Privacy policy

• Your email address. It’s how you sign in (we email a link and a code, never a password) and how we reach you about your account.
• What you type into the ledger. Estate names, assets, transactions, distributions, and the people you invite. You control all of it.
• Files you upload. Receipts, appraisals, bank statements and signed acknowledgments. They’re stored privately and served only to people with access to that estate.
• Payment records. Handled by Stripe; we never see or store card numbers. We keep what was charged and when, plus the estate’s name, which appears on your receipt so it can substantiate a reimbursement claim.
• Sign-in records. The IP address and browser of each session, kept so you and we can tell a real sign-in from someone else’s; and a count of sign-in emails sent to each address and inbox, kept no longer than a day and stored as a one-way hash rather than the address, so no one can flood an inbox or keep guessing codes.
• Which documents were opened. The document name, the viewer’s role, and whether it was unlocked. It records that a document was opened, never what it said.
• Who opened an estate’s records. When a member views an estate, opens one of its documents, downloads an uploaded file, or exports its records, we note who, which, and when, with the IP address and browser used. It records that something was opened, never what it said. It exists so that anyone in an estate’s records who shouldn’t be can be noticed; the estate’s executor and co-executors can see who opened what and when, but not the IP address or browser.
• Your agreement to these terms. Which version of the Terms and this policy you accepted by signing in, and when.

You can start without an email address. We then create a temporary account with no email and a placeholder address that can’t receive mail; anything you record in it is kept for 30 days after your last sign-in expires and then deleted, unless you add your email, at which point the records move to your account and the temporary one is deleted.

We never ask for the decedent’s Social Security number, and there is nowhere in the product to put one. Please don’t type it into notes.

• No advertising trackers, no analytics cookies, no pixels, from anyone.
• We never sell or rent your data, and we never give a data broker or an advertiser anything about you, your estate, or its records. The single exception is described below and contains none of that: when someone who arrived from one of our ads makes a purchase, we tell that ad network the click reference it gave us, the amount, and the time.
• We never use your estate’s records for anything except showing them to you and the people you invite.

We do count page views and page-load speed, using cookieless, first-party measurement served from our own domain (Vercel Web Analytics and Speed Insights). It tells us which pages get read and which are slow; it cannot identify you, follow you across sites, or see anything you type. The same measurement carries one event of ours: a document preview or an unlocked document being opened, recorded as the document style’s name and whether it was still a preview, never the estate or the person. We strip the query string from every URL before it is recorded, so nothing you type into a search box is ever included.

One more count, and it is ours: when a page loads from outside the site, it tells our server which part of the site you landed on and where the visit came from (one of our ads, a search engine, an email, another site, or nowhere in particular), and our server adds one to that day’s tally, noting whether the device looks like a phone or a computer. While we try out two versions of the home page headline, the home page also tells our server which of the two it showed, a third word alongside the other two, so we can count how many people who saw each headline went on to press Start free. Once we settle on one headline and remove the other, that third word goes away and the message is back to two. A press of Start free on one of our guide, sample, calculator, comparison or spreadsheet pages is tallied the same way, as the part of the site the button was on and nothing else. The sign-in page being shown, sign-in emails being sent, the unlock button being pressed, and an unlock press that bounced back because the estate still had no name are tallied the same way. That is the whole message: no cookie, no id, no address or browser kept, no web address, nothing you typed. The tallies hold nothing about any one person, so we keep them; they tell us how many people arrive each day and how many go on to open an account.

And when we run ads of our own: if you arrive by clicking one, the link carries a click reference the ad network added. Our own code keeps that reference in a first-party cookie for up to 90 days, and if you create an estate while it is set, a copy is stored with that estate and erased 90 days after the estate is created. The reference is used for two things and nothing else: to tell the ad network “that click led to a purchase” and stop paying for ads that don’t help anyone, and to count, as a plain daily number, how many new estates and accounts came from an ad. No ad network’s code runs on this site, the reference can’t follow you anywhere, and arriving any other way sets nothing at all.

An estate’s records stay until someone deletes them. There is no expiry, because an estate can take years and the accounting has to cover all of it. You can delete an estate, or your whole account, at any time from the controls below, and that deletion is immediate. Two things outlive it deliberately: the record that a payment was made, which we need for tax and refund purposes and which holds no estate records; and the ad click reference described above, for 90 days. Sign-in records are deleted daily once the session they belong to has expired, with one exception: a no-email account’s sign-in records leave with the account itself, because its last session is how we know the account was abandoned. Unused sign-in links and codes expire after 15 minutes and are deleted daily. In an estate’s access history, the IP address and browser are erased after 90 days, while who opened what, and when, stays with the estate until it is deleted. If you delete your account, your entries in other estates’ histories remain but no longer say who you were, and the record of your agreement to these terms is deleted with it.

Records are stored with our database provider (Neon, on AWS in the United States) and served through Vercel. Sign-in and notification emails are delivered by Resend. Payments run on Stripe. Each processes data only to provide their service to us.

• Export everything. Your complete ledger, inventory, distributions, beneficiaries, deadlines and bank checkpoints download as CSV or JSON from the estate’s Settings page, free, no lock-in.
• Delete it all yourself. Every estate has a delete option at the bottom of its Settings page (the executor types the decedent’s name to confirm), and your account deletes from the Your estates page. Deletion is real and immediate: records and uploaded files are destroyed, not archived into a marketing list.
• Access is yours to grant. Only people you invite can see an estate, at the role you chose, revocable any time. The estate’s Settings page shows its executor and co-executors who has opened its records, and when.

Depending on where you live (California, Colorado, Connecticut, Texas and Virginia among others), you may have the right to know what we hold about you, get a copy, correct it, or have it deleted, and to be told whether we sell or share it. Our answer is the same wherever you live: the export and delete controls above hand you all of it directly, without asking us. If you would rather we did it, or you want to correct something the product won’t let you edit, email support@executorledger.com and we’ll respond within 45 days. We never charge for asking, and we never treat anyone differently for having asked. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Email support@executorledger.com. A person reads it.