WhatIf Privacy Policy

Last updated: October 31, 2026 · Version 2026-10-31

Contents

1. Who we are
2. How encryption affects your privacy
3. What we collect and why
4. If someone added you to their vault
5. What stays on your device
6. Legal bases (EU, UK, Thailand and similar laws)
7. Who we share information with
8. What we don't do
9. How long we keep information
10. Closing your account
11. Your rights
12. Children and teenagers
13. When someone dies or can't be reached
14. International transfers
15. How we protect information
16. If there is a data breach
17. Changes to this policy
18. Contact us

1. Who we are

WhatIf (whatif.easynow.life, formerly called InCase) is an easynow.life product run by Synergy Services, LLC, a Wyoming limited liability company, 1623 Central Avenue, Suite 18, Cheyenne, WY 82001, USA ("WhatIf", "we", "us").

For data protection laws such as the EU and UK GDPR and Thailand's Personal Data Protection Act (PDPA), Synergy Services, LLC is the controller of the personal information described in this policy.

Contact: whatif@easynow.life handles privacy questions and requests.

Our servers and main service providers are in the United States. The people who run WhatIf work from the United States and Thailand (see section 14).

This policy covers the WhatIf website, the web app (including when installed on your device), the Partner Program at /partners/, and the emails we send. It does not cover other sites you visit from WhatIf, such as block explorers or YouTube.

2. How encryption affects your privacy

When you save an item, a document or a video message link, your device encrypts it first. We store only the encrypted version. The keys are made and kept on your devices and on the devices of the people you share with. To unlock your vault you use a passkey (such as Face ID, a fingerprint or Windows Hello), a passphrase, or your printed recovery code. We are designed never to receive any of these in a form we can use.

• We can't read, search, scan or analyze what's in your items or documents, because we don't have the keys. We can't hand them over in readable form to anyone, including law enforcement, family members or an estate.
• We can't reset your vault. If you lose all of your unlock methods (every passkey, your passphrase and your recovery code), your data can't be recovered by anyone, including us.
• WhatIf runs in your browser using code we send. If someone broke into our servers or the way we deliver our code, they could in principle send altered code that tries to capture what you unlock. We take steps against this (section 15), and we would treat it as a breach (section 16).
• Some information has to stay readable to us to run the service. Section 3 lists all of it.

3. What we collect and why

This table lists what WhatIf collects, why, and the legal basis (which matters if you are in the EU, the UK, Thailand or another place whose law requires one; see section 6). Section 9 says how long we keep each kind.

Where it comes from. Most of this comes from you. Information about people added to a vault comes from the vault owner. Billing status comes from Stripe. If a Partner referred you, we know which Partner's code you used.

Readable labels can reveal sensitive facts. The names and relationships you give people, and item categories and types, are readable to us. They could reveal something sensitive (for example a same-sex spouse, or that you hold disability insurance). Don't put sensitive details in a person's name or relationship, or in a vault's name. Put them inside items, where they are encrypted.

4. If someone added you to their vault

A WhatIf user can list you as someone who should get information now, or if something happens to them. We store only what they typed: your name, your email address and your relationship to them, plus technical settings (your access setting and waiting period). Anything they wrote about you inside items is encrypted, and we can't read it.

• How we use it: only to let you sign in and see what they chose to share with you, and to make any release letter for you work.
• Legal basis: legitimate interests: the owner's interest in planning for their family, and your likely interest in receiving what they leave you. Once you sign in, we also rely on our contract with you.
• Whether we contact you: if the owner chooses to invite you, we send one email saying someone has added you to a WhatIf vault. It does not name any item. Some owners choose not to invite people, or choose the "silent" setting so the person doesn't learn about the vault until they are given a release letter. In those cases we don't contact you, because that would defeat the purpose the owner chose. This public notice is how we tell you.
• Your rights: you can ask whether you are listed in any vault, ask for a copy of what we hold about you, and ask to be removed (see section 11.6).

If you are an owner adding people: make sure you are allowed to give us their details, and let people know you've added them unless you have chosen "silent". If a person is 13 to 17, you must be their parent or guardian or have their parent's or guardian's permission. Never add a child under 13 (see section 12).

5. What stays on your device

WhatIf has no advertising or analytics cookies. On your device it keeps only what it needs to work:

• The session cookie described in section 3.
• "Remember this device" keys (only if you turn this on): a copy of your vault key that the browser can use but can't export. It expires after 30 days and is deleted when you sign out.
• An offline copy for the installable app, so you can view your vault without a connection. Vault contents in it stay encrypted. Some account details in it are readable: your email address, your vault's name, the names, email addresses and relationships of people in your vault, and item categories. They are protected by your device's own security, not by WhatIf's encryption. The offline copy is cleared when you sign out or close your account.
• Small preferences: your answer to the crypto relay question for each explorer (deleted when you sign out); where to return after sign-in; a reminder to open your check-up; and a security fingerprint of each vault owner's signing key, used to detect tampering.
• A partner code from a referral link you followed, kept in your browser for up to 90 days so the Partner gets credit if you start a trial.

6. Legal bases (EU, UK, Thailand and similar laws)

• Contract: to provide WhatIf to you under our Terms: your account, your vault, sharing, reminders, billing and the Partner Program.
• Legitimate interests: to keep WhatIf secure and prevent abuse (sign-in records, logs, backups), to answer support emails, to run offers, to keep records of agreements, and to provide the service a vault owner asked for to the people they chose (section 4). We have weighed these interests against your rights. You can object (section 11).
• Consent: for the crypto relay. We ask before the first relayed scan for each explorer on each device. You can withdraw consent by signing out, which clears your answer, or by not scanning through WhatIf. Withdrawing doesn't affect lookups already made.
• Legal obligation: to handle privacy requests and respond to valid legal requests under laws that apply to us, and to keep records the law requires. Where a duty comes from U.S. law (such as tax law), we rely on legitimate interests for EU and UK purposes.
• Special categories of data. Vault contents may include special categories of data, such as health information, about you or others. We can't read them. To the extent that storing them counts as processing special-category data, we do it only because you deliberately chose to store that information with us for your family, and only to store and deliver it as you instruct.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

7. Who we share information with

We disclose personal information to the service providers below, to the people inside WhatIf described in this section, and where the law requires. Our service providers may use it only to provide their services to us, except where they act as independent controllers (noted below).

Service providers

Services your browser contacts directly

• Block explorers (eth.blockscout.com, base.blockscout.com, arbitrum.blockscout.com, polygon.blockscout.com, mempool.space, nxqscan.com): when you press Scan on a crypto item, your browser usually asks the explorer for the wallet's public balance. The explorer sees the wallet address and your IP address. If you agree to use our relay instead, the explorer sees our server's address rather than yours. If you open a wallet on an explorer's website, its privacy policy applies.
• YouTube (Google): only if a vault owner adds a video message. When the video is shown (to the owner while setting it up, or to the people it is shared with), the browser loads it from youtube-nocookie.com. YouTube receives that person's IP address, browser information and the fact that the request came from whatif.easynow.life. Google's privacy policy applies.

Other people inside WhatIf

• The vault owner sees the names, email addresses, relationships and access settings they entered for the people they added, whether each person has signed in, and release activity.
• People in a vault see the vault's name, the items shared with them, and their own entry. They don't see who else is in the vault.
• Partners: if you sign up with a Partner's code or link, that Partner sees a masked version of your email (for example "jo•••@gmail.com"), your plan status, sign-up date, trial-end and renewal dates, and the fees they earn from your payments. Partners never see anything in your vault.
• The public: a Partner's verified name or company is shown to anyone who uses their code or link.

Legal requests, safety and business changes

• We may disclose information if we believe in good faith that the law requires it, or to protect the rights, safety or property of our users, the public or us. Where the law allows, we will tell you first. We can only ever provide vault contents in encrypted form.
• If Synergy Services, LLC or WhatIf is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that deal. It stays subject to this policy, or we will tell you before a different policy applies.

8. What we don't do

• We don't sell or share your personal information. We have not sold or shared it, including for cross-context behavioral advertising, in the past 12 months, as "sell" and "share" are defined by the California Consumer Privacy Act. We don't sell or share the information of anyone under 16.
• No targeted advertising. We don't show ads, and we don't use your information to target ads elsewhere.
• No analytics or ad trackers in the website, the app or our emails. Our emails contain no tracking pixels or per-person tracking links.
• No AI training. We don't use any of your information to train AI models.
• No profiling of anyone, including teenagers.
• No marketing emails today. If we start sending them, we will ask first where the law requires, and each will have an unsubscribe link.

Because we don't sell or share personal information, there is nothing to opt out of. We still treat a Global Privacy Control (GPC) signal from your browser as a valid opt-out request.

9. How long we keep information

10. Closing your account

Anyone can close their account in Settings > Close your account.

• Vault owners: the vault and everything in it are deleted, billing is cancelled straight away, everyone you added loses access, and release letters stop working. If a family member pays for your vault's plan, their plan is cancelled too and we email them.
• People added to a vault: you are removed from every vault you belong to, your keys are deleted, and any plan you pay for is cancelled. You can also just leave one vault (Settings > Leave this vault).
• Unlock needed: if you set up vault keys, you must unlock to close your account. If you have lost every unlock method, email whatif@easynow.life. We will confirm that you control the account's email address, then close the account for you.

What happens to your information:

• It is deleted from our live database straight away. Copies in backups are overwritten within about 30 days. Sign-in records are deleted on their normal 90-day schedule.
• If you never started a plan or free trial, and never joined our Partner Program, we erase your account entirely, including your email address.
• If you ever started a plan or free trial (even one you cancelled before any charge), or joined our Partner Program, we keep a minimal billing record for 7 years: your email address, your subscription and payment history (including any trial), and your Terms acceptance log (including your automatic-renewal consent). We keep it for tax and accounting and for partner-fee records. It contains nothing from your vault.
• We can't delete copies outside our systems: exports and printouts, items someone already opened and saved, or the offline copy on another person's device until their app next updates. Stripe keeps its own payment records under its own privacy policy.

11. Your rights

11.1 Rights everyone has with us

Wherever you live, you can ask us to:

• Access the personal information we hold about you, and get a copy.
• Correct information that is wrong.
• Delete your information.
• Export your information in a portable format.
• Object to our use of your information based on legitimate interests, or restrict it while a concern is resolved.
• Withdraw consent where we rely on it (the crypto relay).

Some of these are limited by how WhatIf works or by law. For example, we keep the billing records described in section 10. We can't give you a readable copy of encrypted contents, because we can't read them, but you can make one yourself. We may hold back information that would reveal another person's information.

11.2 How to use your rights

• In the app: vault owners can download everything in readable form (Settings > Your data > Download everything) or print an emergency packet. This is decrypted on your device. Owners can correct anything in their vault, remove people and delete items at any time. Anyone can leave a vault or close their account (section 10).
• By email: write to whatif@easynow.life. Tell us what you'd like. We'll give you the readable information we hold about you (section 3) in a common format.
• Authorized agents (where your law allows) can make a request for you. We'll ask for proof of their authority and may need to confirm the request with you.

11.3 How we verify requests

We have no passwords or ID documents on file. So we verify a request by checking that you control the email address on the account, either by your signing in or by your replying to a message we send to that address. We won't act on a request we can't verify, and we won't ask for more information than we need. We use what you send for verification only for that purpose.

11.4 Response times

We aim to respond within 30 days. In all cases we respond within the time your law requires: one month under the GDPR and UK GDPR (extendable by two months for complex requests), 30 days under Thailand's PDPA, and 45 days under the CCPA and other U.S. state laws (extendable by 45 days where allowed). If we need more time, we'll tell you why.

11.5 No discrimination

We won't deny you service, charge you a different price, or give you a different quality of service because you used a privacy right.

11.6 If you are listed in someone else's vault

You don't need a WhatIf account to use these rights.

• If you ask whether you are listed in any vault, we will check by your email address and give you what we hold about you: the name, email address, relationship and access settings the owner entered. We will tell you who listed you, unless that would harm their rights (for example, where they deliberately chose to keep the vault private until a release). If we hold that back, we will tell you why.
• If you ask to be removed, we will remove your entry from that vault, which ends your access and any release letter for you. We will tell the vault owner that someone asked to be removed, without giving a reason.
• We can't see or change anything about you inside an owner's encrypted items. Only the owner can.

11.7 EU, EEA, UK and Switzerland

You have the rights in section 11.1 under the GDPR, UK GDPR or Swiss law, including the right to data portability and to object to processing based on legitimate interests. You can also complain to your local data protection authority (in the UK, the Information Commissioner's Office, ico.org.uk). We'd appreciate the chance to resolve your concern first.

11.8 California residents (CCPA/CPRA)

Where the California Consumer Privacy Act applies to us, this section is our notice to California residents.

Sources: you; the vault owner who added you; Stripe; and the Partner whose code you used. Purposes: those in section 3. Retention: section 9. Third parties: Partners see the limited information in section 7. We don't sell or share personal information.

Sensitive personal information. Your vault may contain information the law calls sensitive, such as account log-ins and passwords, financial account numbers, government ID numbers, health information, and information about your children. It is encrypted on your device before it reaches us, and we can't read it. We only store and deliver it so that you and the people you choose can use it, and we never use it to infer anything about you. We use a Partner's taxpayer ID only for tax reporting. We use and disclose sensitive personal information only for purposes the CCPA permits without offering a right to limit, so that right does not apply.

Your rights: to know what we collect, use and disclose; to delete; to correct; to opt out of sale or sharing (we don't do either); to limit use of sensitive personal information (see above); and not to be discriminated against for using these rights. Use them as described in section 11.2.

11.9 Other U.S. states

Where they apply to us, the consumer privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states give you similar rights: to access, correct, delete and get a portable copy of your personal data, and to opt out of sale, targeted advertising and profiling (we don't do any of these). If we decline your request, you can appeal by replying to our decision with the word "Appeal". We'll respond within the time your state's law requires. If you're unhappy with the result, you can contact your state attorney general.

11.10 Thailand

If you are in Thailand, you have the rights in Thailand's Personal Data Protection Act B.E. 2562 (PDPA): to be informed, to access and get a copy, to data portability, to object, to erasure, to restriction, to correction, and to withdraw consent. You can complain to the Office of the Personal Data Protection Committee (PDPC). Section 14 explains transfers of information out of Thailand.

12. Children and teenagers

• Vault owners (the people who create and pay for a vault) must be 18 or older.
• Teenagers aged 13 to 17 may be added to a family member's vault and sign in, but only if the owner is their parent or guardian or has their parent's or guardian's permission. The owner confirms this when adding them, and we record that confirmation. We collect from teenagers only what we collect from any person added to a vault (section 3). We don't sell or share their information, show them ads, or profile them. A parent or guardian can email us to review or delete a teenager's information.
• WhatIf is not for children under 13. Owners must not add a child under 13 as a person in their vault or let them sign in. We don't knowingly collect personal information from children under 13. If we learn that we have, we will delete their sign-in records and remove their entry (name, email address and relationship) from any vault, and tell the vault owner. If you believe a child under 13 has signed in or been added, email whatif@easynow.life.
• Information about children that a parent stores in their own vault (for example a birth certificate, or school or medical details) is inside encrypted items. We can't read it, and it is not collected from the child. The owner decides what to store and is responsible for doing so appropriately. If you want a child to receive something later, add them once they are old enough, using an email address they will control as an adult.

13. When someone dies or can't be reached

WhatIf is designed so the vault owner decides, in advance, who can see what:

• Items shared "Now" are visible to the chosen people whenever they sign in.
• Items shared "Just in case" stay sealed until that person signs in with their own email and asks to open them. The owner is emailed as soon as someone asks, before anything starts. If the owner set a waiting period, they can stop the release during it. After any waiting period, opening the items needs the release letter's password.
• WhatIf does not verify deaths or incapacity, and does not check whether the owner is alive.

The owner's own arrangements govern. We don't delete a vault, hand it over or change who is in it because someone tells us the owner has died, whether that is family, an executor or an attorney. We act on a valid court order that applies to us, but we can only provide information we can read, and vault contents only in encrypted form. On reasonable proof of death (such as a death certificate), we will stop the vault's billing. After that, the vault becomes read-only for 6 months and then locks, and anyone in it can reactivate it in the app. Information about a deceased owner is otherwise kept and deleted as described in sections 9 and 10.

14. International transfers

Our servers and main service providers are in the United States. The people who run WhatIf work from the United States and Thailand. From both places they can access the information we can read (for example account emails, billing status and Partner details) to provide support and run the service. Nobody can read vault contents from anywhere. If you use WhatIf from outside the United States, your information will be transferred to, stored in and accessed from countries whose data protection laws may differ from yours.

• From the EU, EEA, UK and Switzerland: where a provider is certified under the EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss-U.S. framework), we rely on that. Otherwise we rely on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum, included in our data processing agreements with our providers.
• From Thailand: we rely on the exceptions in Section 28 of the PDPA where the transfer is needed to provide the service you asked for, and on the protections in our providers' agreements.

You can ask us for a copy of the relevant safeguards at whatif@easynow.life.

15. How we protect information

Our security page explains our approach in plain language. In summary:

• Items, documents and video links are encrypted on your device (AES-256-GCM, with a separate key for each item) before upload. Sharing uses a separate key for each person (RSA-3072). Items are signed (ECDSA P-256) so family members' devices can detect tampering.
• Signing in takes an emailed link (single use, valid 15 minutes). Opening the vault also needs your passkey, passphrase (protected with Argon2id) or recovery code, so someone who gets into your inbox still can't read your vault. Changes to a vault need proof that it is unlocked.
• The database keeps each family's data separate with row-level security. Connections are encrypted in transit (HTTPS with HSTS). The app uses a strict Content Security Policy that blocks scripts from other sites.
• We protect the accounts that control our code, hosting and email with two-step sign-in.
• Partner W-9 forms are kept in encrypted storage that only the people who handle Partner payments can open, not in our email inbox.

No system is perfectly secure. Because WhatIf runs in your browser, your protection also depends on the code we serve being genuine and on your device being secure. Keep your devices updated and locked, and keep your recovery code and release letters somewhere safe.

16. If there is a data breach

If we learn of a breach that affects personal information, we will investigate, take steps to contain it, and notify affected people and regulators as the law requires. For example, under the GDPR and UK GDPR we notify the regulator within 72 hours where required; Thailand's PDPA has a similar 72-hour rule; and U.S. state laws require notice to affected residents. We'll tell you what happened, what information was involved, and what you can do.

What a breach could expose depends on what happened. Someone who copied our database would get the readable information listed in section 3, plus vault contents only in encrypted form. Someone who took over our hosting or the way we deliver our code could try to change the app to capture contents when people next unlock their vaults. We would treat that as a breach and tell you about it as the law requires.

17. Changes to this policy

We'll post changes here and update the version and date at the top. When we publish a new version, we ask you to confirm that you have read it the next time you use WhatIf. If a change is significant, we'll also tell you by email before it takes effect. Where the law requires your consent, we'll ask for it. Earlier versions are available on request.

18. Contact us

Synergy Services, LLC (WhatIf, an easynow.life product)
1623 Central Avenue, Suite 18, Cheyenne, WY 82001, USA
Email: whatif@easynow.life