Privacy Policy

Your Privacy is Our Priority

At LyfeStash, we understand that your digital legacy contains your most sensitive information. This Privacy Policy explains how NexoStack, Inc. ("we," "our," or "us") collects, uses, and protects your information when you use our LyfeStash service.

1. Information We Collect

Account Information

• Email address (for account creation and authentication)
• Full name (for account identification)
• Phone number (optional, for SMS notifications and additional security)
• Country and phone code (for localization and security)
• Payment information (processed securely by Stripe, never stored on our servers)

Legacy Data

• Digital records you choose to store (encrypted end-to-end before transmission)
• Grantee information (names and email addresses of trusted contacts)
• Access preferences (wait periods, sharing settings, circle protection preferences)
• Security questions (encrypted and used only for account recovery)
• RSA public keys (for secure record sharing with your trusted circle)

Technical Information

• IP address and approximate location (for security monitoring)
• Device information and browser type
• Login history and device fingerprints (for suspicious activity detection)
• Usage analytics (anonymized for service improvement)

2. How We Use Your Information

• Service Delivery: To provide and maintain the LyfeStash platform and facilitate secure record sharing
• Security: To authenticate users, detect fraud, and protect against unauthorized access
• Communication: To send important service updates, security notifications, and access request alerts
• SMS Notifications: To send text message alerts for access requests (only if you enable this feature)
• Support: To respond to your questions and provide customer support
• Improvement: To analyze usage patterns and improve our service (using anonymized data only)
• Compliance: To comply with legal obligations and enforce our Terms of Service

3. Zero-Knowledge Encryption Architecture

• Client-Side Encryption: Your master key is derived from your password and never leaves your device
• AES-256 Encryption: Industry-standard encryption protects your records at rest
• RSA-2048 Key Pairs: Secure sharing with your trusted circle using asymmetric encryption
• We Cannot Read Your Data: Not even LyfeStash employees can access your encrypted records
• Firebase Security: Data is stored on Google's secure Firebase infrastructure with TLS 1.3 in transit

Important: Because of our zero-knowledge architecture, if you lose your password and forget your security question answers, we cannot recover your data. Please store your credentials securely.

4. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. Due to our zero-knowledge encryption architecture, we cannot access your stored records (passwords, documents, etc.) — only you and the grantees you explicitly authorize can decrypt them.

What We Can Access (Unencrypted Metadata)

• Your account information (name, email, phone number)
• Grantee names and emails (who you've invited)
• Subscription status and billing history
• Login times, locations, and device information
• Record metadata (titles, categories, creation dates) — but NOT the actual content

What We CANNOT Access (End-to-End Encrypted)

• Your stored records (passwords, account numbers, documents, messages, etc.)
• Your master password or decryption keys
• File attachments and their contents
• Any sensitive data you store in record fields

Limited Data Sharing

We may share the metadata listed above (but never your encrypted records) only in these circumstances:

• With Your Grantees: When you explicitly grant access, your grantees receive encrypted records that only they can decrypt using their private keys. We facilitate the secure transfer but cannot see the content.
• Circle Protection: Your trusted circle members can see that an access request occurred (who requested, when) but cannot see your encrypted records unless you've shared them.
• Service Providers: With trusted third parties who help us operate our service (Stripe for payments, Twilio for SMS, Firebase for infrastructure) under strict confidentiality agreements. They only receive the minimum data needed (e.g., Stripe sees billing info, Twilio sees phone numbers for SMS).
• Legal Requirements: When required by law or court order, we can only provide unencrypted metadata. We cannot decrypt your records even if compelled to do so.
• Business Transfer: In the event of a merger or acquisition, account metadata may be transferred, but your encrypted records remain inaccessible without your keys.

5. Data Security Measures

• End-to-end encryption with zero-knowledge architecture
• AES-256 encryption for data at rest
• RSA-2048 key pairs for secure sharing
• Secure transmission using TLS 1.3
• Password hashing with PBKDF2 and unique salts
• Multi-tab persistent sessions with encrypted storage
• Failed login attempt tracking and account lockout protection
• New location login alerts via email
• Optional SMS notifications for critical events
• Regular security monitoring and updates
• Google Firebase infrastructure security

6. Your Rights

You have the right to:

• Access: View and download your personal information through your account settings
• Correct: Update inaccurate or incomplete information at any time
• Delete: Request account deletion, which will securely erase all your data
• Export: Download your encrypted records and account data
• Control Notifications: Opt out of non-essential communications and manage SMS preferences
• Revoke Access: Remove grantees and revoke shared record access at any time
• Data Portability: Take your data with you if you choose to leave

7. Data Retention

We retain your information for as long as your account is active or as needed to provide services. If you request account deletion:

• Your personal data and encrypted records will be permanently deleted within 30 days
• Backup copies will be securely erased within 90 days
• Some metadata may be retained for legal compliance (anonymized where possible)
• Payment history may be retained for accounting and tax purposes as required by law
• You will receive email confirmations at key stages of the deletion process

8. Cookies and Local Storage

We use minimal cookies and browser storage for essential functionality:

Browser Local Storage

• Session Management: To keep you logged in securely and maintain your encrypted session keys in memory
• Invitation Tokens: To temporarily store invitation links before account creation

Cookies (Essential Only)

• Language Preference: To remember your preferred language (stored for 1 year)
• Device Fingerprinting: To detect suspicious activity and new device logins for security monitoring (stored for 1 year)

We do NOT use cookies for:

• Marketing or advertising
• Tracking across websites
• Third-party analytics (we use anonymized Firebase Analytics only)
• Selling your data to third parties

You can control browser storage and cookies through your browser settings. However, disabling local storage will prevent you from using LyfeStash, as it's essential for secure session management. Disabling cookies will only affect language preferences and device recognition.

9. International Data Transfers

Your information may be transferred to and processed in the United States, where NexoStack, Inc. is headquartered. We use Google Firebase infrastructure, which provides global data centers with appropriate security safeguards. By using LyfeStash, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection laws.

10. Children's Privacy

LyfeStash is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately, and we will delete it.

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect and how we use it
• Right to request deletion of your personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, please contact us at privacy@lyfestash.com

12. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by email or through a prominent notice on our service at least 30 days before the changes take effect. Your continued use of LyfeStash after changes become effective constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us: