Privacy Policy

This Privacy Policy explains how WealthPass ("WealthPass", "we", "us", or "our") collects, uses, discloses, and safeguards your information when you use our website and services (the "Service"). By using the Service, you agree to the practices described here.

1. Who we are

WealthPass is a personal wealth-tracking and digital legacy service. It lets you record your assets and liabilities while you are alive and, upon confirmed death, releases the information you have chosen to the beneficiaries you have designated.

2. Information we collect

Account information

When you create an account we collect your email address and display name. If you sign in with Google, we receive your name, email address, and profile picture from Google in accordance with your Google account permissions. We use Google sign-in solely to authenticate you and create your account.

Encrypted vault data

The sensitive contents of your vault — including assets, liabilities, beneficiary allocations, recorded legacy messages, and your testament — are encrypted on your device before they are sent to us. We store only the encrypted ciphertext and, by design, cannot read these contents.

Operational data

To operate features such as beneficiary notification and lookup, we store limited non-encrypted data, including a beneficiary's email address (used to deliver notifications), basic asset metadata such as type and currency, and your account email.

Life-status data

We record your "I am Alive" check-ins and related timing to operate the inactivity safeguard that governs whether and when your vault may be released.

Payment information

Subscription payments are processed by Stripe. We do not store your full card details; we receive limited information such as your subscription status from Stripe.

Device and usage data

We and our infrastructure providers collect standard technical data such as IP address, device and browser information, and log data for security, diagnostics, and abuse prevention.

3. How we use your information

• To provide, maintain, and secure the Service;
• To operate the life-check and death-trigger safeguards;
• To notify your designated beneficiaries if your vault is released;
• To process subscriptions and payments;
• To communicate with you about your account and important changes;
• To detect, prevent, and respond to fraud, abuse, and security incidents;
• To comply with applicable legal obligations.

4. End-to-end encryption

Your vault contents are encrypted with a key tied to your account. The key is held in secure escrow so that the Service can release your information to your beneficiaries only when your death is confirmed through the safeguards described in our Terms. Outside of that process, we cannot access your decrypted vault contents. If you lose access to your account and your key cannot be recovered, your encrypted data may be permanently unrecoverable.

5. How we share information

We do not sell your personal information. We share information only as follows:

• Service providers that process data on our behalf, including Google Firebase and Google Cloud (hosting, authentication, database, storage), Stripe (payments), and our email and SMS delivery providers (notifications).
• Your beneficiaries, who receive the information you allocated to them if and when your vault is released.
• Legal and safety — where required by law, legal process, or to protect rights, safety, and security.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

6. Legacy release

A core function of the Service is to release designated information to your beneficiaries upon confirmed death. Before any release, you are given an opportunity to cancel, as described in our Terms of Service. When a release occurs, each beneficiary is shown only the information you allocated to them.

7. Data retention

We retain your information for as long as your account is active or as needed to provide the Service, and thereafter as required for legal, accounting, or security purposes. You may request deletion of your account and associated data as described below.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing, under laws such as the Thailand Personal Data Protection Act (PDPA) and the EU General Data Protection Regulation (GDPR). To exercise these rights, contact us using the details below.

9. Security

We use technical and organizational measures — including strong encryption of vault contents (encrypted with your vault key before storage, with that key held in secure escrow so your information can be released to your beneficiaries after death), encrypted transport, and access controls — to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International transfers

Your information may be processed and stored in countries other than your own, including by our infrastructure providers. Where required, we take steps to ensure appropriate safeguards for such transfers.

11. Children

The Service is not intended for individuals under 18, and we do not knowingly collect personal information from children.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a revised "Last updated" date and, where appropriate, notify you.

13. Contact us

If you have questions about this Policy or your information, contact us at support@wealthpass.app.