Where your content goes, and who can open it.
You are trusting us with personal things, things that are important. So here is the whole mechanism: what happens on your device, what reaches us, and what we can and cannot read.
Your key is made and opened on your device only.
Everything you add is encrypted on your device. We only receive a scrambled version of the content heavily encrypted, together with a copy of your key that only you can unlock. A bit like giving us half a key, where you (and only you) hold the other half.
- Letter to Maya“Happy 21st, Maya. I wrote this the week you…
- first-steps.mp4“The first time you walked…
- Important detailsBank account, sort code, and where the will is kept…
- Letter to Maya
- first-steps.mp412.4 MB · video
- Important details
The encryption we use is AES-256, the same standard banks and governments use. We didn’t invent it, which is the point: it has been public for twenty years and nobody has broken it.
Three ways in. You only need one.
The hard part is not encrypting things. It is making sure you can still get in years later. So there are three separate ways to access your key, and losing one of them costs you nothing.
Biometric
The fastest way in on a device you use often — currently your Face ID or fingerprint, and we will add more as biometric identity evolves.
A PIN on your device
Four digits you choose, with a hard limit on wrong guesses — ten, and it forgets your key.
Your recovery code
Twenty characters, shown once at setup. This one works on any device, anywhere.
People you trust, or a date you set.
You pick one when you create an event. Either way, what opens goes only to the recipients you named.
Guardians agree
You name up to eight people and choose how many must agree. If your check-ins stop they are asked to confirm, and they never see what is inside.
- Check-ins stop
- Guardians are asked
- Enough agree
- Recipients emailed
- Needs
- Guardians you name
- Change it
- Any time while your event is live
A date arrives
You pick a moment. Your files are locked to it by drand, a public beacon that cannot publish a future value early — so until then nobody can open them, us included.
- You pick a moment
- Locked by the beacon
- The moment arrives
- Recipients emailed
- Needs
- A date and time you choose
- Change it
- Reschedule or withdraw before it
People drift. That is planned for.
Over years people will move, change email and lose things. A setup that needed every Guardian to still be reachable would quietly expire.
Never all of them
You choose how many Guardians must agree. Name four and require two, and two of them can be unreachable without anything being lost.
Change them while it runs
Once your event is live you can add someone, remove someone, or raise and lower how many must agree — right up until a release begins.
Each has a way back
Every Guardian gets their own recovery code when they accept, so a lost phone is not the end of it.
Not a hard drive in our office.
Your files go to Arweave, an open storage network that nobody owns (like the internet), with copies spread across independent operators around the world.
Each dot is an independent operator, and the filled ones hold a copy of your file.
That storage is bought once, not rented. No monthly bill sits behind your account waiting to lapse, and nothing is deleted because a card expired. It is why each event is paid for once, never by subscription: a subscription is a thing that can stop.
Read the Arweave yellow paper(opens in a new tab)What sits on our servers.
What we hold
- Locked copies of your keys
- Names and email addresses for your Guardians and recipients, so we can email them
- The name you gave the event, and the name you gave each item
- The size and type of every file, and when an event is due to open
- The date you last checked in
What we cannot read
- Anything you wrote
- Any file, photo or video you uploaded
- Any password or account detail you saved
- Your recovery code, biometrics, and your device PIN
What we would do if LGCY ended.
A fair question to ask anyone holding something for thirty years. We would rather answer it than tell you not to worry.
- We would publish an exportYour encrypted files, and everything needed to identify each item and open it — including the key material that today only we hold.
- We would publish the toolsThe file format, and a program that could open or release the export with applicable keys, with no LGCY servers involved anywhere in the process.
- We would open source all the aboveReleased openly, so anyone with the right key could get a copy, release the contents or open it.