Privacy

What we store

• Your plan, as one encrypted record (AES-256-GCM). Its random encryption key is protected using your private link and, if you create one, your executor link. The database stores encrypted keys and one-way link fingerprints, not the links themselves. A copy of the database alone does not contain the key needed to read the plan.
• When an owner or executor opens a plan, the link is sent to our server over HTTPS and held in a browser cookie. Our server decrypts the plan in memory to show it and, for an owner, save changes. We do not routinely read plans; this is server-side processing, not end-to-end encryption.
• Dates: when a plan was created, changed and last opened (to apply the 3-year rule).
• Daily counters to stop abuse, keyed by a salted one-way hash of your internet address, kept two days.

What we never ask for

No name, no email address, no phone number, no account. Every box is checked, and the site refuses text that looks like a password, PIN, recovery phrase, card number, Social Security number or email address. No check catches everything (a plain word used as a password looks like any other word), so please never type one.

Cookies

One cookie holds your plan's private link on this browser (and one for an executor link, if you open one), plus a security cookie for forms. No advertising or analytics cookies, no tracking cookies and no third-party fonts. The only script from another site is the one banner ad on the public pages, described under Advertising; it also counts one page view per page as a daily total.

Server logs

Like every web server, ours logs page addresses and internet addresses for a short time for security. The key in your private link is after the "#" (which browsers do not send as part of a page address). The browser sends it to our server when opening a plan and in its cookie afterward.

Sharing

We do not share plan contents or send them to anyone. The banner ad on public pages is fetched by your browser from adengine.us, WeldonPC’s ad server: see Advertising. Payments are not available during preview. If PayPal payments are introduced, we will update this policy before launch to explain what information is shared and received.

Retention and deleting

A plan that neither its owner nor an executor opens for 1095 days (about three years) is deleted unless it has an active paid Keeper period. This includes plans made during the free preview. Print a letter for your estate papers and reprint it after changes: the printed letter is a snapshot.

You can delete your plan from the live database yourself; if a Keeper subscription is renewing, cancel it first. Encrypted copies can remain in backups after deletion. We normally keep the newest 14 database backups, usually made nightly, and the newest ten update backups of each kind on the server; older copies can remain longer. WeldonPC also keeps an off-server copy of update backups with no fixed end date. A database backup alone does not contain the link needed to read the plan. Restoring an older database backup could bring back a deleted plan or an executor link you had revoked after that backup was made.

Advertising

Since October 17, 2026 the public pages (home, Pricing, the Guide and About) show one small banner ad from AdEngine (adengine.us), the small ad network run by WeldonPC, the company behind this site. For now the ads are for WeldonPC’s own services. Your plan and every page in it, an executor’s letter, the Legacy Checkup, this page, the terms and error pages show no banner and load nothing from adengine.us.

To show an ad, your browser loads a script from adengine.us, asks it for one banner, loads the banner image, and reports once that the page was viewed and once that the banner was shown. Like any website, adengine.us receives your internet address, your browser type and the address of this site with those requests (the site’s address only, not the page’s).

• No cookies, no profile. AdEngine sets no cookies, gives you no ID and does not track you from site to site.
• How your internet address is used. adengine.us looks up the approximate city for your internet address in a location database kept on its own server (nothing is sent to anyone else), so that ads meant for one area are shown only there. It also uses the address to count each ad view or click only once and to leave out robots and WeldonPC’s own office traffic. The address is not stored with the counts; the temporary entries made from it expire within six hours and are cleared from the server within two days.
• What is kept. Daily totals only: page views for this site, and views and clicks for each ad. The adengine.us web server also keeps a standard access log (internet address, time, address requested, referring site, browser) for security; it is deleted on a rolling schedule.
• Clicking an ad passes through adengine.us, which counts the click, and then opens the advertiser’s site, which has its own privacy policy.
• Nothing about you is sold or shared.