Last updated: 2026-09-29
This Privacy Policy explains how Legacy handles personal data in connection with its digital-legacy support service for people dealing with the loss of someone.
Controller: Chrometis OÜ (operator of Vaulto and Legacy)
Privacy contact: legacy@chrometis.com
Postal address: Ahtri tn 12,
15551 Tallinn, Estonia
Registration number: 17340556
Data Protection Officer, if
applicable: contact legacy@chrometis.com
We may process:
We do not intentionally collect advertising identifiers, precise location, contacts address-book data, health data, or payment card data in this build.
Vault content may concern the account holder, a deceased person or other living people. Users must not enter another person’s data unless they have a lawful basis and the necessary authority.
We use data to:
Optional product-usage analytics and crash diagnostics are collected only after explicit user consent. These events are limited to operational information such as screen/feature names, app lifecycle, platform and error type. Firebase may use app-instance and device-related technical identifiers for these services; the events are not anonymous. Vault content, email addresses, access-request content and direct user identifiers are not deliberately sent as telemetry. Consent can be withdrawn in Account. On withdrawal, the app disables collection, resets local Analytics data and requests deletion of unsent crash reports. Previously transmitted data remains subject to provider retention and erasure processes.
The service is intended to provide practical support after a loss by facilitating controlled, read-only access to digital-legacy information. The operator does not determine who is an heir, executor or legally entitled person.
Where GDPR applies, we rely on:
Users may add trusted contacts by email. A trusted contact can request access, and the owner can cancel before the waiting period ends. Secure access may be included under an eligible paid owner plan. Under Free, an uncancelled request may instead become eligible for a one-time in-app purchase; read-only access remains locked until store and backend verification complete.
We process purchase-intent, product, hashed transaction, store, environment, eligibility and grant metadata to prevent replay, bind each purchase to one owner/request, support single- or multiple-redeemer policies, provide access and handle refunds, security events and disputes. Apple, Google and RevenueCat process purchase data under their own notices. Legacy does not receive full payment-card details.
Read-only vault display requires an active grant belonging to the same authenticated Firebase user ID that submitted the request, a matching verified contact email, and Firestore access rules. A later account that reuses the email does not inherit the earlier request or grant.
The app does not verify a death, probate, a will, family relationship, representation, succession certificate or any other legal entitlement. A waiting period, account relationship or read-only grant is a technical workflow and is not evidence of a legal right to access or inherit content.
Owner access is free while a paid subscription is active or was paid within the previous six months. Subscription non-payment does not delete information: it is retained for at least one year after payment stops; after that it remains retained but inherited access is denied until eligibility is restored. Explicit account deletion and disclosed legal/security deletion remain separate.
Android and iOS use native Firebase Authentication and Firestore SDKs. Firestore security rules restrict reads and writes by authenticated identity, owner ID and trusted-contact email.
New text records use v4 Encrypt-then-MAC: a fresh random 256-bit per-record key, AES-256-CBC with a fresh random 128-bit IV, separate encryption and authentication subkeys derived with HMAC-SHA-256, and an HMAC-SHA-256 tag that binds the secret ID, owner, title and category. Tampered v4 records fail closed. Older v3 records use AES-CBC plus HMAC but do not bind that document context; v2 and older records remain readable for compatibility and may not provide authenticated integrity.
The per-record decryption key is currently stored in the same Firebase data and authorization boundary as the ciphertext. The service is therefore not end-to-end encrypted and an authorized backend/data compromise could expose vault text. For photo secrets, only the Storage object reference is encrypted as text; the photo binary itself is not client-encrypted in the current build and depends on platform transport, Storage rules and account/grant authorization. New records keep an encrypted object reference instead of persisting the download URL in Firestore; historical records may retain legacy URLs until migrated. The app does not provide an export function.
Risks also include device or operating-system compromise, stolen credentials or email access, malicious or mistaken trusted contacts, notification delivery errors, provider incidents, backups, incomplete asynchronous deletion and permanent loss if recovery data is unavailable. No security system is perfect. Users should protect their device passcode, email account and Firebase login credentials.
We do not sell personal data. Data may be processed by infrastructure and service providers needed to operate the app, including Firebase/Google Cloud, Apple App Store, Google Play, RevenueCat when enabled and email delivery infrastructure where configured.
Trusted contact email addresses are used to notify contacts and validate access-request eligibility.
Service providers may process data outside the European Economic Area. Where GDPR applies, transfers should rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or equivalent contractual/data-transfer mechanisms.
The controller should maintain processor agreements, transfer assessments and a record of processing activities before launch.
We keep account and owner-managed trusted-contact data while the account is active. Account deletion initiated in the app or through the authenticated website removes the Firebase account and starts backend deletion of vault data, photos, contacts owned by that account, UID-bound access requests, grants, notification records and RevenueCat customer data where that integration is configured. Backend cleanup may complete asynchronously. An email address entered independently in another user’s trusted-contact list may remain in that user’s account until that user removes it or the applicable retention period ends. Store subscriptions are not cancelled by account deletion and must be managed separately.
Vault data stored in Firebase remains until the user explicitly deletes it or the account-deletion workflow removes it, subject to the non-payment retention rule above and any retention required for legal, fraud-prevention or security reasons. The app does not provide an export function. Temporary local app data is cleared on account deletion on a best-effort basis and may otherwise remain until app data is cleared or the app is removed, subject to platform backup behaviour.
When RevenueCat or a store reports a payment issue, cancellation or expiration, Legacy stores the entitlement state and previous paid plan to enforce current permissions and display recurring operational notices. These notices do not change the retention of existing vault or inheritance data.
Where GDPR applies, users may request access, rectification, deletion, restriction, portability, objection to processing, and withdrawal of consent where processing is based on consent.
Users may also complain to their local data protection authority.
Requests should be sent to the privacy contact above. The controller may need to verify identity and may retain information where required for legal claims, security, fraud prevention or other lawful obligations.
Legacy is not intended for children under 13 or under the minimum digital-consent age in the user’s country. We do not knowingly collect children’s personal data.
Store privacy disclosures must match actual behaviour. Optional diagnostics and product-usage telemetry is disabled until the user gives explicit consent. The app does not sell personal data or use telemetry for targeted advertising.
We may update this Privacy Policy when the service changes. Material changes should be communicated in-app or by email where appropriate.