Privacy Policy

Last updated: 29 September 2026 This Privacy Policy (“Policy”) explains how End of Life Planner, located in Budapest, Hungary (“we,” “us,” or “our”), collects, uses, discloses, and otherwise processes personal information for the End of Life Planner website and planner application (the “Service”). This Policy is part of your relationship with us, together with our Terms & Conditions. It describes privacy practices. It does not create any warranty, fiduciary duty, professional relationship, or liability beyond the Terms. If this Policy and the Terms conflict on a privacy topic, this Policy controls for that topic; the Terms control limitation of liability, disclaimers, eligibility, payment, and governing law (Hungary). By accessing or using the Service, you acknowledge this Policy. If you do not agree, do not use the Service. 1. Who we are End of Life Planner, located in Budapest, Hungary, is the data controller for personal information described in this Policy. Privacy requests: [email protected]. Support: [email protected]. 2. Intended audience The Service is designed for individuals 18 or older in the United States. It is a consumer organizer for wishes and documents, not a healthcare provider, covered entity, law firm, funeral director, bank, or government agency. If you use the Service from another country, you do so on your own initiative and understand that we and our providers may process information in the United States and other countries, which may have different privacy laws than your own. 3. Information we collect We collect the following, depending on how you use the Service: • Account and contact data: email address, internal user id, session tokens, and sign-in timestamps. Access is by Google sign-in or an emailed sign-in code; we do not collect an account password. If you continue with Google, we receive the email address, name, and account identifier Google provides. • Purchase and entitlement data: Polar customer, checkout, and order identifiers; paid or refunded status; immediate-digital-access acknowledgement and timestamp; and related transaction timestamps. We do not receive or store your full card number or CVV. • Marketing and waitlist data: email, opt-in status, source page path, unsubscribe token, and confirmation timestamps if you joined the early list. • Planner metadata needed to operate sharing and check-in (this is not ciphertext): invited people’s email addresses, relationship labels, permission flags, share mode (share now or later), invite and access status, check-in cadence, check-in timestamps, and release state. • Plan and vault content you choose to store: checklist fields, notes, and uploaded files. After you set a passphrase, this content is encrypted on your device and stored as ciphertext. We do not hold your passphrase. Until a plan is migrated to encryption, or if encryption is unavailable, some fields may be stored so the Service can function; we treat that content as private and not for advertising. • Optional assist input: the text you type into “Tell it your way,” if you use it. • Communications: emails we send and related delivery metadata (sign-in codes, invites, check-in reminders, release notices, purchase and access notices, yearly export nudges, and marketing only if you opted in). • Device and security data: hashed IP address, truncated user agent, approximate location derived by providers from IP, referrer, request logs, rate-limit keys, and similar abuse-prevention data. • Product analytics and diagnostics, which we send because they are required to operate the Service: page views, in-app events (for example that a section was saved, an invite was sent, or a file size), error reports and stack traces, and browser and device type. Paths have query strings and fragments removed. Without analytics cookies we do not create a PostHog person profile and do not send your account id or email. If you allow analytics cookies, we also identify you by internal user id and email when you are signed in. • Information you provide about other people: names, emails, phone numbers, and roles you enter in the plan or when inviting someone. We do not require you to upload a will, medical record, or government ID to create an account. Anything you put in the plan or vault is voluntary. 4. Where it comes from You (and people using an account you control); people you invite who accept and use the Service; your browser and device; Google when you choose Google sign-in; Polar when you pay or are refunded; and our email, hosting, storage, analytics, and AI providers as needed to operate their services. 5. How we use information We use personal information to: • Create and administer accounts, sessions, Google sign-in, and email-code sign-in • Process payment, taxes as applicable, entitlements, refunds, and chargebacks • Provide the planner, vault, sharing, check-in, survivor view, and export • Send transactional email, including sign-in codes, invites, check-in reminders, release notices, purchase notices, and yearly export nudges • Send product updates only if you opted in, and honor unsubscribe • Secure the Service, prevent spam, fraud, and abuse, and debug outages • Understand product usage at an aggregate and account level so we can operate and improve a small service • Comply with law, enforce the Terms, and protect rights, safety, and the Service • Support a wind-down or business transfer as described below We do not use your plan or vault contents to train AI models. We do not use them for advertising. We do not sell personal information. We do not use automated decision-making that produces legal effects about you, and we do not determine whether someone has died. Check-in reminders and later access follow product rules you configure (for example, notifying people you designated if you miss check-ins or use Release). 6. Legal bases (EEA/UK/Switzerland, if they apply) Where a “legal basis” is required, we rely on: performance of a contract (providing the Service you request); consent (marketing opt-in, optional assist, analytics cookies, and sensitive information where consent is required); legitimate interests (security, fraud prevention, operating the Service, and the product-analytics and error events required to operate it), balanced against your rights; and legal obligation. You may withdraw consent where processing is based on consent; withdrawal does not affect prior processing. Declining analytics cookies does not stop those cookieless events. 7. Encryption, passphrases, and what we can still see When vault storage and plan encryption are in use, documents and plan fields are encrypted on your device before upload. We store ciphertext, key-wrapping material, and account metadata. We cannot decrypt your plan or vault without your passphrase or recovery material, and we cannot reset a lost passphrase. That is not the same as seeing nothing. We can still see, and our processors may process, account email, payment identifiers, invite emails, sharing and check-in metadata, analytics events, error reports, and any text you voluntarily send through optional assist. You are solely responsible for passphrases, recovery cards, exported copies, printed copies, and anything you show on a shared screen. If you share a passphrase, invite someone, or download an export, those copies are outside our control. 8. Sharing, invites, and check-in You may invite people and assign roles. You control access and may revoke it. Sharing is not a legal transfer of authority, a will, a power of attorney, or a death-certificate process. Recipients see only what you grant, when the share mode allows it. We store invitee email addresses and send them email (invite, access-active, and, if you use check-in or Release, later notices). Missed check-ins and owner Release can notify people you designated; that is a product feature you configure, not a legal finding. You represent that you have a right to provide each invitee’s information and that our contacting them is lawful. You are responsible for telling them you have shared access. If an invitee asks us to delete their email, we will do so where we can without breaking a seat you still want active; we may keep limited records of the request. 9. Optional AI assist If you use “Tell it your way,” we send only the text you type in that box to OpenAI, for a single extraction request, so we can suggest fields. We do not send your saved plan or vault files. Requests are configured not to be stored on our side of the API call. You must review suggestions before they become part of your plan. OpenAI’s terms and privacy policy apply to that request. Do not paste passwords, full ID numbers, or anything you are not willing to send to a third-party model provider. 10. Payments Card data is handled by Polar.sh, which may act as an independent controller for checkout and payment. Polar’s terms and privacy notice apply to checkout. We store entitlement and Polar identifiers so we can unlock, support, or revoke access. We do not store full card numbers. 11. Cookies, analytics, and similar technologies We use: • Essential cookies and similar storage for sign-in, session security, and load of the Service • PostHog for product analytics (page views and in-app events), identifying signed-in users by internal user id and email, capturing application errors, and the in-product support chat We send PostHog product-analytics and error events because they are required to operate the Service. Before you allow analytics cookies, and if you continue without them, those events are cookieless: we remove query strings and URL fragments, do not create a PostHog person profile, and do not send your account id or email. PostHog uses network and device signals to generate a short-lived server-side visitor hash, so cookieless visitor counts are approximate and the same visitor may be counted again later. Event properties include operational details (such as a section id, invite relationship type, or file size) rather than the contents of plan fields or vault files. We do not currently record session videos of the planner. Exception reports may include technical stack traces and the page where an error occurred. We ask for your affirmative consent before PostHog uses analytics cookies or local storage for analytics or identifies a signed-in user. You may continue without analytics cookies without losing access to the Service, and may change that choice from the Privacy Policy. Essential cookies may still be required for sign-in and security to work. Declining analytics cookies does not stop the cookieless events we send to operate the Service. The support chat is part of the Service and is available whatever you choose about analytics cookies. It keeps a random support-chat key in your browser's local storage so you can return to your conversations, and it does not send analytics events. Messages you send, the page you start a conversation from (with query strings and invitation tokens removed), and, if you are signed in, your account email are sent to PostHog so we can answer you. Signing out clears the support-chat key from that browser. We do not currently run third-party advertising pixels on the Service. We do not sell personal information or share it for cross-context behavioral advertising as those terms are used under California law. If that changes, we will update this Policy and provide any required opt-out. Browser “Do Not Track” is not a consistent standard; we do not treat it as a complete opt-out of essential or analytics cookies. If a law requires us to honor a recognized opt-out preference signal (such as Global Privacy Control) for a particular use (for example sale or share), we will do so for that use. Because we do not sell or share for advertising, those signals do not currently change core Service operation. 12. Service providers We use vendors to operate the Service. They process information on our instructions except where they act as independent controllers (notably Polar for payments, and OpenAI for optional assist input). The current list, with purpose and region, is on our Sub-processors page. We may change providers or add replacements that perform similar functions. Material new categories of provider will appear on that page. Our analytics workspace may include operational integrations used by our team (for example internal alerts). Those are for running the Service, not for selling your information. We require service providers to protect information appropriately, but we are not responsible for a provider’s independent failure except as the Terms and applicable law require. 13. Sensitive information, HIPAA, and professional limits You may choose to record health-related notes, financial-account locations, family details, funeral wishes, or similar sensitive information. That is optional. Where GDPR or similar law requires an additional condition for special-category information, we will request explicit consent before processing it for the organizer functions you select. We are not a “covered entity” or “business associate” under HIPAA, we do not enter business associate agreements, and the Service is not a medical record, HIPAA-compliant platform, or attorney-client or other privileged channel. Information you store is not protected by medical or legal privilege because you stored it here. Nothing on the Service is legal, medical, tax, insurance, or funeral-director advice. The Service is not a will and does not create a will, trust, power of attorney, advance directive, DNR, or other legal instrument. If you include special-category or “sensitive personal information” (as privacy laws use those terms), we use it only to provide the organizer functions you requested, to secure the Service, and to comply with law — not to infer characteristics for advertising. Where consent is the applicable condition, you may withdraw it; this can prevent us from continuing to provide the affected feature. 14. What we ask you not to store Do not use the Service as a password manager. Do not store live passwords, PINs, one-time codes, full Social Security or national ID numbers, or copies of identity documents unless you accept the risk that metadata, assist, exports, invitees, or a compromised device could expose them. Digital-life fields are for how to find access, not the secrets themselves. We may refuse or delete content that we reasonably believe is unlawful or that creates unacceptable risk, where we technically can (we cannot read ciphertext without your passphrase). 15. How we disclose information We disclose personal information: • To the service providers above • To people you invite, to the extent of the access you grant • To Polar and other payment parties as needed for checkout, tax, refunds, and fraud • If we believe in good faith disclosure is required by law, legal process, government request, or to protect the rights, property, or safety of us, you, invitees, or the public, or to investigate fraud or security issues • In connection with a merger, acquisition, financing, restructuring, insolvency, or sale of assets, in which case this Policy will still apply until replaced • In aggregated or de-identified form that is not reasonably likely to identify you We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not disclose it to third parties for their own direct marketing. We do not permit our providers to use your plan or vault contents for their advertising. 16. Retention We keep account, entitlement, plan ciphertext, vault ciphertext, and sharing/check-in metadata while your account is active and as needed for refunds, disputes, security, backups, and legal duties. • Waitlist email: until you unsubscribe or we delete the list, unless law requires longer • Security hashes, rate-limit keys, and similar logs: generally up to 90 days, unless needed longer for an investigation • Analytics and error data: according to our PostHog project settings and backup cycles • Assist requests: not retained by us as plan content; the provider may have a short residual processing window • Legal holds: as required If we wind down the Service, we will give at least 90 days’ notice and keep export available during that period, as described in the Terms. After closure, we delete or de-identify personal information we no longer need, subject to backups and law. Backups and logs may persist for a limited period after deletion from production systems. 17. Security We use reasonable administrative, technical, and organizational measures appropriate to a small service, including TLS in transit, hashed or truncated abuse-prevention data, and client-side encryption for plan and vault content when that feature is enabled. No method of storage or transmission is 100% secure. We do not guarantee that unauthorized access, hardware failure, or provider outages will never occur. You are responsible for the security of your email inbox (used for sign-in), devices, passphrases, and copies you export or print. 18. International transfers We and our providers may process information in the United States, the European Union, and other countries. Where data is transferred from the EEA, United Kingdom, or Switzerland to a country without an applicable adequacy decision, we use a valid transfer mechanism, such as the European Commission’s standard contractual clauses or an applicable adequacy framework, and supplementary safeguards where required. We use consent or contract-based transfer derogations only for the limited situations where law permits them. You may request information about the safeguards applicable to your data at [email protected]. We do not operate a separate regional data-residency option. 19. Your choices and rights You may: • Decline marketing, or unsubscribe using the link in those emails • Skip optional assist • Revoke sharing • Export your plan (PDF and encrypted pack) while the Service is available • Request access, correction, deletion, or a copy of personal information we hold, by emailing [email protected] We will not discriminate against you for exercising rights granted by law. We may need to verify your identity (for example via the email on the account). We may decline or limit a request as permitted by law, including where we cannot authenticate you, the request is excessive or unfounded, disclosure would harm others, or we must keep records for legal, security, or payment reasons. Important limit: we cannot produce the plaintext of encrypted plan or vault content without your passphrase. For that content, “access” and “deletion” mean we can confirm that ciphertext exists and, if you request deletion of the account, we can delete ciphertext and related records we control. We cannot recover a lost passphrase, and deletion of our copy does not erase exports, prints, or copies invitees already have. Authorized agents may submit requests where the law requires us to accept them; we may require proof of authority and still verify the consumer. If we deny a request and your state law provides an appeal, email [email protected] with the subject “Privacy appeal” and why you appeal. If you remain unsatisfied, you may contact your state attorney general or, where GDPR applies, the supervisory authority in your habitual residence. In Hungary, this is the National Authority for Data Protection and Freedom of Information (NAIH). 20. Additional U.S. state notice (including California) This section is a notice at collection for California and a comparable notice for other U.S. states with consumer privacy laws. Categories collected (in the last 12 months and going forward, as you use the Service): identifiers; customer records / commercial information; internet or other electronic network activity; approximate geolocation; electronic information in the limited sense of error diagnostics, not voice recordings; inferences drawn from product usage (for example that you completed a section); and sensitive personal information you choose to enter (such as health-related notes or financial-account locations). We do not collect precise geolocation, biometric identifiers, or social security numbers as account fields. Business purposes: the uses in section 5. Retention: see section 16. We keep each category for the time reasonably needed for those purposes, then delete or de-identify. Sold or shared: we do not sell personal information and do not share it for cross-context behavioral advertising. We have no “Do Not Sell or Share My Personal Information” opt-out beyond this statement, because we do not sell or share in those ways. We do not offer financial-incentive programs that exchange discounts for personal information. Sensitive personal information: used only to provide the Service you request and for security and legal compliance, not to infer characteristics. We do not have actual knowledge that we sell or share the personal information of consumers under 16. California “Shine the Light”: we do not disclose personal information to unaffiliated third parties for their direct marketing. 21. Children The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it. Parents or guardians who believe a minor provided information should contact [email protected]. 22. Third-party services and links Checkout, email delivery, analytics, hosting, object storage, and optional assist are operated in part by third parties. Their sites and policies govern their own practices. The Service may link to third-party sites; we are not responsible for their content or privacy practices. 23. Changes; business transfers; wind-down We may update this Policy by posting a revised version on this page and changing the date above. Material changes take effect when posted, or on a later date we state. Where permitted, continued use after the effective date constitutes acceptance. If a change requires notice or consent under law, we will provide it (including by email to the address on your account when appropriate). If we transfer the Service in a merger, acquisition, or similar transaction, or if we wind down, personal information may be transferred or retained as needed to give the notice and export window described in the Terms, then deleted or de-identified as described in section 16. 24. Contact Privacy: [email protected] Support: [email protected] Location: Budapest, Hungary We are a small team. We will respond within the time required by applicable law, often sooner. 25. No extra promises This Policy is not legal advice about your estate. It is not a promise that the Service will meet a particular regulator’s certification. Features may appear in stages. Practices described as “when in use” apply when that feature is enabled for your account.