AES-256-GCM
AES-256-GCM, locally
Your message is encrypted right in your browser, on your device, before it's ever sent. The server only receives unreadable ciphertext.
01Encrypted in your browser
Encryption happens in your browser, before anything is sent
Three cryptographic mechanisms work together so the server never holds anything readable without your consent.
256-bit · random
A fresh key for every message
Each entry gets its own random encryption key. It is never transmitted or stored in the clear.
ECDH P-256 · HKDF
Key sealing (ECDH + HKDF)
That one-time key is "sealed" with the service's public key (ECDH P-256 + HKDF-SHA256). Only the matching private key can unseal it — and that key never touches the server.
02The server stores
What the server stores, and what it never receives
A straightforward split: here is everything our infrastructure could possibly access.
The server stores
- An encrypted data block (unreadable without the key)
- Technical encryption parameters (IV, the sealed-key "envelope")
- Your name and contact details (email, phone), plus recipients' names and contacts — for notifications, billing and delivery
- Subscription status and last payment date
The server never receives
- The plaintext of your message
- The decryption private key — it exists only offline, held by the service owner
- Any technical way to read the data without a separate manual action off-server
03Pulse monitoring
A single hiccup doesn't trigger anything
As long as the monthly payment goes through, the system knows you're there and does nothing.
If a payment fails, nothing happens immediately — an expired card or a technical glitch happens to everyone. We send you three emails — on day 3, 7 and 25 — each with an “I'm here” button. From day 25 we also write to your trusted person and call them if they don't reply. Only if no one responds for at least 30 days does the protocol move on to manual review and delivery.
What happens if payment stops
- Day 0
A payment fails. Nothing happens — the card may simply have expired.
- Day 3 · 7 · 25
Three emails with an “I'm here” button. One click and everything stops.
- Day 25 · 28
We write to your trusted person and, if they don't reply, we call. They can confirm you're okay.
- Day 30
No response — after a manual review, each recipient gets their own link and opens their message.
04The last link — human, offline, once
Decryption is deliberately a manual act
The server cannot, and should not, decrypt your data on its own.
The private key needed for decryption exists only offline, kept by the service owner separately from any project infrastructure. Only once the protocol confirms every attempt at contact has been exhausted is that key used manually — once — to unseal the data for delivery to your recipients.
05FAQ
Questions worth asking
What happens if I cancel my subscription?
If you cancel the subscription yourself, the protocol is frozen at the end of the paid period: nothing is delivered to anyone, and we'll email you. You can renew any time in your account. It's different when a payment simply stops going through (say, your card expired): then we check whether you're there, and without a response the messages will be delivered.
Could the system mistakenly decide I'm unreachable?
A single payment failure triggers nothing. We email you three times and, if you've added a trusted person, ask them too. They can confirm you're okay, and the protocol is then frozen. Every delivery is preceded by a manual review.
Who exactly receives my data?
Only the recipients whose details you provided yourself (up to 5, each with their own separate message). Your trusted person receives no messages. Decryption happens off-server, manually, and only at the moment of final delivery.
Do I need to do anything regularly?
No. While your payment goes through automatically, there's nothing to do. You can change recipients, messages or the email language at any time in your account.
How long is my data kept?
A protocol that was never paid for is deleted after 2 months. A frozen one (you're in touch but not paying) — after 2 years; we'll warn you by email 30 days before. After delivery, all data is deleted after one year. You can delete your protocol yourself at any time.
Take care of it today
A few minutes and $2 a month — and your loved ones won't be left without answers.