Afterword ("we," "us," or "the Platform") is a digital legacy platform based in Switzerland. We operate a zero-knowledge, encrypted digital legacy vault that allows users to store and schedule the posthumous delivery of personal messages.

This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the Swiss Federal Act on Data Protection (FADP / DSG) and, where applicable, the EU General Data Protection Regulation (GDPR).

By using the Afterword platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use our services.

The data controller responsible for the processing of your personal data is:

We process your personal data solely for the following purposes:

• Account Creation & Authentication: To verify your identity, provide secure passwordless login, and manage your session.
• Vault Operations: To store, encrypt, and manage your legacy content and recipient information.
• Pulse Check Protocol: To send periodic check-in notifications via email or SMS, confirming your continued activity.
• Message Delivery: To release your encrypted messages to designated recipients upon confirmation of your absence.
• Payment Processing: To process your one-time membership payment via our payment processor.
• Customer Support: To respond to inquiries and provide technical assistance.
• Service Communications: To send essential transactional emails (e.g., login codes, pulse check alerts, security notifications).

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use your data for profiling, automated decision-making, or advertising.

Under the Swiss FADP and, where applicable, the GDPR, we process your data based on:

• Performance of a Contract (Art. 6(1)(b) GDPR / Art. 31 FADP): Processing necessary to deliver the services you purchased.
• Consent (Art. 6(1)(a) GDPR / Art. 31 FADP): Where you voluntarily provide data or opt into specific features such as SMS-based pulse checks.
• Legitimate Interest (Art. 6(1)(f) GDPR / Art. 31 FADP): For security measures, fraud prevention, and platform integrity.

We employ a deliberate dual-region architecture to balance global accessibility with data sovereignty:

We engage the following third-party processors:

All processors are bound by data processing agreements in accordance with applicable data protection laws.

We use essential, first-party cookies strictly necessary for authentication and session management.

We also use Google Analytics 4 to measure website traffic and feature usage.

We do not use advertising cookies, behavioral tracking pixels, or cross-site tracking for marketing purposes.

Vault Content: Your encrypted legacy content is retained indefinitely until one of the following occurs: (a) you manually delete it, (b) you delete your account, or (c) the content is released to your designated recipients through the Silence Protocol.

Account Data: Account information is retained for the lifetime of your membership. If you choose to delete your account ("Wipe Vault"), all data is permanently and irrecoverably purged from our Swiss servers.

Payment Records: Transaction records are retained by Stripe in accordance with applicable financial regulations.

Under the Swiss FADP and, where applicable, the GDPR, you have the following rights:

• Right of Access: You may request information about what personal data we hold about you.
• Right of Rectification: You may update or correct your personal data through your account settings.
• Right of Deletion: You may permanently delete your account and all associated data at any time via the "Wipe Vault" function.
• Right to Data Portability: You may export your account data in a machine-readable format.
• Right to Object: You may object to specific processing activities by contacting us.
• Right to Lodge a Complaint: You may file a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

To exercise any of these rights, contact us at hello@afterword.ch.

Your vault media content remains within Swiss jurisdiction at all times via Exoscale. Account data is processed by Supabase on global infrastructure. Where personal data is transferred outside of Switzerland or the EEA, we ensure appropriate safeguards are in place.

We implement the following security measures:

• AES-256 encryption at rest for vault media content (stored on Exoscale, Switzerland)
• TLS encryption in transit for all communications
• Zero-knowledge architecture for vault media
• Row-Level Security (RLS) policies on all database tables
• Passwordless authentication via one-time codes
• Multi-factor authentication for keyholders
• MD5 checksum integrity verification for all stored media
• Swiss sovereign infrastructure for media content storage

Upon account creation, you are issued a unique Master Recovery Code. Under our zero-knowledge framework, we do not retain a readable copy of this code. It is your sole responsibility to store it securely and offline.

Afterword is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. Any material changes will be communicated via email. Continued use of the service constitutes acceptance of the updated policy.

For privacy-related inquiries, data requests, or complaints:

For general inquiries, visit our Contact page or email hello@afterword.ch. For the full legal agreement, please review our Terms of Service.