How WhatIf keeps your information safe

What we can't see

• Anything you type into an item: names, account and policy numbers, passwords, 2FA keys, notes, "how to claim" steps. (One exception you control: a crypto wallet address you choose to scan through us, explained below.)
• Your documents and your video message link.
• Your release letters' passwords. We never see or store them.

If our servers were hacked, or someone at WhatIf went looking, the contents of your vault would be only scrambled data. They could see the things listed under "What we can see". One honest caveat: this relies on the app code we deliver to your browser each time you open WhatIf. Someone who took over our hosting could change that code to capture what you type or unlock next. We guard against that (see "The honest trade-offs" below), but it's why we can't promise more.

What we can see

To run the service, we need a few things in readable form:

• Email addresses (yours and those of the people you add), so we can send sign-in links and invites.
• Your vault's name, the names you give the people in it, and their relationship to you.
• Each person's access setting ("Now", "Just in case" or "Just in case, silent") and the waiting period you chose for them.
• Which people each item is shared with, and whether it's "now" or "just in case". (Not what the item is: that stays locked.)
• Whether an item is hidden.
• When someone asks to open sealed items, when they're opened, and when a release was stopped.
• Sign-in records: the email, the internet (IP) address and the browser used, kept for 90 days to stop break-in attempts.
• Each item's category and type (for example "Insurance · Life"), its status, and the date you last checked it.
• How many items and documents you have, their sizes, and when they were changed.
• An item's expiry date, only if you set one, so we can remind you. The reminder email never says which item it is.
• A crypto wallet address, only if you press Scan on a network whose explorer won't answer your browser directly and you agree to let WhatIf ask for you. At that moment our server sees the address, the token (and its contract address, if you entered one), which account asked and its internet address. We don't store any of it. Your answer is remembered for that explorer on that device until you sign out. Every other scan goes straight from your device to the explorer.
• Your plan and billing status. Card details are handled by Stripe and never reach us.
• For partners: your partner details (name, contact and payout details, referrals and fees).
• The record of when you agreed to the Terms (and, for a plan, to automatic renewal), and which version.
• Anything you email us.

On your own device: the app saves an offline copy so you can view your vault without a connection. Item contents in it stay encrypted, and are decrypted only after you unlock with Face ID, fingerprint or passphrase. Once unlocked (or if you chose to keep that device unlocked), they're readable on that device. Some details in the offline copy, such as the names, emails and relationships of people in your vault and item categories, are readable on that device even while locked. Signing out clears it.

The full list, and how long each thing is kept, is in our Privacy Policy.

How your vault is locked

• Your email gets you to the door, not into the vault. Opening it also needs your Face ID, fingerprint or passphrase, so someone who gets into your inbox still can't read anything.
• Everyone has their own key. When you share an item, your device locks a copy for that person's key only. Nobody sees items you didn't share with them, and nobody sees who else is in your vault.
• You approve every key. Before anything is shared with someone, you approve them, and you can compare a safety code to make sure it's really them.
• Items are signed. Your device signs everything you save, so your family's devices can tell if anything was tampered with.

"Just in case" and release letters

• Items you seal "just in case" are locked with a release password that WhatIf generates and that you print as a letter for your attorney, your will, or a friend you trust.
• Opening them takes both that person's own sign-in and the letter. Neither works alone.
• When someone asks to open sealed items, you're emailed right away, before anything opens. If you chose a waiting period, you can stop it at any time during that period. With no waiting period, the items can be opened straight away.
• You can make a new letter at any time, and the old one stops working.

Importing from another app

• When you import a password manager export or a spreadsheet, the file is read and encrypted on your device, one item at a time. The readable file is never uploaded.
• That exported file itself isn't encrypted, so delete it (and empty your trash) once the import is done.

The honest trade-offs

• We can't reset your vault. You get a printed recovery code when you sign up. If you lose your devices, your passphrase and that code, nobody can open the vault, including us.
• Removing someone can't un-show what they already saw. If you remove a person, change any passwords you had shared with them.
• The app runs in your browser. Like every web app, it's only as safe as the code we send. We protect the accounts that control our code and hosting with two-factor sign-in.

If you stop paying, or if WhatIf goes away

• If payments stop, your vault stays open for your family, read-only, for 6 months. After that it's paused until anyone in it renews. Nothing is deleted automatically; only you can delete it, from Settings.
• You can download a readable copy of everything, or print an emergency packet, at any time. It's decrypted on your device, never on our servers, so you're never locked in.