Privacy Policy

• Documents you add — files you upload, photograph, forward by email or generate with the document builder, plus the text, dates, amounts and categories our AI extracts from them.
• Estate and account details you type in — trusted contacts, wishes, beneficiary designations, insurance and account notes, library execution details.
• Financial account data you choose to link — institution name, account type, last four digits, holder names and balances, retrieved through Stripe Financial Connections only after you authorize the connection.
• Family profiles — a name, role (owner, partner, executor), profile color and a salted, hashed PIN. Optional recovery, digest and check-up email addresses.
• Activity log — security-relevant events (unlocks, reveals, exports, shares, emergency access) with a timestamp and the acting profile.
• Billing — if you subscribe, Stripe processes your payment. We store only your Stripe customer and subscription identifiers and plan status, never card numbers.

• To file, search, remind, report on and let you ask questions about your own documents.
• To build the estate library, bereavement and tax packs, beneficiary checker and net-worth snapshot you see in the app.
• To send the emails you turn on: reminders, monthly digest, yearly check-up, family invites, PIN-reset links and emergency-access notices.
• To secure the vault: PIN verification, idle lock, brute-force lockouts and the activity log.

We do not use your content to train AI models, build advertising profiles, or for any purpose other than running HearthVault for you.

We use a small number of providers, each only for the job named here and each under contractual confidentiality:

• AI extraction & chat — document contents are sent to a large-language-model provider (Google Gemini, via the Emergent integrations gateway) to read, categorize and answer questions about them, and to draft obituaries and thank-you notes from facts you type. Password-category fields are encrypted before storage and are decrypted for the model only when you, an owner or partner, ask a question that needs them.
• Tribute music — background music for tribute videos is generated by Fal.ai via the same gateway; only the mood you choose is sent, never your photos or recordings.
• File storage — original files, photos, voice recordings and rendered videos are stored encrypted in Emergent object storage.
• Email — Resend delivers the emails you turn on and, if you configure it, receives documents you forward to your inbox address.
• Text messages & voice (optional) — if you connect your own Twilio account, unlock codes and shared links can be sent by text and photos you text in are filed; if you connect ElevenLabs, letters can be read aloud or in a cloned voice you record. Neither is used unless you add those keys.
• Google (optional) — when you connect Google, we import Gmail attachments and Drive folders you pick, add renewal reminders to your calendar, and use Places to list funeral homes near your home address.
• Payments & bank linking — Stripe handles subscriptions, billing portal and Financial Connections. Stripe's own privacy policy governs data you enter directly into Stripe's forms.
• Hosting & database — the app and its MongoDB database run on our cloud infrastructure.

The current list, with regions, is kept up to date on our Trust Center.

HearthVault uses one cookie, hv_vault, which is strictly necessary: it keeps your vault unlocked for up to 30 minutes and is HttpOnly and Secure. We also keep one value in your browser's local storage, hv_last_member, so the lock screen opens on your profile. Neither is used for tracking.

We do not use analytics, advertising or social-media cookies, and we self-host our fonts so no font requests go to third parties. When you start a Stripe checkout or bank-linking session, Stripe may set its own fraud-prevention cookies as part of that action.

Because we only use strictly necessary storage, no consent banner is shown. If we ever add optional analytics we will ask first.

• Family profiles see what their role allows: owners everything, partners add/edit, executors read-only without password reveals.
• Share links (tax pack, bereavement pack, attorney review) are code-protected, expire, and can be revoked. They never include password documents.
• Emergency access shows a read-only estate hub to the person you designate, only with the code you gave them, and emails you when it is used.

We never sell, rent or share your data with third parties for their own purposes. We disclose data only if legally compelled, and we will tell you unless the law forbids it.

• PINs are hashed with bcrypt; sessions are short-lived HttpOnly cookies; failed attempts trigger lockouts.
• Password-category fields, bank balances, holder names and linked-account tokens are encrypted at rest.
• All traffic is TLS-encrypted. Cross-site requests are blocked.
• Every reveal, export and share is written to the activity log you can review.

No system is perfectly secure. If we learn of a breach affecting your data we will notify you without undue delay.

Your data stays as long as your vault exists. Deleting a document removes it from the vault immediately and its file is purged from storage on the next cleanup. Deleting a family profile removes their PIN and access at once. To delete your entire vault, email us from your recovery address and we will erase all documents, files, profiles and account data within 30 days, except billing records we must keep for tax and accounting law.

Wherever you live, you can access, correct, export (PDF, CSV and ZIP bundles are built in) or delete your data at any time. If you are in the EU, UK, California or another jurisdiction with specific privacy rights, those rights apply to you and you may exercise them by contacting us. We will not discriminate against you for doing so.

HearthVault is for adults managing household and estate records. It is not directed to children under 16 and we do not knowingly collect their data, other than information a parent chooses to record (for example a guardianship nomination).

If we change this policy in a meaningful way, we will show a notice in the app and update the effective date above. Continued use after the change means you accept the updated policy.