PassOn holds some of the most sensitive information a person can write down. This policy says plainly what we collect, what we do with it, who else touches it, and what we will never claim.
Last updated: October 31, 2026
Your Offline Copy, under Reports and in Settings, downloads everything you stored as one ZIP file: every record, every uploaded file, your legal records and your security history, with an optional password. Or delete your account. Deletion removes your records from our database and your files from storage.
Vault attachments and estate documents are encrypted in your browser before upload. We hold a recovery key so your family can still get in. We do not claim to be unable to read your data, because that would be false.
We do not sell personal information, and we do not share it with advertisers. It goes only to the service providers named below and to the people you chose, when you said they should have it. The few exceptions are spelled out in this policy.
PassOn is operated by Smart Integrations LLC, 218 E. Valley Rd STE 104-313, Carbondale, CO 81623, United States ("PassOn", "we", "us"). We are the data controller for the information described here.
In this policy, a "user" is anyone who holds a PassOn account, whether or not they are a member, and a "member" is a user who has paid for, or been granted, a Standard or Premium membership. Keepers, beneficiaries, and other people a user names in a plan are covered in the section People Named in a Plan. Everything in this policy applies to users and members alike.
This policy covers the PassOn website at passon.cloud, the PassOn application at app.passon.cloud, the partner portals for attorneys, CPAs, insurance agents, and funeral directors, and the optional PassOn device worker you can install on your own computer. It applies to account holders, to website visitors, and to people an account holder names in their plan, such as Keepers, beneficiaries, and dependents, even if those people never create an account.
To create an account we collect your email address and a password, which we store only as a one-way scrypt hash. You may add your name and phone number. If you log in with Google or Facebook, we receive your email address, display name, and the provider's ID for your account, and nothing else from that provider. If you register a passkey, we store the public half of the credential; the private half and any biometric never leave your device.
Everything else you store is up to you. Depending on what you fill in, this can include your date and place of birth, home address, Social Security number and driver's license number, funeral and memorial wishes, medical directives such as organ donor and resuscitation preferences, the location of your will and the names of your executor and healthcare proxy, life insurance policies, bank and investment accounts identified by institution and the last four digits, trusts, real estate, debts, physical belongings, personal messages and biography, and the location of your safe or password manager. We never ask for full bank account numbers, credit card numbers, or the private keys or seed phrases of a cryptocurrency wallet; for crypto we store wallet addresses and your written description of where the recovery method lives. Some of this is sensitive: identity documents and government ID numbers, health and medical information, financial account details, and the contents of your Secure Vault. Before you first store any of it we ask for your consent, once, and keep a record of it. You can withdraw that consent in Settings; we then stop accepting new sensitive information, and you can delete what you have stored, or your whole account, there. Health information has two consents of its own, one to store it and one to share it, and withdrawing them erases it; our Consumer Health Data Privacy Policy explains.
A plan is about other people. You may enter names, relationships, email addresses, phone numbers, postal addresses, dates of birth, and photos for your Keepers, beneficiaries, estate handlers, authorized contacts, attorneys, physicians, and anyone else who plays a role. For dependents in your care, including children, you may record medications, medical conditions, dietary needs, and care instructions. Our Consumer Health Data Privacy Policy describes all the health information we hold, whom it is about, and who receives it. When you add a Keeper, beneficiary, estate handler, authorized contact, or emergency contact, and again if you change their email address or phone number, we ask you to confirm that you have the right to share their contact details, and we record when you did. If you list emergency contacts, we hold their name, email address and, if you give it, phone number. We record when we email someone an invitation to accept a role, and when they accept. You are responsible for having a proper basis to give us this information about them, and we use it only to carry out your plan. See "People Named in a Plan" below for their rights.
You can upload documents, photos, and recorded video and audio. Vault attachments and estate documents are encrypted in your browser before upload. Profile photos, time capsule video, and time capsule audio are not encrypted in the browser, because encrypted media cannot be played back; they are protected by access controls and encrypted connections instead.
Credit card payments are processed by Stripe. Credit card numbers go directly to Stripe and never reach our servers; we keep the Stripe transaction reference, amount, and status, and we send Stripe your email address as part of the transaction record. If you pay in cryptocurrency, we record the wallet address you sent from and the transaction hash.
When you use the application we record security events in an audit log: logins and failed logins, password and 2-Step Verification (2FA) changes, file downloads, and similar actions, each with your IP address, browser identifier, and the time. Our servers also keep a technical log for 14 days: the kind of each request, the page, the result, the time, your IP address and browser identifier, and a copy of each security event with a shortened email address. It is deleted after 14 days, even if your account is deleted sooner.
When you create an account, we save with it the campaign tags of the link that brought you, if it had any (short labels such as "google"), what you chose to handle first, if you chose on our website, and the time you signed up. Nothing else from that link is saved, and a sign-up through Google or Facebook does not show them any of it. We use the tags only to count where new members come from, and your choice to open that section once and to count what people choose.
We also record when you add or change items in your plan, such as a Keeper, a beneficiary, an asset, a Time Capsule, or an uploaded file. For these entries we keep the type of item, its internal record number, the time and, when an existing item was changed, the names of the fields that changed, such as "last name" or "phone", never their values, and a few yes-or-no notes about the save, such as whether an invitation email went out. We do not keep the item's contents, people's names, amounts, or file names in that log, and we do not record your IP address or browser for them. We use these entries to see whether the product is being used and where people get stuck, and to answer a support question about your own account. They appear in the security history you can export from Settings.
If you install the PassOn Worker on your Windows computer, we keep the computer's name and Windows version, an identifier for it, when it was paired and last connected, and, after your death, its report of what it did, including the names of files it moved to the Recycle Bin. All of it is encrypted, and it is deleted with your account.
If you write to support we keep the correspondence. When you accept our Terms of Service, a Membership Agreement, a Keeper or authorized contact acknowledgment, the documented-death instruction, or the consent to store sensitive information, and when an attorney, accountant, insurance agent, or funeral director signs up for a provider account and accepts the Terms, we keep a record of that acceptance: the version you accepted, the time, your IP address, and in most cases your browser identifier. If you opt in to text messages we keep a record of that consent, including the time, your IP address, and browser identifier, as the law requires. If you are a Keeper, an estate handler or the second in line, an authorized contact, an emergency contact, or a caretaker and opt in to receive texts when you accept the role, we keep the timestamp, your phone number, and the version of the words you agreed to. If you chat with Maria, our Welcome AI Assistant on the website, we keep the transcript along with the page you were on and any campaign tags in the address, and your browser keeps a copy of the transcript in its local storage until you clear it.
We record which kind of email we send you and when, for example a welcome email or a password reset, but never its contents.
If you request our free guide we keep your email address, the page you requested it from, and a salted, truncated hash of your IP address that we use only to limit abuse. The website counts its own visits, on our own server, with no cookies and no browser identifier, and sends nothing about your visit to anyone else. For each page it records the page's address, the campaign tags of your visit, which version of the page you saw, any button or form you used, the time, and the same hashed IP. It does not record which site you came from, only whether you arrived from outside passon.cloud, and it cannot tell whether two visits were made by the same person.
We do not use the contents of your plan for advertising, and we do not build profiles of you for anyone else. We do not collect, use or sell personal information to train large language models or any other AI model.
Some features send text to Google's Gemini API to produce a result. Each one starts with something you do:
We send only what the feature needs, and we use the output only for you. Google processes this content under its API terms. We do not send your plan to any AI provider except when you take one of the actions above.
All connections use encrypted transport. Stored information is encrypted in two layers. Our database sits on a disk volume encrypted with AES-256. On top of that, everything you enter is encrypted one value at a time with AES-256-GCM before it reaches the database: names, contact details, addresses, account and policy numbers, amounts, descriptions, notes, medical information, vault entries and messages, and the same for the people you name. What you type to Maria on our website, the email you leave for a guide, and what the website records about your visit are encrypted the same way, under a separate key held by the website, which cannot read member information. Someone who obtains a copy of our database or its backups gets ciphertext. What stays readable is what the database needs in order to work: record numbers, dates and times our system recorded, statuses and settings, campaign tags and the kind of each website event, the price you paid us, and information that is public anyway, such as blockchain timestamps and the business listings in our provider directory. Passwords are scrypt hashes. 2-Step Verification is required before you save certain sensitive information, such as Secure Vault items. You can also choose an automatic sign-out interval and review your own security history.
Vault attachments and estate documents are encrypted in your browser with AES-256-GCM before upload, so our storage provider only ever holds ciphertext. This is key escrow, not zero-knowledge: a per-file key is stored on our server wrapped under our master key. That design is deliberate. It is what lets us check a file for malware, run Analyze when you ask, and deliver files to your family when your Keepers agree. We therefore do not describe PassOn as zero-knowledge or end-to-end encrypted, and we do not claim that we cannot read your data.
Our servers decrypt a file in only three situations: an automated file-type and malware check at upload (the malware scanner runs on our own server, so the file is not sent to any outside service), an action you take yourself such as a download or pressing Analyze, and delivery to a beneficiary or estate handler after your death has been verified under the rules you set. Nobody at PassOn browses your files — access is restricted by written policy and every file access is logged. A person at PassOn opens file content only with your written consent naming the file, under a legal order, or to examine a file already quarantined by the malware scanner.
No system is perfectly secure. If we learn of a breach affecting your information, we will notify you as the law requires.
Keepers receive invitations (with a reminder after 7 days and again after 30 if they have not answered), verification requests, welfare-check notices and, while a report of your passing waits for their answer, reminders by email, and a short notice if that report is withdrawn or closed as a mistake.
Your Keepers, your estate handler, the second in line and your authorized contacts are emailed an invitation to accept their role when you choose to send it. If you are a member, an emergency contact you list and a caretaker you name for a dependent are emailed one invitation without you having to send it. We send it again only if you press Resend. For them, accepting is optional and changes nothing about when they are emailed. You see who has accepted. When someone accepts a role, we record when, and the IP address and browser they used.
A Keeper may give us a phone number of their own when they accept. We use it to call them if we cannot reach them by email. We text it only if the Keeper ticks the box under it to opt in to receive texts. After verification, each beneficiary receives one message with a private link to what you left them. A beneficiary is not emailed just for being named. Dependent caretakers receive an urgent email. Every email we send an emergency contact lets them opt out. If they opt out, we do not email them again as an emergency contact, and you see that they opted out. An emergency contact receives nothing from your plan.
You can lock what you leave each person. We keep the answer only as a one-way hash, like your password, and never email it.
If an email PassOn sends after a member's death to a person they named cannot be delivered, we record that person's name and email address and when it bounced, so the member's estate handler and second in line can be told. This record is kept with the plan and deleted with it.
We send you text messages about your own account only after you opt in. We text the people you chose only if they opt in themselves when they accept their role; a Keeper does this in an unticked box on the page where they accept. You cannot opt in for them. Once they opt in, they may receive texts as follows:
We give their numbers to Twilio, our text message provider, only when we text them. They can reply STOP to any text to stop texts, or HELP for help. We never text your beneficiaries, or anyone else named in your plan. Mobile numbers and text message consent are never shared with or sold to third parties or affiliates for marketing or promotional purposes. Your estate handler receives your estate summary, your life insurance details, and the agency notification forms we generate, some of which contain your Social Security number because the agencies require it. If your estate handler has not confirmed receiving it within 7 days, or the email to them could not be delivered, the second in line you named is included as well, and if no one you named can be reached, PassOn staff step in. If some of your Keepers have not answered a report of your passing after two weeks, we email your estate handler and the second in line you named once, to tell them that a report was made and to ask them to help us reach your Keepers; from then on the PassOn team may also phone a Keeper who has not answered, your estate handler or the second in line, using the numbers in your plan or the one a Keeper gave us. A Keeper’s only job is to confirm your death, and Keepers do not receive your plan.
You can attach a funeral director, estate attorney, insurance agent or CPA to your plan on the Connections page, by entering their code, choosing them from a directory, or signing up with their code. We record that link and, for each one, three switches you control: whether that professional may see your name and email address; whether they are told when your Keepers have verified your death; and whether, at that point, they receive the name, email and phone of your estate handler. A funeral director with all three on can see your funeral and memorial wishes on their PassOn dashboard from that notice on. A funeral director link has a fourth switch, off unless you turn it on: whether the director may see your funeral and memorial wishes now, while you are alive, with your name only if the name-and-email switch is on too. Apart from those wishes, nothing about your plan reaches any of them before verification, and nothing at all reaches a professional whose switches are off. Turning a switch off stops that sharing; removing the link stops all sharing with that professional going forward. We do not receive payment for these links. If you joined PassOn with a professional's code, or entered it before paying, PassOn pays that professional a one-time $50 when you become a paid member, once the 14-day refund period has passed. It costs you nothing and does not change your price. That professional can see that a reward was earned and when, and sees your name only while their switch to see your name and email is on.
These companies process information for us under data-processing terms that limit them to providing their service:
| Provider | Purpose | What it receives |
|---|---|---|
| Vultr | Hosting for the website, the application, and the database, in Dallas, Texas | All application data |
| Cloudflare R2 | File storage | Uploaded files; vault and estate documents arrive already encrypted |
| Google Gemini | AI features you start, and follow-up emails after a chat with Maria | The document text, prompt, or chat involved |
| Google reCAPTCHA | Abuse prevention on registration, login, password reset, professional sign-up and the text-message opt-in form | Browser signals Google uses to tell people from bots |
These companies process information to provide their service to us, and also use it for their own purposes, such as preventing fraud and abuse, meeting their legal obligations, and improving their services. For that use each follows its own privacy policy, linked below:
| Provider | Purpose | What it receives |
|---|---|---|
| Stripe Privacy policy | Credit card payments | Payment details and your email address |
| SendGrid (Twilio) Privacy policy | Email delivery | Recipient addresses and message contents |
| Twilio Privacy policy | Text messages and WhatsApp | Phone numbers and message contents |
| Alchemy and other blockchain data providers Privacy policy | Confirming cryptocurrency payments | Wallet addresses and transaction hashes |
| Google Tag Manager Privacy policy | Tag loader on the website (currently empty) | Page address and standard browser request data |
Address suggestions in the application come from Google Maps. As you type into an address field, what you have typed so far is sent from our server to Google, which uses it under the Google Privacy Policy and may keep it to improve its products.
When no PassOn professional matches a search in one of our directories, the directory shows Google's own list of nearby businesses, or a Google map, inside the page. It loads from Google in your browser, so Google receives your IP address, your browser details and the search, under the same Google Privacy Policy.
To prove when a plan snapshot or an authenticated video existed, we publish a cryptographic hash to the Bitcoin blockchain through OpenTimestamps. A hash cannot be reversed into your content. No names, files, or plan contents are ever written to a blockchain.
We disclose information when a law, court order, or lawful government request requires it, after review by a founder and limited to what is required; we notify you where the law allows. If PassOn is acquired or merges, your information transfers with the service under this policy, and we will tell you before any change in how it is used.
The application uses a session cookie to keep you logged in, set with the HttpOnly, Secure, and SameSite flags. Its lifetime follows the automatic sign-out interval you choose in Settings, up to a maximum of 30 days. Short-lived cookies also carry anti-forgery tokens for forms and a ten-minute state value during a Google or Facebook login, which also holds your campaign tags and your first choice if you sign up that way. The application keeps interface preferences in your browser's local storage, and unsent form drafts, your campaign tags and that choice in session storage; drafts are cleared when you sign out, the tags and the choice when you sign in or close the tab.
The website sets no cookies of its own. It loads Google Tag Manager, whose container currently holds no tags, so it sets no analytics or advertising cookies. If we add analytics or advertising tags from another company, we will update this policy first. Referral codes and campaign tags from the address bar are kept in session storage for the life of the browser tab, and the campaign tags are added to links into the application. You can block cookies and clear storage in your browser; blocking the application's session cookie will stop you logging in.
Do Not Track. Neither the website nor the application responds differently to a browser's Do Not Track signal, because there is no agreed standard for what it should mean. We do not track you across other companies' websites. The only outside code on our pages is what is named in this policy: Google Tag Manager, reCAPTCHA, and Google's results in our directories, from Google, and Stripe's payment form when you pay by credit card. Each receives your browser's details when it loads and uses them under its own privacy policy.
A legacy plan is meant to outlive you, so by default we keep your plan for as long as your account exists, and after verification for as long as it takes to deliver it and for the two years after that described below. Beyond that:
Wherever you live, you can do the following, most of them yourself in the application:
Appeals. If we refuse a request, you can appeal by replying to our answer with the word "Appeal". A founder who did not make the first decision reviews it and answers you in writing within 45 days, with the reasons. If we deny your appeal, you can complain to the Attorney General of your state; we will tell you how in our answer.
Residents of California, the European Economic Area, the United Kingdom, and other places with privacy laws have these rights by statute and may also complain to their local regulator. We do not sell or share personal information for cross-context advertising, and we do not discriminate against anyone for exercising a right. To exercise any right, or if you cannot log in, email privacy@passon.cloud. We will verify that the request comes from the account holder before acting.
If someone has named a person as a Keeper, beneficiary, estate handler, authorized contact, or in another role, we hold what they entered about that person, and we contact that person only as their plan requires. Anyone named for a role may decline it, from the invitation where it offers that, or by telling the user who named them. If they opted in to receive texts when they accepted, they can reply STOP to any text. Once they no longer hold the role, they can ask us to delete the record of their opt-in. Anyone named may email privacy@passon.cloud to ask what we hold about them or to ask us not to contact them. Because that information is part of another user's plan, we may need to tell that user that they asked, and we may be unable to delete it while the plan depends on it; in that case we will restrict its use to what the plan requires.
When a Keeper or authorized contact confirms a death or an incapacity, we record who confirmed it, when, and from where. If a confirmation is disputed, that record may be shared with the member, their family, or the authorities. This is the same statement made in the acknowledgment each Keeper and authorized contact accepts.
If a Keeper you named has a PassOn account of their own at the email address you gave us for them, and their death is verified through that account (their own Keepers confirm it, or it is documented), we tell you once, in the app and by email, that your Keeper has passed away, using the name you gave them, and that they no longer count among the Keepers who confirm a passing, so you can name another. Your Keepers page marks them as passed away. In the same way, if you are someone's Keeper and your own death is verified, the member who named you is told.
PassOn accounts are for adults, and we do not knowingly let anyone under 18 create one. Account holders may record information about children in their care, including health details, so that a caretaker can act on it. That information is entered by the parent or guardian, is encrypted, and is shared only with the caretaker they designate. If you believe a child has created an account, contact us and we will remove it.
Our servers and database are in Dallas, Texas, United States, and our service providers operate in the United States or globally. If you use PassOn from elsewhere, your information is transferred to and processed in the United States, which may not have the same privacy laws as your country. We rely on your instruction to store your plan with us, and on our providers' contractual commitments, as the basis for those transfers.
When we change this policy, we post the new version here and update the date at the top. If a change expands what we collect or share, we ask you to accept the new version the next time you log in or open PassOn.
Questions about this policy or about your information:
Our Terms of Service describe the service itself, including how Keeper verification works.