Privacy Policy

Last updated: September 2026 · Applies to thegoodbyevault.com, thenominee.org, and the "The Goodbye Vault" apps (Android & iOS)

1. What this service is

The Goodbye Vault is an encrypted digital-legacy vault. You store secrets; if you stop checking in, they are delivered to nominees you chose. It is operated as part of the Nominee ecosystem ("we", "us").

2. What we collect

• Account data: your email address and a one-way password hash. Your password is never stored in readable form.
• Encrypted records: the ciphertext of your secrets, plus wrapped (encrypted) keys. We cannot read these. They are encrypted on your device before reaching us.
• Nominee data: names, email addresses and notes of the people or organisations you designate, so we can deliver records to them.
• Check-in metadata: timestamps of your logins and activity, used to run the reminder and release schedule.
• Operational logs: standard server logs (IP address, timestamps) kept for security and abuse prevention.

3. What we never have

• Your master password or the encryption keys derived from it.
• Plaintext content of any record you store.
• Plaintext delivery tokens (only one-way hashes and an encrypted form that requires a separately-stored server release key).

4. How we use data

• To operate the vault: authentication, storage of encrypted records, nominee management.
• To send reminder emails when you miss a check-in.
• To send release emails with a secure delivery link to your nominees if you stop responding through the grace period.
• To notify a nominee's delivery status back to you (sent / accessed).

We do not sell, rent, or share personal data with advertisers or data brokers. Ever.

5. Legal basis (GDPR)

Processing is based on contract performance (Art. 6(1)(b) GDPR) for operating your vault, and on legitimate interest (Art. 6(1)(f)) for security logging. Nominee data is processed to fulfill your instructions as the data controller of your records.

6. Retention

• Account and record data: kept while your account is active; deleted on account deletion.
• Delivery packages: kept until released and accessed, or deleted when you delete the record or nominee.
• Server logs: rotated regularly, retained no longer than 90 days.

7. Security measures

• End-to-end encryption: AES-256-GCM for records; PBKDF2-HMAC-SHA256 key derivation (210,000 iterations) on your device.
• Delivery tokens stored only as SHA-256 hashes plus an encrypted form protected by a separate server-held release key.
• TLS in transit; decryption for nominees happens in their browser, not on our servers.

Because we cannot decrypt your records, a server breach exposes ciphertext only. An attacker would additionally need the separate server release key to reach delivery tokens, and your password for anything else.

8. Your rights

You may access, correct, export, or delete your data at any time via the app or by contacting us. Deleting your account removes your records, nominee links, and sessions. Because records are encrypted with your password, deletion is absolute — we hold no recovery copy.

9. Children

The service is not directed at children under 16 and we do not knowingly collect their data.

10. Changes

We will announce material changes to this policy by email to registered users before they take effect.

11. Contact

Privacy questions: privacy@thenominee.org