Privacy should be understandable, not just legal.

Our commitment

BeforeHand is designed around deliberate access, data minimization, and clear control. We do not treat a family relationship as automatic permission to view another person's plan, and we do not use your plan's contents for advertising, profiling, or anything other than running the product you asked us to run.

BeforeHand software is operated by SaariyS-II Corporation.

Information you provide

When you create an account, we collect your name and email address. You can add a phone number, which we use only for the two-factor text codes and time-sensitive alerts described below, not for marketing.

Instead of a password, you can sign in with Google or with Sign in with Apple. Both give us only your name, email address, and (for Google) a profile photo. Nothing else. If you choose Apple's “Hide My Email” option, we only ever see the private relay address Apple generates, never your real one. We never request or receive access to your Gmail, Drive, Google Calendar, Google Contacts, iCloud, or any other service tied to either account beyond confirming who you are.

Keeping your account secure

Every account is protected by two-factor authentication in addition to your password (or your sign-in with Google or Apple). The primary method is a time-based code from an authenticator app, generated and checked entirely on our own servers, with no third party involved. You can also request a one-time code by text message instead; that path is optional, sent through Twilio, and only used the moment you actually ask for a code.

You opt in to these text codes yourself, by entering your mobile number, checking the SMS consent box, and choosing to request one. We never text a number that hasn't done that. Message frequency depends entirely on you: we send one only when you actively request a security code, never on a recurring schedule and never for marketing. Message and data rates may apply. You can stop these texts at any time by removing your phone number from your account settings, by not requesting another code, or by replying STOP to any code message; reply HELP for help, or contact us at the email below.

We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.

Separately, when you choose to store something sensitive in your plan (an account password, an identification number, an access code), you set a security PIN of your own, distinct from your account password. We never store that PIN in a form anyone, including us, could read back: we keep only a salted, one-way hash of it, the same kind of check used to verify a password, not to recover one. Forgetting it means resetting it, not retrieving it.

Information you record in your plan

Your plan can include structured records (financial accounts, insurance policies, digital account logins, medical directives, personal property, and similar categories you choose to add), uploaded documents, and information about the people you connect to your plan: their name, relationship to you, and contact details. Fields you mark as sensitive, such as account passwords and identification numbers, are encrypted (AES-256-GCM) before they're written to our database, and uploaded documents are encrypted the same way before they're written to storage. They are not just access-controlled behind a login, but unreadable without the encryption key even if the underlying storage were somehow exposed. Sensitive fields also stay masked on screen behind the security PIN described above, separately from whatever access another person may have to view that part of your plan.

Choosing stronger protection: Maximum privacy

Separately from the protection described above, you can turn on Maximum privacy for your plan: real end-to-end encryption, not encryption we manage on your behalf. When it's on, your plan data and uploaded documents are encrypted on your own device before they're ever sent to us, with a key only you hold. We cannot decrypt that data, not through our database, not through our own systems, not even if you asked us to.

This is a choice you make, not the default, because it comes with real responsibility. Turning it on generates a recovery phrase that only you hold; you'll need it to read your plan on a new or different device. If you ever lose that phrase along with every device you've used it on, that data cannot be recovered, not by you, and not by us either. There is no backup and no override.

A small set of details stay visible to us even under Maximum privacy (which category a record belongs to, and, if you provide one, the name of an institution it relates to) so features like readiness tracking and automatic account-closure notices can keep working without us reading the content itself. Everything else you enter is protected. You can switch back to standard protection at any time, which restores our ability to help you if you ever need it.

Referral partners

Some people join BeforeHand through a referral partner, such as a lawyer or advisor, who gives them a discount code. When you use a partner's code, we record which partner referred you so the discount applies and the partner can see how many people their referrals brought in. By default, a partner only sees numbers, never who you are.

When you subscribe with a partner's code, you can choose to let that partner know you've signed up. If you do, they see your name and whether you're subscribed. They never see anything inside your plan. This is optional, your discount applies either way, and you can turn it off at any time from your Account page. If someone was invited by a partner by email, the partner sees that the invitation was sent, but whether that person signed up is shown only if they choose to share it.

Affiliates

Some people find BeforeHand through an affiliate, such as a creator or writer, who earns a commission when the people they refer subscribe. If you arrive through an affiliate's link, we record which affiliate referred you, along with when you visited and the kind of device you used. We store your network address and browser details only in a scrambled form that can't be read back.

If you then create an account and subscribe, we record your payments against that affiliate so we can pay their commission. The affiliate sees only your initials, when you signed up, your plan and whether you're subscribed. They never see your name, email, payment details or anything inside your plan.

Free forms and the readiness check

If you ask for a free form on one of our free form pages, we collect your email address and state so we can email you the form. If you take the readiness check, we save your answers as you go, along with who the plan is for, so you can pick up where you left off. This happens before you have an account. We also record how you reached the page, such as the ad you clicked and the campaign tags in the link, so we can tell which advertising works.

To see where our free form pages work and where people give up, we record each step you take from the moment you reach one of these pages: which page you arrived on, whether you opened the form, chose your state and gave your email, how far you got through the readiness check, and, if you go on to sign up, each setup step, whether you start a trial and whether you pay. Before you give us your email, these steps are tied only to a random identifier stored in your browser, not to your name or email. Once you ask for a form or create an account, they are linked to it. We use this record ourselves, to understand and improve these pages, and we don't sell it.

For the emails we send about your free form (the form itself, and any follow-ups), we also record whether the email was opened and which of its links you clicked, such as the download link. Opens are recorded by our email provider, Mailgun, through a small image in the email; clicks pass briefly through our own website before taking you where the link points. We don't do this for any other email we send.

If you then create an account, your answers are copied into it and deleted from your form request. If you don't, we delete your answers 40 days after the last email we send you. Every email we send about your form has a one-click unsubscribe link and a "Delete my data" link that removes your email address, your form request, your answers and the record of the steps you took before creating an account.

Adding people to your plan

When you add a trusted person or an Executor to your plan, we collect the name, relationship, and contact details you give us for them. If they don't already have a BeforeHand account, we email them to let them know they've been added and, if you've granted them any access, what that access is for. Inviting someone to a shared family subscription works the same way. We collect the name and email you give us for them and use it only to send that invitation and manage their seat on your subscription.

Who can see it, and when

Nothing you record is visible to anyone by default. Access only exists for the specific people you choose, scoped to exactly what you decide (a full plan, a single category, or a single item), and most access stays inactive until you explicitly publish it. Some access is conditional: it only activates once a life event you've defined (such as incapacity or death) is reported and verified through a review of real evidence, not a single click.

Once a death is verified specifically, we treat closing your accounts and settling your affairs as the priority: the Executor you've named and the family point of contact you've designated automatically gain full access to your plan's records and documents at that point, regardless of the narrower access they may have held while you were living. Everyone else you've connected to the plan can see high-level progress on that process without seeing your underlying records, unless they hold their own specific access to them.

Payments and subscriptions

If you subscribe, payment is handled entirely by Stripe; we never receive or store your card number, expiry date, or security code. What we keep on our side is a Stripe-issued customer reference so we can look up your subscription status, not your card details, which stay with Stripe under its own privacy and security practices.

How we communicate with you

We send email about account activity, including access being granted and life-event updates. Text messages are limited to the two-factor security codes you specifically request. We use Mailgun to deliver email and Twilio to deliver those text messages; neither is authorized to use your information for any purpose beyond sending the message we ask them to send. If you ask for a free form and tick the box to receive tips, we send a short series of emails about your form and your readiness check. If you create an account through a free form page but don't finish setting it up, we send up to three emails about your account. You can unsubscribe from these at any time. We don't sell your information.

We keep a short record of each email we send you: your email address, which email it was, and when it was sent, never its contents. Reminder emails check this record and wait if you've already heard from us recently, so you don't get too many, and it lets us see what we've sent you if you contact us. We delete each entry after 12 months.

If you have an account, we may also email you reminders to finish your plan, and tips and offers to help with it. We choose them from the questions you answered and from your account status, such as whether you're in a free trial, when you last signed in, and whether your plan is published. We never use what you wrote in your plan. You can turn plan reminders and tips and offers off, separately, on your email preferences page, from the link in any of these emails. If you're in Europe or the United Kingdom, we only send tips and offers if you ticked "Send me tips and offers" when you signed up, or turned them on later. We record when and where you agreed.

To see which of these emails are useful, we record whether you clicked the main link in one. To find out whether they help at all, a small share of accounts, picked at random, doesn't receive tips and offers, and we compare the two groups.

Some of our emails ask what's getting in the way of your plan. If you answer, we save your answer and any note you add, linked to your account, and use them only to improve BeforeHand.

Cookies, sessions, and tracking

The web app uses a session cookie so you stay signed in. Our public pages also use Google Tag Manager to load analytics and advertising measurement tools, such as Google Analytics, Google Ads, Meta, Reddit and Microsoft Clarity, which may set their own cookies to measure visits and how well our ads work. When you request a free form or create an account, we may share a scrambled (hashed) version of your email address with Google Ads to measure ad results. We never share your plain email address, and nothing inside your plan is ever shared with these tools. You can accept or decline these cookies in the banner shown on your first visit. If you are in Europe, the UK or Switzerland, they stay off until you accept. The iOS app doesn't use cookies at all: it keeps your session as a token stored in the device's Keychain, encrypted by iOS itself and never held anywhere else on the device.

Where your information is stored

Your plan data and uploaded documents are stored using Supabase, our database and file-storage provider, with sensitive fields and documents encrypted before they ever reach storage, as described above. If you access BeforeHand from a location outside where our infrastructure is hosted, your information will be transferred to and processed in that location, under the same protections described in this policy.

How long we keep it

We keep your plan, your documents, and your contacts for as long as your account is open, so the product keeps working the way you'd expect. If you revoke someone's access or remove a record, it stops being visible immediately; we don't promise instant deletion from backups, which exist to protect against data loss and age out on their own schedule rather than being individually edited. If your plan enters the account-closure process described above, records related to that process are kept long enough to support the Executor and family point of contact through it, and afterward for as long as we reasonably need to in case a dispute or legal request requires us to show what happened. Billing records are kept for as long as tax and accounting rules require after payments are made through Stripe. Readiness check answers from a free form request are deleted 40 days after our last email if no account is created. The record of which tips and offers we sent you, whether you clicked them, and any feedback answers you gave are kept while your account is open and deleted with it.

Your rights and choices

Wherever you're located, you can ask us to tell you what personal information we hold about you, correct anything that's wrong, or delete your account. Most of what we hold you can already see and edit directly inside the product: your profile, your plan records, your contacts, and who has access to what. To delete your account, use “Request account deletion” in the iOS app's Account screen, or email us at the address below; either way, we verify the request first, since deleting an account can affect other people's access, an in-progress account-closure process, or an active subscription, and we want to be sure it's really you and that you understand what it affects before we act on it. If you're in a region that grants you a formal right to data portability or to object to processing (for example under the GDPR or the CCPA), the request above covers that too. Email us and tell us what you're asking for.

You can also, independent of any of that: revoke anyone's access to your plan at any time your plan isn't already in the account-closure process; stop receiving two-factor text codes by replying STOP or removing your number (contact us to reset the authenticator-app method if you lose access to it); and unsubscribe from any non-essential email using the link in that email.

Children

BeforeHand is built for adults planning for themselves and the people they trust. It is not directed to, and we do not knowingly collect information from, anyone under 13. If we learn that a child's information was provided to us, we'll delete it.

Changes to this policy

If how we handle your information changes in a way that matters, we'll update this page and, for significant changes, tell you directly.

Contact us

Questions about this policy, your information, or an account deletion request: hello@beforehandplan.com.

Before this policy is final

This page reflects the product's actual current design and the providers listed above. It should still be reviewed by qualified counsel, updated with the company's legal name, registered address, and jurisdiction, and reconfirmed against the exact providers in use before it is relied on as a binding privacy policy.