Privacy

1. The short version

• What you write in your envelope, passwords and numbers included, is encrypted in your browser. We store it sealed and cannot read it.
• We run no analytics trackers, no ad pixels and no third-party scripts.
• We do not sell personal information, and we do not share it for advertising.
• We keep the few plain facts the service needs to run: who you are, who your people are, your check-in schedule and your billing status.

2. What we collect and can read

From members:

• Your name, email address, an optional backup email address and your time zone
• A sign-in key derived from your password, stored as a one-way hash. We never receive the password itself.
• If you turn on two-step sign-in: the secret your authenticator app uses, and one-way hashes of your backup codes
• For each device that is signed in: the browser it reported and when it was last used, so you can see your sessions and end them
• The name, email address and relationship of each person you name, the part you gave them (who goes first, who is your stand-in, who may report) and which sections each may receive
• The backup question you set for a person. Never the answer.
• Short notes you leave for people who hold no card, with their names and email addresses. We send these at release, so we store them in a form we can read.
• Which entries you marked to be destroyed at release. The mark only, not the contents.
• Your check-in settings and history, and any note you write for your contacts to read if you go quiet
• For each entry: which section it is in, when it was changed and how large it is. Not what it says.
• Your plan and payment status
• A record of account events, such as check-ins, alerts and reports, which you can read back

From people who report a passing: their name, email address and relationship, the date they give, their statement and the death certificate they upload.

From a stand-in who reports that a member is alive but unable to act: the same details, and the doctor's letter they upload.

From someone who writes to us from the "Someone has died" page: their name, email address and relationship, and the name and email address of the person they are asking about. We use it only to look for an account and, if there is one, to reach the people that member named.

From firms: the firm's name, address details, contact person and billing status.

From visitors who use a free tool: an email address, only if they type one in to have something sent to them.

From every request: the technical details any web server sees, such as IP address and browser type. We use them to limit abuse and to keep security logs.

3. What we store but cannot read

Every entry, letter, recorded message and attachment is encrypted on your device before it reaches us, with a key we do not have. That includes every sign-in name, password, account number, Social Security number and code you save. To us they are sealed data like the rest.

When you import logins from a file, the file is read by your browser and is never uploaded. Only the sealed entries reach us. A voice message is recorded and sealed on your device in the same way.

Your private clean-up list is an entry like any other: sealed, and sent only to the person you chose to go first.

A paper you make in your account is put together by your browser from your answers. Your answers and any copy you save are sealed like every other entry. We never receive a readable version.

The code on each person's card, and the answer to any backup question, are never sent to us at all. If we were ordered to hand over an envelope, sealed data is all we could give.

4. What we never ask for

• Your SuddenGone password, your recovery code, the code on a card or the answer to a backup question, by email, by phone or in any other way
• A readable copy of anything in your envelope
• Your location, your contacts or your camera

Your browser will ask for the microphone only if you choose to record a voice message, and only for that recording.

5. How we use it

• To run your account, your check-ins and your hand-off
• To email you and the people you chose: reminders, alerts, report notices and release links
• To review reports of a passing
• To let our staff help with an account when asked. Staff tools show the plain facts listed above and never what is inside an envelope.
• To take payment and keep billing records
• To prevent abuse and keep the service secure
• To send occasional product emails, which you can turn off. Check-in and release emails cannot be turned off while those features are on, because they are the service.

6. Who we share it with

• Stripe, which takes payments. It receives your email address and payment details. We never see your full card number.
• Our hosting provider, on whose servers the service and its mail system run.
• The people you name. They receive emails that include your name. After a release they can open what you left them.
• A firm that introduced you, if there is one. It can see your name, your email address and whether your account is active. It cannot see your entries.
• The person who reported a passing is told if you cancel their report.
• Authorities, when the law requires it, or when we report a fraudulent claim of death. We can only hand over what we can read.

That is the whole list. We do not sell personal information, rent it or share it for advertising.

7. Cookies and storage on your device

• One cookie keeps you signed in. It is required for the service to work and is not used for tracking.
• Your browser's key storage holds the working key to your vault while you are signed in, in a form the page can use but cannot read back. Signing out removes it.
• Local storage remembers what you have checked off on the free checklist. It stays on your device.

There are no advertising or analytics cookies, so there is no cookie banner.

8. How long we keep things

• Your account and sealed entries: until you delete your account. Deletion is permanent.
• A released envelope: available to the people you named for at least one year after release.
• Entries marked never to be handed over: deleted at release, unread.
• Notes to people who hold no card: kept until they are sent at release, or until you delete them or your account.
• Death certificates, doctors' letters and report details: kept for the review and removed within 90 days after the report is closed.
• Billing records: as long as tax and accounting rules require.
• Email addresses from free tools: until you ask us to remove them.
• Security logs: a limited period, then deleted.

9. Your choices and rights

• See and export. You can read and download everything in your envelope from your account.
• Correct. You can change your details and your people at any time.
• Delete. You can delete your account from your settings, or ask us to.
• Stop emails. Every product email has an unsubscribe link.

If you live in California, you have the right to know what personal information we hold about you, to have it corrected or deleted, and not to be treated differently for using those rights. We do not sell or share personal information as those terms are defined in California law. People in other places may have similar rights. To use any of them, write to us at the address below. We will ask you to confirm your email address before we act.

If someone named you in their envelope and you would rather not be, tell them, or write to us and we will remove you and let them know.

10. Children

SuddenGone is for adults. We do not knowingly collect information from anyone under 18.

11. Security

The security page explains how entries are sealed, what a break-in would and would not expose, and the limits of the design. If we ever learn of a breach that affects you, we will tell you promptly.

12. Changes and contact

If we change this page in a way that matters, we will email members before the change takes effect.

Questions or requests about your information: write to support@suddengone.com.