Privacy policy — version 2026-09-23

MY WISHES — PRIVACY POLICY
Version 2026-09-23

This says what we keep, how we protect it, and who can see it. It describes
how the software really works.

1. WHAT WE KEEP

To run your account:
- Your email address.
- Your password, stored in a form that cannot be turned back into the
  password. Not even by us.
- Each time you sign in: the time, the internet address you came from, and
  the kind of device or browser.

What you choose to add. All of it is optional:
- Profile details, such as your name, address and phone number.
- Identity numbers: Social Security, driver's licence, passport, national ID.
- Documents, assets, possessions, contacts and recorded messages.
- Beneficiaries, and for each one an optional tax number.
- Your wishes.

There is no advertising, no analytics and no tracking on this site.

2. HOW IT IS PROTECTED

We use very strong, standard methods to protect passwords and all other
sensitive data.

These are encrypted with a key that belongs only to your account:
- Identity numbers.
- Every uploaded file and recorded message, and the transcript you type
  beside a recording.
- A beneficiary's tax number.

That key is itself locked by a master key kept outside the database. A copy
of the database on its own reveals none of it.

Identity numbers are never included in a page. One is shown only when you ask
to see it, one at a time.

3. WHAT IS NOT ENCRYPTED

Names, addresses, phone numbers, dates and the titles of things. They are
shown and searched all the time, so they are stored as they are. This
includes a beneficiary's name and contact details, but not their tax number.

When you open a recording, its transcript is decrypted and shown to you like
any other text on the page.

4. WHO CAN SEE IT

- You.
- A trusted contact sees only the categories you tick, and only the items
  you mark as visible to trusted contacts. A beneficiary's tax number is
  never shown to a trusted contact.
- Sharing a document with someone gives them that one document, not your
  account.
- An emergency-only contact sees nothing until they ask, you are told, and
  seven days pass without you refusing.

When someone you have given access to opens a document, you can see who did
and when.

5. THE HELP BUTTON

The help button is our own assistant, built for this site. It answers using
an AI service through a private connection. It is not a public chatbot.
Nothing about you or your records goes with your question, and we do not
keep the question.

6. THE PEOPLE WHO RUN MY WISHES

They can see your account and your contact details: name, email, phone and
address. They need this to manage accounts and answer support requests.
Every such action is logged. They cannot read what the account protects:
your identity numbers, files, recordings, beneficiaries and everything else
stay encrypted for you.

7. EMAIL

We send only what the service needs: verification codes, sign-in links,
password resets, emergency-access notices, and a notice when a professional
you contacted through the directory writes back. Messages are delivered by an
email service, which handles the address and the message. We do not sell your
address and we do not email your contacts.

8. DELETING THINGS

Deleting something moves it to Deleted items, where it can be restored.
Deleting it permanently from there removes the record and, for documents and
recordings, the encrypted file. That cannot be undone.

9. DELETING YOUR ACCOUNT

Deleting your account erases everything inside it, including the keys that
protect it. It cannot be undone. We keep only a minimal record of the account
itself: your name, email, phone and address, the dates it opened and closed,
the last address you connected from, and the date and version of the agreements
you accepted. Nothing from inside the account is kept.

10. WHERE IT RUNS

On servers we run. Backups hold the same encrypted values described above.

11. CHANGES

This policy may change. Earlier versions remain available.