Privacy Policy

1. Introduction

LifeWyn ("LifeWyn", "we", "us", or "our") provides a zero-knowledge digital inheritance platform. This Privacy Policy explains what information we collect when you use our websites, applications, and related services (collectively, the "Service"), how we use and protect it, and the choices you have. By using the Service, you agree to the practices described here.

The defining principle of our Service is that your most sensitive content — the data you store in your vault — is encrypted on your own device before it reaches us, and the keys that decrypt it are never transmitted to us. Your account and contact details are a separate matter and are described in full below.

2. Information we collect

We collect only what we need to operate the Service:

• Account and contact information. Your name, email address, and (optionally) a phone number, used to create and secure your account, authenticate you, and send essential notifications.
• Device and technical information. Device type, operating system, browser, IP address, language, and similar diagnostic data used for security, fraud prevention, and reliability.
• Encrypted vault ciphertext. The encrypted contents of your vault. We store this ciphertext but cannot decrypt it, because the keys required to do so never leave your control.
• Protection Check-In signals. Metadata generated when you complete periodic check-ins, along with the inactivity and verification signals used by your inheritance rules (for example, timestamps of your last confirmed activity).
• Inheritance configuration. The nominees you designate, the rules and thresholds you set, and encrypted key-shares — never their decrypted contents.
• Nominee contact details. The name and contact details of the people you name. These are held in readable form, because the Service cannot notify or verify a nominee whose address it cannot read.
• Billing metadata. Subscription plan, billing status, and transaction identifiers. Card and payment details are handled by our payment processors; we do not store full card numbers.

3. What we cannot access

To make our commitment concrete, the following are technically inaccessible to us by design:

• Your plaintext vault data. Documents, credentials, keys, notes, and files inside your vault are encrypted before upload. We hold only ciphertext.
• Your master password and derived keys. Your master password is never transmitted to or stored by us. We cannot recover it, and we cannot reconstruct the keys derived from it.

Because we do not hold your keys, a legal demand for your vault reaches ciphertext rather than plaintext, and we cannot restore access if you lose your master password — there is no manual recovery process we can fall back on, because we do not hold what we do not need. Account and nominee contact details, which we do hold in readable form, can be produced. This is an intentional trade-off in your favor.

4. How we use information

We use the information we collect to:

• Provide, maintain, and secure the Service and your account;
• Operate Protection Check-Ins and evaluate your inheritance rules using the signals described above;
• Communicate with you about your account, security, service changes, and support requests;
• Process subscriptions, trials, billing, and renewals;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use your vault contents for advertising or profiling — your vault reaches us only as ciphertext, so it is not available to us for those purposes.

5. Encryption and data security

Vault contents are protected with authenticated symmetric encryption (XChaCha20-Poly1305) using keys derived on your device from your master password with a strong key-derivation function. Data is encrypted in transit using TLS and encrypted at rest on our infrastructure. We apply access controls, network segmentation, logging, and routine review to our systems. No system is perfectly secure, but the zero-knowledge architecture means that even a compromise of our servers would expose ciphertext, not your readable data.

6. Key management and inheritance data

Recovery for nominees is enabled through encrypted key-shares that you configure. These shares are stored in encrypted form and are only made available to a nominee when the conditions you defined are satisfied and verified. We store the rules, thresholds, and encrypted shares required to orchestrate this process; we do not store anything that would let us assemble your keys ourselves ahead of a valid, verified release.

7. Sharing and disclosure

We disclose information only in limited circumstances:

• Nominees. When your inheritance rules are met and verified, designated nominees receive the encrypted key-shares and vault access you granted them — and nothing more.
• Service providers. We share limited data with vendors who process it on our behalf (for example, cloud hosting, email delivery, and payment processing) under contractual confidentiality and security obligations.
• Legal and safety. We may disclose information if required by law, subpoena, or valid legal process, or to protect the rights, safety, and security of users, the public, or LifeWyn. Even so, we cannot disclose plaintext vault data we do not have the ability to decrypt.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred subject to this Policy.

Our current sub-processors are:

This list is maintained on our compliance page and is updated when it changes.

8. Where your data is stored

• Account and billing data: Oracle Cloud Infrastructure (OCI), Mumbai (ap-mumbai-1).
• Encrypted vault contents: Oracle Cloud Infrastructure (OCI), Mumbai (ap-mumbai-1).
• Backups: same region, on a rolling 30-day retention.

Wherever data is stored, your vault contents are encrypted before they reach us, so we hold ciphertext rather than your records regardless of the hosting region.

9. Data retention and deletion

We retain account, configuration, and billing metadata for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

When you request deletion of your account, the request is recorded and held for a grace period during which you can cancel it. After that period, we remove or anonymise the associated data, except where longer retention is required by law. Final destruction of account records is carried out by our team rather than automatically, because it cannot be undone. Fully automated, self-service account erasure is not yet available; to request deletion, contact us using Section 15.

Because vault contents are encrypted with keys we do not hold, deleting the ciphertext renders it permanently unrecoverable. Export anything you want to keep before you request deletion.

10. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can manage much of this directly in your account settings, including exporting your data.

To make a formal data-rights request, contact us at grievance@lifewyn.com. We acknowledge every request within 5 business days and aim to resolve it within 30 days, and in any case within the timeframes required by applicable law. We may need to verify your identity first.

If you are in India, the Digital Personal Data Protection Act, 2023 also gives you the right to nominate another individual to exercise your rights in the event of your death or incapacity. This is separate from naming recipients inside your vault.

11. Cookies and local storage

We use cookies and browser local storage to keep you signed in, remember preferences, secure sessions, and understand aggregate usage. Some local storage is essential to the Service — for instance, holding keys derived on your device so your vault can be decrypted locally. You can control non-essential cookies through your browser settings, though disabling essential storage may break core functionality.

12. International transfers

We may process and store information in countries other than your own, including where our service providers operate. Where we transfer personal data across borders, we rely on appropriate safeguards, such as standard contractual clauses, consistent with applicable data-protection law.

13. Children's privacy

The Service is not directed to children and we do not knowingly collect personal information from them. In India, the Digital Personal Data Protection Act, 2023 defines a child as anyone under 18 and requires verifiable parental consent before processing their personal data; we do not knowingly process children's data and do not offer accounts to them. Elsewhere, the minimum age is the age required to form a binding contract in that jurisdiction, and in no case under 16.

If you believe a child has provided us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the Service or by email. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

15. Contact us

If you have questions about this Policy or how we handle your information, contact us at support@lifewyn.com. You can also reach out through our contact page.

For security vulnerabilities, write to security@lifewyn.com — see our responsible disclosure policy.

16. Data controller, DPO, and supervisory authority

The following disclosures are required under the GDPR and India's DPDP Act. They are being finalised with counsel and will be completed before general availability:

• Data controller. LifeWyn Global Private Limited. Registered address: Near Flipkart Building, Embassy Tech Village, Outer Ring Road, Kadubeesanahalli, Bengaluru, Karnataka 560103, India.
• Data Protection Officer (DPO). Held on an interim basis by the founding team. Contact: support@lifewyn.com.
• Grievance Officer (India DPDP Act). Kishor Dhakad, Co-founder. Contact: support@lifewyn.com, Near Flipkart Building, Embassy Tech Village, Outer Ring Road, Kadubeesanahalli, Bengaluru, Karnataka 560103.
• Supervisory / data-protection authority. If you are in the EU/EEA, you have the right to lodge a complaint with your local supervisory authority; in India, with the Data Protection Board once constituted.