content in permanent storage. When your content is secured, its (encrypted) form is written to a permanent, decentralised storage network. Although it is encrypted and unreadable without your keys, the ciphertext cannot be removed once written.
• Event and confirmation records in a permanent public record. Event identifiers, Guardians’ signing addresses, their votes and the associated timestamps are written to a public, permanent record. This information is publicly visible and cannot be deleted or altered.

This means that for these specific categories of data, your right to erasure (section 11) is technically impossible to fulfil. We disclose this openly so you can make an informed choice before using the Service. A signing address in that public record may, in some circumstances, be linked to an individual’s identity by third parties.

9. Cookies and local storage

We use:

• Essential cookies — to keep an Owner signed in; to keep a Guardian or Recipient signed in after they have opened their invite link or entered their recovery code; and (in preview environments) a preview-access cookie. These are strictly necessary for the Service to function.
• Analytics and advertising cookies (optional) — if you accept them, our analytics provider sets two cookies to measure how the site is used, and the Meta Pixel sets _fbp and _fbc (we may also set _fbc ourselves when you arrive from a Meta ad) to measure which of our ads lead to sign-ups and purchases. These are not set unless you accept, and we delete them when you reject or withdraw.
• Your cookie choice — stored on your device. This stored choice is essential and is kept whichever way you choose. Only while you have accepted is it also mirrored in an essential cookie so our servers can honour it (up to 180 days, shorter in some browsers, refreshed when you visit); that cookie is deleted when you reject or withdraw, and on your next visit if your choice is no longer stored.
• Storage on your own device — LGCY keeps encryption keys in your browser so you don’t have to unlock on every action. One is protected by your PIN and never leaves your device or reaches us; another is a temporary, non-exportable cached copy of your unlocked key, cleared automatically after 8 hours of inactivity, 24 hours maximum, or when you sign out.

Your choice, and how to change it

We ask before setting any optional cookie. Nothing is loaded until you choose, rejecting takes exactly one click just like accepting, and you can change your mind at any time using Cookie settings in the footer. Your choice applies to the browser or device you make it on. Withdrawing stops any further collection on that browser or device and deletes the optional cookies there. To ask us to delete analytics or advertising data already collected, email privacy@lgcy.box: we will delete what we hold and pass your request on to our providers. Advertising data already sent to Meta is held by Meta, so deleting Meta’s copy must be requested from Meta (see Meta’s Privacy Policy).

The essential cookies and the on-device key storage listed above are strictly necessary to provide the Service you asked for, so they are not covered by that choice and cannot be switched off while you use LGCY.

10. How long we keep your data

Deleting your account. You can delete your account from the account settings (this requires confirming a one-time code we email to you, and closing any active events first). Doing so removes your records from our database, including your account, events, boxes, item metadata, wrapped keys, and Guardian/Recipient records. It cannot remove content or records already written to permanent storage or the permanent public record (section 8). Once your keys are deleted, any such content becomes permanently undecryptable.

11. Your rights

Under the UK GDPR you have the right to:

• Be informed about how we use your data (this policy).
• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”), subject to the permanent-record limits in section 8.
• Restrict or object to our processing, including processing based on legitimate interests.
• Data portability for data you provided to us, where technically feasible.
• Withdraw consent at any time where we rely on consent.
• Complain to the Information Commissioner’s Office (see section 14).

To exercise any of these, email privacy@lgcy.box. We will respond within one month. We may need to verify your identity first.

An important limit created by our encryption. Because your content is end-to-end encrypted, a data request we fulfil can include your account data and the metadata we hold (event names, item names, sizes, types, Recipient/Guardian lists), but it cannot include the plaintext of your stored content — we do not have it and cannot produce it. You can, however, access and export your own content at any time yourself through the app, using your own keys.

12. Security

We take the security of your data seriously. Measures include:

• End-to-end encryption of all stored content (AES-GCM), with keys derived and held only in your browser/device.
• Encryption in transit (HTTPS) for all connections.
• Strict access controls in our database (row-level security), with the most sensitive tables — key material, recipient keys — accessible only to privileged server processes, never directly by users.
• Re-authentication for sensitive actions such as changing your email or deleting your account.
• Independent verification of release conditions before any decryption key is released to a Recipient.
• Rate limiting and platform-level protections against abuse.

No online service can guarantee absolute security, but our architecture is designed so that even a compromise of our servers would not expose the contents of your stored material.

13. Children

The Service is intended only for adults. It is not directed at anyone under 18, and we do not knowingly collect data from people under 18. If you believe someone under 18 has provided us data, contact privacy@lgcy.box and we will delete it.

14. Complaints

If you have a concern about how we handle your data, please contact us first at privacy@lgcy.box so we can try to resolve it. You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office (ICO) — https://ico.org.uk — helpline 0303 123 1113.

15. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify account holders by email or through the Service. The “Last updated” date at the top shows the current version.