LifeAccount™
How it works Pricing
Sign in Start free
How it works Pricing Sign in Start free
Privacy Policy

Your data is yours.

LifeAccount · Effective May 23, 2026 · v4.0

A note before you read: This policy is written to be readable, not to hide behind legal language. Where the law uses a specific term, we say what it means.

LifeAccount is a secure depository — not a law firm, financial advisor, or healthcare provider. Nothing on this platform constitutes legal, financial, or medical advice, and storing documents here does not make them legally valid. Consult qualified professionals for those decisions.

This is a draft pending final review by a privacy attorney before paid public launch.

1. Who we are

LifeAccount is a secure digital vault and life planning service based in the United States. The Service is available to U.S. residents only.

Questions? Email us at [email protected].

2. What this policy covers

This policy explains what we collect about you, what we do with it, who we share it with, how long we keep it, and your rights. It applies to lifeaccount.com, app.lifeaccount.com, and any communication we send you.

It does not cover other companies’ sites we link to — such as a partner advisor’s site, an attorney directory, or a funeral pre-planning service. Those have their own privacy policies.

3. Information we collect

We collect three kinds of information.

a. Things you give us.

When you create an account or fill in your vaults, you provide:

  • Account details — your name, email address, password (hashed, never stored in plain text), and optionally your phone number, state, and birthday.
  • Vault contents — whatever you choose to put in your Legal, Insurance, Identity, Financial, People, Digital, Story, Final Wishes, and Time Capsule vaults. This can include sensitive information: medical preferences, insurance policies, financial account references, beneficiary designations, passwords, and personal letters.
  • Uploaded files — documents, photos, audio, or video you upload.
  • Inner Circle data — the name of your Circle, who you invite, who joins, and which items you choose to share with Circle members.
  • Executor and contact information — the people you designate to receive access after you pass, and the people you list in your People Vault.
  • Conversations with Grace — messages you exchange with our AI companion.
  • Payment information — processed by our payment provider. We never see or store your card number.
  • Signup acknowledgments — the explicit acknowledgments you made when creating your account (age and U.S. residency confirmation, Terms and Privacy Policy agreement, depository disclaimer), along with the IP address, browser, and exact document versions you saw at the time. We retain these permanently as a legal record.

b. Things we collect automatically.

  • Sign-in records — date, time, IP address, and approximate city of each sign-in, so we can alert you to logins from new locations.
  • Usage data — the pages you visit inside LifeAccount and the features you use, to keep the service running and improve it.
  • Device data — browser type, operating system, and general device characteristics, used for security and bug reporting.

We do not place tracking cookies or use third-party advertising trackers on the signed-in product. The marketing pages may use basic analytics; see our cookie notice in section 16.

c. Things others tell us about you (with your consent).

If you accept an Inner Circle invitation, we receive the invitation record from the person who invited you. If you ask a partner advisor to contact you (see section 5), we record that consent and pass your information to that advisor only after you click to confirm.

4. How we use your information

We use the information you give us to:

  • Run and improve the Service
  • Send you transactional emails (welcome, sign-in alerts, billing)
  • Send occasional emails you can opt out of (birthday reminders, annual vault review)
  • Deliver letters and Time Capsules you have scheduled
  • Verify the identity of an executor when you pass, and grant them access to your account per your instructions
  • Detect and prevent fraud, abuse, and security incidents
  • Comply with legal obligations

We do not sell your information. We do not share it with advertisers. We do not use it to train any AI model. We do not use it for targeted advertising. We do not engage in profiling that produces legal or similarly significant effects on you. (See section 7 for how Grace works.)

5. Partner advisors — only when you ask

From time to time we work with carefully chosen partner advisors — insurance brokers, estate planning attorneys, funeral pre-planning services, financial planners, notary services, and similar professional service providers. Our relationships with these companies vary:

  • Some partners are completely independent of LifeAccount and pay us no compensation
  • Some partners pay LifeAccount a referral fee, commission, or affiliate payment for customers we send them
  • Some partners share common ownership, leadership, or other material relationships with LifeAccount

We never share your information with a partner unless you have given us specific, explicit consent for that specific partner, for that specific purpose. When you click a partner referral button inside LifeAccount, we show you exactly what information will be shared, who it will be shared with, and what our relationship with that partner is, and ask you to confirm. Until you confirm, nothing is sent.

If you give consent and later change your mind, you can revoke that consent at any time in Settings → Consent & sharing. When you revoke a consent, we notify the partner (where reasonable) that you no longer wish to be contacted, and we stop sharing further information with them. The partner’s own privacy policy controls what they do with information they already received before your revocation.

You are never required to use any LifeAccount partner. You are always free to use any provider you prefer.

These disclosures are made in compliance with the Federal Trade Commission’s Endorsement Guides and equivalent state requirements.

6. Inner Circle data sharing

An Inner Circle is an optional feature that lets you connect your LifeAccount with other LifeAccount members — a spouse, an adult child, a sibling, a close friend. When you join a Circle, other members see your name, city, and the fact that you have an account. Members do not see any of your vault data unless you explicitly share a specific item with the Circle.

Sharing is per-item and revocable. You can unshare any item at any time. If you leave a Circle, all your future sharing stops. Items you shared before leaving remain visible to members who already saw them — we cannot un-see something already viewed.

Being in an Inner Circle does not grant another member legal authority over your account or your estate. It is a sharing feature, not a legal designation.

Every action inside an Inner Circle — joining, leaving, sharing, unsharing, removing a member — is logged in an immutable audit record that you can view at any time.

7. Grace, our AI companion

Grace is an AI companion powered by a third-party AI API. When you chat with Grace, your messages are sent to our AI provider for processing and the response is sent back to you and saved to your conversation history in your vault.

Our AI provider does not use API conversations to train their models. By default, our AI provider retains API request data for up to 30 days for trust and safety monitoring, after which it is deleted from their systems. LifeAccount keeps your conversation history in your account so you can return to it later. You can delete any conversation at any time in Settings.

LifeAccount does not use your conversations, vault content, or personal information to train any AI model — our own or any third party’s.

Grace does not make automated decisions. Grace does not make automated decisions that produce legal, financial, or similarly significant effects on you. All outputs from Grace — including obituary drafts, Final Wishes summaries, and Legacy Interview content — are suggestions for your review. You remain in full control of everything in your vaults.

In accordance with applicable privacy regulations regarding AI features, LifeAccount conducts privacy risk assessments for features that process sensitive personal information through automated means, including Grace.

Grace is not a lawyer, doctor, or financial advisor. She may occasionally provide outdated or incorrect information. For any important decision, please verify with a qualified professional.

8. The companies we use to run LifeAccount

To run the Service, we use a small set of trusted vendors (“subprocessors”). They process information on our behalf, under contract, and only for the purposes we have authorized. All vendors are U.S.-based and U.S.-hosted.

  • Database, authentication, and file storage provider — SOC 2 Type 2 certified
  • Application hosting provider — SOC 2 Type 2 certified
  • AI processing provider (powers Grace) — SOC 2 Type 2 certified. Does not use API conversations to train models.
  • Payment processing provider — PCI DSS Level 1 certified. We never see or store your card number.
  • Transactional email delivery provider — SOC 2 audited

We do not transfer your data outside the United States.

9. What happens to your data when you pass

LifeAccount is a depository, not an estate administrator. We hold your data securely; we do not act on your behalf after you pass.

When you pass, it is the responsibility of the executor you designated to initiate access to your LifeAccount. We do not monitor public records, obituaries, or any other source to detect a member’s passing. Nothing happens to your account automatically — including the release of letters or Time Capsules tied to your passing — until your designated executor begins the activation process described in our Terms of Service.

When your executor initiates activation and provides the required documentation (a valid death certificate and identity verification), a 30-day waiting period begins as a fraud prevention measure. At the end of this period, your executor receives access to the parts of your account you chose to make available to them, and Time Capsules and letters tied to your passing are delivered per your instructions.

Your data remains your data after you’re gone. We do not sell, share, transfer, or repurpose the data of a deceased member. Your executor may export everything for the estate, or request that we delete it.

If your account becomes inactive for more than five years with no designated executor activity, we will attempt to reach you and your listed contacts before taking any action. We will never delete a member’s data without notice.

10. How long we keep your information

The default rule: we keep your data for as long as you have an account.

If you cancel your paid subscription:

  • Your free vaults (Legal and Insurance) remain available indefinitely on the free plan.
  • All other vault contents (Identity, Financial, Digital, People, Story, Final Wishes, The Last Chapter, Time Capsule) remain encrypted and on file but are read-only until you re-subscribe.

If you delete your account:

  • We delete your vault contents, files, conversations with Grace, and Inner Circle membership within 30 days.
  • We keep a minimal record of your account’s existence (email address, signup acknowledgment record, and deletion date) for up to 7 years to comply with tax and anti-fraud obligations. This record contains no vault contents.
  • Audit log entries you participated in are retained with your identity anonymized.
  • Your permanent signup acknowledgment record is retained as a legal-compliance artifact and is not deleted.

Conversations with Grace older than 24 months are automatically archived. You can permanently delete any Grace conversation at any time from Settings.

11. Your rights

You have the right to:

  • See what we have. Use Settings → Export my data to download everything we hold about you in a portable format (JSON + PDF).
  • Correct what’s wrong. You can edit your vault contents and account details at any time.
  • Delete your account. Settings → Delete my account. Deletion is final after a 30-day grace period during which you can change your mind.
  • Take your data with you. Your export is a standard format you can take anywhere.
  • Withdraw consents. Settings → Consent & sharing lets you revoke any consent you have previously given for partner referrals, Inner Circle sharing, occasional emails, and other optional activities.
  • Opt out of marketing. Settings → Email preferences. Transactional emails (welcome, sign-in alerts, billing) cannot be turned off while you have an active account.
  • View your signup acknowledgment record. Settings → Privacy → My acknowledgments shows the exact text and date of each agreement you made.
  • Ask us a question. Email [email protected] and we will respond within 5 business days, and within 45 days for formal data access requests.

You may also submit privacy requests through your account Settings, or through the web form at lifeaccount.com/privacy-choices.

12. State-specific rights

Regardless of where you live, you have the rights described in section 11. Several states have enacted comprehensive privacy laws that give their residents additional rights. If you live in one of the states listed below, those additional rights apply to you.

To exercise any state-specific right, email [email protected] with the subject line “Privacy request — [your state],” or use the web form at lifeaccount.com/privacy-choices. We will respond within 45 days.

California (CCPA / CPRA)

You may request a list of the categories of personal information we collect, use, and share; request deletion; request correction; and opt out of any “sharing” or “sale” of personal information. LifeAccount does not sell or share personal information in the sense those terms are used by the CCPA / CPRA.

Right to limit sensitive personal information. You have the right to limit our use of sensitive personal information to only what is necessary to provide the Service. To exercise this right, email [email protected] with the subject line “Limit Sensitive Data Use.”

Global Privacy Control (GPC). We honor Global Privacy Control signals. If your browser sends a GPC opt-out signal when you visit lifeaccount.com, we treat it as a valid California opt-out request and apply it to any data sharing on our marketing pages.

California residents may also designate an authorized agent to make requests on their behalf. To submit a formal opt-out or data request, visit lifeaccount.com/privacy-choices or email us with the subject line “California Opt-Out.” California residents have additional health information protections under the Confidentiality of Medical Information Act (CMIA).

Virginia (VCDPA)

Virginia residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. LifeAccount does not engage in targeted advertising, data sales, or such profiling.

Colorado (CPA)

Colorado residents have the right to access, correct, delete, and port their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling. LifeAccount does not engage in targeted advertising, data sales, or profiling that produces legal or similarly significant effects.

Connecticut (CTDPA)

Connecticut residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling. LifeAccount does not engage in any of these activities.

Utah (UCPA)

Utah residents have the right to access, delete, and obtain a portable copy of their personal data, and to opt out of the sale of personal data and targeted advertising. LifeAccount does not sell personal data or engage in targeted advertising.

Texas (TDPSA)

Texas residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling. LifeAccount does not engage in any of these activities.

Oregon (OCPA)

Oregon residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, data sales, and profiling. LifeAccount does not engage in targeted advertising, data sales, or profiling.

Montana (MCDPA)

Montana residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of the sale of personal data and targeted advertising. LifeAccount does not sell personal data or engage in targeted advertising.

Iowa (ICDPA)

Iowa residents have the right to access, delete, and obtain a portable copy of their personal data, and to opt out of the sale of personal data and targeted advertising. LifeAccount does not sell personal data or engage in targeted advertising.

Indiana (INCDPA)

Indiana residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling. LifeAccount does not engage in any of these activities.

Tennessee (TIPA)

Tennessee residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling. LifeAccount does not engage in any of these activities.

Florida (FDBR)

Florida residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising and the sale of personal data. LifeAccount does not engage in targeted advertising or data sales.

Minnesota (MHMD)

Minnesota residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, data sales, and profiling. LifeAccount does not engage in any of these activities. The individual responsible for privacy compliance at LifeAccount can be reached at [email protected].

New Jersey (NJDPA)

New Jersey residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, data sales, and profiling. LifeAccount does not engage in any of these activities. LifeAccount does not process personal data of users between the ages of 13 and 17 for targeted advertising or profiling.

Maryland (MODPA)

Maryland residents have the right to access, correct, delete, and obtain a portable copy of their personal data. LifeAccount does not process personal data for targeted advertising, data sales, or profiling. LifeAccount does not process personal data of users under 18 for targeted advertising.

Nebraska, New Hampshire, Delaware, Kentucky, Rhode Island

These states have enacted or are implementing comprehensive privacy laws with rights substantially similar to those described above. Residents of these states have the right to access, correct, delete, and port their data, and to opt out of targeted advertising and data sales. LifeAccount does not engage in targeted advertising or data sales, and honors privacy requests from residents of all of these states.

All other states

Many additional states have introduced or are considering comprehensive privacy legislation. Regardless of where you live, you have the rights described in section 11 of this policy. We commit to honoring reasonable privacy requests from all U.S. residents. If your state enacts a new privacy law, we will update this section and notify active members by email.

Health information (all states)

We are not a covered entity or business associate under HIPAA. The medical information you enter into LifeAccount — medical directives, DNR status, healthcare proxy designations — is treated as sensitive personal information subject to additional protections under this policy and applicable state law. California residents have additional protections under CMIA. Washington residents have additional protections under the My Health MY Data Act (MHMD).

A note on what we do not do (all states)

LifeAccount does not sell personal information, does not share personal information with advertisers, does not use personal information for targeted advertising, does not engage in profiling that produces legal or significant effects, and does not use vault content or Grace conversations to train any AI model. These commitments apply to all members regardless of state of residence.

13. How we protect your information

  • Encryption in transit (TLS 1.2+) and at rest (AES-256).
  • Row-level security so one member’s data is invisible to any other member at the database level.
  • Two-factor authentication (TOTP) available on every account and strongly recommended for paid plans.
  • Backup codes issued at 2FA setup — single-use, never reusable.
  • Sign-in alerts on logins from new devices or locations.
  • Auto-logout after extended inactivity. Configurable in Settings.
  • Vault file storage uses signed URLs with short expirations. Files are never publicly accessible.
  • Daily database backups via our database provider, retained for 7 days. We are working toward nightly off-site backups with a separate cloud provider, a 1-hour Recovery Point Objective, and quarterly tested restore drills — progress is tracked publicly on our Security page.
  • Background checks and least-privilege access for any team member with administrative access. Administrative access does not include reading vault contents as part of normal operations.
  • We conduct internal data protection assessments for features that process sensitive personal information, including Grace and the voice narration feature, in accordance with applicable state law requirements.
  • No security system is perfect. Please use a strong, unique password and enable two-factor authentication.

14. The Forever Promise

We have made a commitment to our members about what happens if LifeAccount ever ceases operations.

  • We will give every member at least 90 days’ written notice before any wind-down or material change to how data is managed.
  • We will provide a complete data export in standard formats (JSON + PDF) for every member during that period, at no charge.
  • We will publish a transition plan describing what happens to data after the wind-down, including any successor or escrow arrangements.
  • Your family’s information belongs to you. It is not a company asset to be sold, transferred, or repurposed in the event of a sale or shutdown.

This commitment is contractual under our Terms of Service and survives any transfer of LifeAccount’s ownership or legal form, including any future incorporation. Any successor entity is bound by it.

15. Children

LifeAccount is intended for adults 18 and older. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18, and we enforce a minimum age requirement at account creation.

In compliance with the federal Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect any personal information from children under 13 years of age. If you believe a child under 13 has created an account or provided us with personal information, please email [email protected] immediately and we will delete it without delay.

If you believe anyone under 18 has created an account, please contact us at [email protected] and we will delete the account and all associated data promptly.

You may of course mention or reference your minor children or grandchildren in your own vaults — a Time Capsule for a grandchild, a beneficiary designation, a letter. That information is yours and is handled like any other vault content.

16. Cookies and tracking

The signed-in product uses only essential cookies required for authentication and session management. We do not use any third-party advertising cookies, retargeting pixels, or cross-site tracking on the signed-in product.

The marketing pages on lifeaccount.com may use basic analytics (page views, referrer source) to understand which content is useful. We do not associate marketing analytics with any logged-in account identity.

We honor Global Privacy Control (GPC) signals on our marketing pages. See section 12 for details.

17. U.S. residents only

LifeAccount currently serves U.S. residents only. We do not market to or knowingly accept members from outside the United States. If you are in the European Union, the United Kingdom, Canada, or another jurisdiction with its own data protection laws, please do not provide personal information to LifeAccount until we are able to serve your region in compliance with your local law.

If we learn that a member is not a U.S. resident, we reserve the right to close their account and delete their data, with reasonable notice and an opportunity to export first.

18. Changes to this policy

We will update this policy when our practices change or when the law requires us to. For material changes — changes that affect your rights or how we use your data — we will email every active member at least 30 days before the changes take effect. On your next sign-in after a material change, we will require you to acknowledge the updated policy before continuing to use the Service. The new acknowledgment is recorded permanently alongside your original signup acknowledgment.

Minor edits (spelling, clarification, formatting that does not affect meaning) will be posted here with the “Last updated” date updated at the top.

19. Contact us

Questions, requests, complaints, or curiosity — all welcome at [email protected].

LifeAccount
30 N Gould St Ste 43019
Sheridan, WY 82801
United States

For privacy requests: [email protected] — subject line “Privacy Request”

For California opt-out: lifeaccount.com/privacy-choices

For all other state privacy requests: lifeaccount.com/privacy-choices or email with subject line “Privacy request — [your state]”

If you’re not satisfied with our response to a privacy concern, you have the right to file a complaint with your state attorney general’s office or, if you are a California resident, with the California Privacy Protection Agency (cppa.ca.gov).