Privacy Policy

• Documents you add — files you upload, photograph, forward by email or generate with the document builder, plus the text, dates, amounts and categories our AI extracts from them.
• Estate and account details you type in — trusted contacts, wishes, beneficiary designations, insurance and account notes, library execution details.
• Financial account data you choose to link — institution name, account type, last four digits, holder names and balances, retrieved through Stripe Financial Connections only after you authorize the connection.
• Family profiles — a name, role (owner, partner, executor), profile color and a salted, hashed PIN. Optional recovery, digest and check-up email addresses.
• Activity log — security-relevant events (unlocks, reveals, exports, shares, emergency access) with a timestamp and the acting profile.
• Billing — if you subscribe, Stripe processes your payment. We store only your Stripe customer and subscription identifiers and plan status, never card numbers.

• To file, search, remind, report on and let you ask questions about your own documents.
• To build the estate library, bereavement and tax packs, beneficiary checker and net-worth snapshot you see in the app.
• To send the emails you turn on: reminders, monthly digest, yearly check-up, family invites, PIN-reset links and emergency-access notices.
• To secure the vault: PIN verification, idle lock, brute-force lockouts and the activity log.

We do not use your content to train AI models, build advertising profiles, or for any purpose other than running HearthVault for you.

We use a small number of providers, each only for the job named here and each under contractual confidentiality:

• AI extraction & chat — document contents are sent to a large-language-model provider (Google Gemini, via the Emergent integrations gateway) to read, categorize and answer questions about them, and to draft obituaries and thank-you notes from facts you type. Password-category fields are encrypted before storage and are decrypted for the model only when you, an owner or partner, ask a question that needs them.
• Tribute music — background music for tribute videos is generated by Fal.ai via the same gateway; only the mood you choose is sent, never your photos or recordings.
• File storage — original files, photos, voice recordings and rendered videos are stored encrypted in Emergent object storage.
• Email — Resend delivers the emails you turn on and, if you configure it, receives documents you forward to your inbox address.
• Text messages & voice (optional) — if you connect your own Twilio account, unlock codes and shared links can be sent by text and photos you text in are filed; if you connect ElevenLabs, letters can be read aloud or in a cloned voice you record. Neither is used unless you add those keys.
• Google (optional) — when you connect Google, we import Gmail attachments and Drive folders you pick, add renewal reminders to your calendar, and use Places to list funeral homes near your home address.
• Payments & bank linking — Stripe handles subscriptions, billing portal and Financial Connections. Stripe's own privacy policy governs data you enter directly into Stripe's forms.
• Hosting & database — the app and its MongoDB database run on our cloud infrastructure.

The current list, with regions, is kept up to date on our Trust Center.

If you verify a mobile number inside HearthVault, we send transactional texts only: one-time verification and unlock codes, security alerts, reminders you or your vault owner scheduled (document follow-ups, signing appointments, policy reviews), links the owner chose to share with you, and periodic inactivity check-ins. We never send marketing or promotional texts.

• Consent — you opt in by entering your number in Security → Mobile number, ticking the consent box and confirming a code. Family members invited by text receive a single invitation and are not enrolled until they verify their own number.
• Frequency and cost — message frequency varies with your activity (typically 2–6 texts a month). Message and data rates may apply.
• Opting out — reply STOP to any message to stop all texts; you'll get one confirmation. Reply START to resume, or HELP for help. You can also remove your number in the app at any time.
• What we store — your number, the time you consented, and whether you have opted out. Numbers are encrypted inside your vault.
• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Twilio is used only as the carrier gateway to deliver and receive these messages.

Stand-alone versions: SMS Privacy Policy · SMS Terms & Conditions · Opt-in form copy.

HearthVault uses one cookie, hv_vault, which is strictly necessary: it keeps your vault unlocked for up to 30 minutes and is HttpOnly and Secure. Advisors signed in to the advisor portal, and owners who link Google sign-in, receive an equivalent session cookie for that sign-in.

We keep a few preference values in your browser's own storage, none of which identify or track you: hv_last_member (which profile the lock screen opens on), your language choice, accessibility viewer settings (text size, contrast), whether you dismissed the install prompt or a one-time banner (kept for the session or the day), the email you last typed for reminders, and a short local cache of your "Ask your vault" conversation so it reopens where you left it. Clearing site data removes all of them.

We do not use analytics, advertising or social-media cookies, and we self-host our fonts so no font requests go to third parties. Page views on the public site are counted with a cookie-less, first-party counter: a hash of your IP address and browser that changes every day and is never stored in a readable form. The app is hosted on the Emergent platform, whose loader script runs on each page to serve the application; it does not set advertising cookies. When you start a Stripe checkout or bank-linking session, Stripe may set its own fraud-prevention cookies as part of that action.

Because we only use strictly necessary storage, no consent banner is shown. If we ever add optional analytics we will ask first.

• Family profiles see what their role allows: owners everything, partners add/edit, executors read-only without password reveals.
• Share links (tax pack, bereavement pack, attorney review) are code-protected, expire, and can be revoked. They never include password documents.
• Emergency access shows a read-only estate hub to the person you designate, only with the code you gave them, and emails you when it is used.

We never sell, rent or share your data with third parties for their own purposes. We disclose data only if legally compelled, and we will tell you unless the law forbids it.

• PINs are hashed with bcrypt; sessions are short-lived HttpOnly cookies; failed attempts trigger lockouts.
• Password-category fields, bank balances, holder names and linked-account tokens are encrypted at rest.
• All traffic is TLS-encrypted. Cross-site requests are blocked.
• Every reveal, export and share is written to the activity log you can review.

No system is perfectly secure. If we learn of a breach affecting your data we will notify you without undue delay.

Your data stays as long as your vault exists. Deleting a document removes it from the vault immediately and its file is purged from storage on the next cleanup (deleted items can be restored for 30 days from Recently deleted). Deleting a family profile removes their PIN and access at once. The owner can erase the entire vault themselves from Security → Backup / erase: every document, file, profile and record is destroyed immediately and cannot be recovered. If you prefer, open a support request from your recovery address and we will do it for you within 30 days. Billing records are kept for as long as tax and accounting law requires.

• Performance of a contract — storing, filing and showing you your documents, reminders, estate plan and shared bundles; billing.
• Legitimate interests — keeping the service secure (PIN lockouts, audit log, fraud checks), measuring public pages without cookies, and sending service messages about your vault.
• Consent — optional features you switch on: SMS, bank linking, Gmail/Drive import, newsletters, and any AI feature that sends your documents to a model provider. You can withdraw consent at any time by turning the feature off.
• Legal obligation — retaining billing records and responding to lawful requests.

HearthVault is operated from the United States and hosted on Google Cloud (via the Emergent platform) in US regions; files are encrypted at rest and in transit. If you use the service from the EU, UK or elsewhere, your data is transferred to and processed in the United States. For EU/UK residents we rely on the Standard Contractual Clauses (and the UK Addendum) with our processors, and on the EU–US Data Privacy Framework where a processor is certified. The list of processors and their locations is in section 3.

Wherever you live, you can access, correct, export (PDF, CSV and encrypted ZIP backups are built in — Security → Backup) or delete your data at any time without asking us. We will not discriminate against you for exercising any right.

EU, UK and Swiss residents have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent and to complain to your supervisory authority. California residents (CCPA/CPRA) have the right to know what personal information we collect and how it is used, to delete it, to correct it, and to opt out of "sale" or "sharing" — we do not sell or share personal information and never have, and we do not use or disclose sensitive personal information for anything other than providing the service you asked for. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws have equivalent rights.

To exercise a right that isn't self-serve, open a privacy request from your vault's recovery email so we can verify it is you. We respond within 30 days (45 for California requests, extendable once as the law allows). An authorized agent may submit a request on your behalf with written permission.

HearthVault is for adults managing household and estate records. It is not directed to children under 16 and we do not knowingly collect their data, other than information a parent chooses to record (for example a guardianship nomination).

If we change this policy in a meaningful way, we will show a notice in the app and update the effective date above. Continued use after the change means you accept the updated policy.