Privacy Policy
Last updated: 12 July 2026 (version 1.0)
In short
You are about to tell us who your family is, what you own, and who gets it when you die. That is about as personal as data gets, and we have built Legawyl accordingly.
- The contents of your will are encrypted before they are stored. Not hashed, not vaguely “secured”. Encrypted, with AES-256-GCM.
- We do not sell your data, we do not advertise, and there is no ad-tech, no tracking pixel, and no session recording anywhere in Legawyl. There is nothing to opt out of, because we never built it.
- We never train AI models on your will.
- If you use Legawyl without an account, your answers never reach our servers at all.
- Analytics is off until you say yes, and it never receives a single word of your will’s contents.
- You can delete everything, yourself, immediately, from your account settings.
The rest of this page is the detail behind those promises.
1. Who is responsible for your data
Legawyl is an independent, non-commercial software project, operated from Poland, in the European Union. For privacy and security reasons we do not maintain a public office. The operator is the controller of your personal data; for any privacy, access, or deletion request, contact us at support@legawyl.com, the one address that also handles support and security.
You can also delete all of your data yourself, immediately, using the Delete Account button in your account settings (see section 8).
Our supervisory authority is the Polish Data Protection Authority (UODO, uodo.gov.pl).
Why European law applies to an American product. Legawyl is built for people making wills in the United States. But the person who operates it, and the servers that run it, are in the European Union, and the GDPR follows the operator, not the user. So your data is handled under the GDPR wherever you live. In practice that is good news for you: it is one of the strictest privacy regimes in the world, and you get its protections regardless of your state.
2. What we collect
2.1 Your account
| Data | Why |
|---|---|
| Email address | To identify your account, activate it, and contact you about it |
| Name | To address you, and to fill in your will |
| Password | Stored only as a bcrypt hash. We never store, log, or see your actual password |
| Google account details | Only if you choose “Sign in with Google”. We receive your email address and name, nothing else |
| Your acceptance of these policies | The date you accepted, and which version, so we can both answer “what did I actually agree to?” |
2.2 Your will: the sensitive core
To build a will, the questionnaire collects: your full legal name, date of birth, email, phone number and full postal address; your marital status and your spouse’s name; your children’s names (including minors) and their guardians; your pets and their caretakers; your assets and what they are worth; who inherits what, and in what shares; your alternate and contingent beneficiaries; your executors and digital executor; how you wish your remains to be handled; and two free-text fields (your final wishes and a personal message).
This entire body of information is encrypted at rest with AES-256-GCM. It is stored as ciphertext. It is never indexed or searched by its content, and it is never sent to any third party, in any form, for any purpose.
2.3 Sensitive information (GDPR Article 9)
Some of what the questionnaire asks touches on special categories of personal data, and we would rather be explicit about it than bury it:
- Confirming that you are of sound mind, and answering whether you are under the influence of drugs or acting under coercion, is information that relates to your health.
- Choosing how your remains should be handled (for example burial or cremation) can imply a religious or philosophical belief.
We collect this only because a valid will requires it, and we process it on the basis of your explicit consent, which the questionnaire asks for before you answer these questions (Article 9(2)(a)). You may withdraw that consent by deleting your account, which erases the data. It is encrypted with the rest of your will and is never disclosed to anyone.
2.4 Information about other people
Your will names other people: your spouse, your children (who may be minors), your beneficiaries, guardians, executors and pet caretakers. We hold their names and relationships because you told us about them, not because they came to us.
We want to be plain about what we do with them: nothing. We do not contact them, we do not market to them, we do not build profiles of them, and we do not disclose their details to anyone. Their information sits inside your encrypted will, is used only to generate your document, and is deleted when you delete your account.
If you are one of these people and you want to know what a Legawyl user has recorded about you, please contact us. Note that we may be unable to identify you inside someone’s encrypted will, and that we may be prevented from disclosing the contents of another person’s will to you.
2.5 If you use Legawyl without an account
You can complete the whole questionnaire without signing up. If you do, your answers are stored only in your own browser’s local storage. They are never transmitted to us, and we never see them. No database row is created for you.
Two consequences you should understand:
- We cannot recover them. If you clear your browser data, switch device, or use a private window, the draft is gone, and we cannot help, because we never had it.
- They sit unencrypted on your device. Anyone with access to your computer and your browser profile could read them. If you share a device, finish your will in a private session, or create an account so that it lives encrypted on our server instead.
They are uploaded to us only if you create an account and explicitly choose to import them.
2.6 Analytics, only if you agree
If, and only if, you accept the analytics banner, we collect pseudonymous usage data: which step of the questionnaire you reached, how long steps take, whether you completed the will, and general device and browser information.
What analytics never receives: your name, your email, your address, your assets, your beneficiaries, your executors, any free text, or any other content of your will. Not a single field of it. This is enforced in code by an allowlist of permitted events, checked when the software is built. It is not merely a policy we promise to follow.
You can decline the banner, change your mind at any time in your account settings, or set the Global Privacy Control signal in your browser, which we detect and honour automatically without you having to click anything.
There is no advertising, no interest-based profiling, no cross-site tracking, and no session replay.
2.7 Server logs
Our server keeps standard request logs, which may contain IP addresses, for security and debugging. They are not shipped anywhere and they rotate as the service is redeployed.
2.8 The attorney waitlist
Separately from the will builder, legal professionals can leave an email address to hear about tools we may build for attorneys. If you do, we store that email address, and, if you choose to answer the optional questions we link from the confirmation email, your answers about what you would want such tools to do.
This is a separate list from any Legawyl account. It is not connected to a will, it is never used to contact anyone about anything else, and joining it creates no account. Unlike the contents of a will, these answers are not encrypted at rest, because their whole purpose is for us to read them and count them up when deciding what to build. Do not put anything confidential, or anything about a specific client, in those boxes.
Email us at support@legawyl.com and we will delete your address and any answers.
2.9 If you leave a gift to a charity
If your Will leaves something to a charity or other organization, then at the moment you generate the Will we record the facts of that gift on their own: the organization’s name and EIN, the kind of gift, and the amount or percentage. Nothing else from your Will is copied, and a Will you are still drafting records nothing at all.
We do this so we can tell an organization how many people have remembered them, and for how much, without showing them anybody’s Will. These records are not linked to your name in anything we would share, and we do not tell any organization who you are, or that you specifically named them. If that ever changes, it will be something you are asked about and can decline, not something buried in a policy update.
Unlike your Will, these few records are not encrypted, because counting them is the entire reason they exist and encrypted values cannot be counted. They are deleted when you delete your account, along with everything else.
If you use Legawyl without an account, none of this happens: as section 2.5 says, nothing from your Will reaches us at all.
3. Cookies and browser storage
We keep this small enough that we can simply show you the whole thing.
3.1 Cookies
| Cookie | Purpose | Lifetime | Consent needed? |
|---|---|---|---|
| next-auth.session-token | Keeps you signed in | 24 hours | No. Strictly necessary |
| next-auth.csrf-token | Protects against cross-site request forgery | Session | No. Strictly necessary |
| next-auth.callback-url | Returns you to the right page after sign-in | Session | No. Strictly necessary |
These three exist only to deliver the sign-in you asked for, so they do not require consent. You are still entitled to know they are there.
That is the complete list. Legawyl sets no analytics cookie, no advertising cookie, and no third-party cookie of any kind.
3.2 Browser storage (not cookies)
| Key | Purpose | Consent needed? |
|---|---|---|
| legawyl.anonymous-will | Your in-progress will, when you use Legawyl without an account (section 2.5) | Strictly necessary for the feature you asked for |
| legawyl.analytics-opt-out | Remembers that you said no to analytics | Strictly necessary. It exists to protect your choice |
| ph_* | Analytics device identifier | Yes. Written only after you accept |
We do not load fonts, scripts, or images from third-party servers, so simply visiting Legawyl does not reveal your IP address to anyone but us and our host.
4. Why we are allowed to process your data (GDPR Article 6)
| What we do | Our legal basis |
|---|---|
| Create your account; store, encrypt and version your will; generate your document | Performance of a contract with you (Art. 6(1)(b)) |
| Send you account emails (activation, account changes) | Performance of a contract |
| Store the health-adjacent and belief-adjacent answers in section 2.3 | Your explicit consent (Art. 9(2)(a)) |
| Product analytics | Your consent (Art. 6(1)(a)), withdrawable at any time |
| Keep the Service secure, prevent abuse, take backups | Our legitimate interests (Art. 6(1)(f)) in operating a safe service, limited to what security actually requires |
| Record the charitable gifts in a generated Will, so we can report anonymous totals to the organizations named (section 2.9) | Our legitimate interests (Art. 6(1)(f)) in operating the service that keeps Legawyl free, limited to the gift facts and never extending to telling anyone who you are |
| Keep you on the attorney waitlist, and record any answers you give to its optional questions (section 2.8) | Your consent (Art. 6(1)(a)), withdrawable at any time by emailing us |
| Respond to a legal obligation | Legal obligation (Art. 6(1)(c)) |
5. Who else sees your data
We use a small number of providers. Every one of them is named here. There are no others.
| Provider | Role | What it receives |
|---|---|---|
| Hetzner (EU) | Hosting: the server and database | Everything, as our host |
| Mailjet | Sends account and activation emails | Your email address and name. Nothing from your will |
| Zoho Mail (EU) | Hosts our support@legawyl.com mailbox, where support, privacy and security messages arrive | Whatever you choose to put in an email to us. Please don’t paste the contents of your will into a support message. You never need to, and email is far less protected than the encrypted copy we hold |
| PostHog (EU region) | Product analytics, only with your consent | Pseudonymous events (section 2.6). Never your name, your email, or any will content |
| “Sign in with Google”, if you choose it; and Google Drive stores our database backups | The fact that you signed in; and backup files that are encrypted before they leave our server. Google only ever holds ciphertext it cannot read | |
| healthchecks.io | Tells us if the nightly backup failed | A timestamp. Literally nothing else |
We will update this table if it ever changes.
We do not sell your personal data. We do not share it for advertising. We never will. This is not a hedged statement. Legawyl contains no advertising technology of any kind.
We will disclose data only where we are legally compelled to (a valid court order or legal obligation), or where it is genuinely necessary to protect someone’s safety. If we are compelled, we will tell you unless we are prohibited from doing so.
If Legawyl is ever reorganised into a company, or acquired, your data may transfer as part of that, but only to a successor bound by a privacy policy at least as protective as this one. We will tell you before it happens.
6. Where your data lives
Our servers, our database, and our analytics provider are all in the European Union.
Your data does not leave the EU in readable form. Backups are encrypted before they are uploaded, so although they are stored on Google Drive, what is stored there is ciphertext that Google cannot read.
If you are in the United States, this means your data is processed in Europe, under European law. That is deliberate.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and all will versions, including archived ones | Until you delete your account. Version history is a feature: your earlier wills are kept so that you can look back at them |
| Registrations that are never activated | Deleted after 30 days, automatically: email, name, password hash and activation token together. An abandoned sign-up does not linger |
| Activation tokens for accounts that were activated | Kept until you delete your account |
| Password-reset tokens | Expire after 1 hour and can be used once. Stored only as a cryptographic hash, never the token itself. Removed when used, when replaced by a newer request, and by a daily cleanup |
| Charitable gift records (section 2.9) | Until you delete your account. Each version of your Will keeps its own record, so they follow the same history as the Will itself |
| Attorney waitlist entries and their optional answers | Until you ask us to remove them, or until we decide not to build attorney tools at all, whichever comes first. There is no self-service delete for this list yet, so email us and we will do it |
| Encrypted backups | 30-day rolling window. When you delete something, it leaves our backups within 30 days |
| Analytics | Up to 12 months |
| Sign-in session | 24 hours |
| Server logs | Rotate with deployments; not retained long-term |
We do not delete accounts for inactivity. A will is meant to sit untouched for years. We will not take yours away because you did not log in.
8. Your rights
Under the GDPR you have the right to:
- Know and access what we hold about you;
- Correct anything inaccurate. Your name and your will are editable in the app at any time; to change the email address on your account, email us and we will do it for you;
- Delete everything. You can do this yourself, immediately, from your account settings. It is a permanent hard deletion, not a flag on a row. There is no undo;
- Receive a copy of your data in a portable, machine-readable format. Email us and we will send it to you;
- Withdraw consent to analytics, or to the Article 9 data in section 2.3, at any time;
- Object to or restrict processing based on our legitimate interests;
- Complain to a supervisory authority. Ours is UODO (uodo.gov.pl), and if you live in the EU you may also complain to your own national authority.
To exercise any right, email support@legawyl.com. We will respond within 30 days. We will never charge you for this, and we will never make you justify yourself.
9. Security
What we actually do:
- In transit: everything runs over HTTPS.
- At rest: the contents of your will are encrypted with AES-256-GCM. What sits on the disk is ciphertext.
- Passwords: hashed with bcrypt. We could not tell you your password if we wanted to.
- Backups: encrypted before leaving our server, so our backup storage provider holds only ciphertext.
- No third-party assets: no external fonts, scripts, or pixels load in your browser.
- Analytics safety: enforced in code by a build-time allowlist, not by good intentions.
What we do not claim: we hold no SOC 2, ISO 27001, or any other security certification, and we do not have a security team. We would rather tell you exactly what we do than imply an audit we have never had. Several of our competitors advertise certifications; we do not have one, so we do not say we do.
No system is perfectly secure. If we ever suffer a breach affecting your personal data, we will notify the supervisory authority within 72 hours, as the GDPR requires, and we will tell you without undue delay where there is a risk to you. Plainly, quickly, and without spin.
Found a vulnerability? Email support@legawyl.com. Report it in good faith and we will not pursue you for it.
10. Children
You must be 18 or over to use Legawyl, and the Service is not directed at children.
But note the distinction, because it matters. While our usersare adults, wills routinely contain information about minors: your children’s names, and who should be their guardian. We process that data because you, their parent or guardian, provided it in order to protect them. It is encrypted with the rest of your will, is never disclosed to anyone, and is deleted when you delete your account.
11. Changes to this policy
If we change this policy we will update the date and version at the top. If a change materially affects your rights, we will tell you before it takes effect, not after, either by email or by a clear notice in the app.
12. Contact
Support, privacy and security all reach us at the same place: support@legawyl.com. See also our Terms of Service, which explain what Legawyl is, and, importantly, what it is not.