Privacy policy

• Account information: name, email, and login credentials.
• Vault contents: whatever you choose to store — wishes, debts, bequest instructions, spiritual records (missed zakat, fasts, Hajj badal) and other important information. This does not include account passwords: Isti’dad is designed for you to store how to retrieve access to other accounts, not the credentials themselves.
• Trustee information: contact details for the trustees you designate, so we can reach them as part of the verification process.
• Verification records: evidence submitted and confirmations exchanged when a claim about your passing is made.
• A phone number, only if you give one. Optional, asked once, and used for a single purpose: telephoning to check you are well after a long silence. We record your consent alongside it, and withdrawing that consent deletes the number.
• Activity: when you last opened the app, and when you last confirmed your records are current. This is what drives the check-in reminders.

We use your information only to:

• Operate your vault and keep it accessible to you while you are alive.
• Run the verification process that determines when and to whom your vault is released.
• Send you account notifications.
• Improve the security and reliability of the service.

Isti’dad is free and funded by volunteers, sponsors, and donors — we do not sell your data, and we never use vault contents for advertising.

Everything sensitive in your vault — names, amounts, notes, messages, wishes — is encrypted with AES-256-GCM before it is written to the database. Passwords are hashed. Everything travels over TLS. Somebody who obtained a copy of our database would get ciphertext.

Nobody at Isti’dad reads your vault. There is no screen anywhere in our tools — support, administration or otherwise — that shows the contents of a vault. Our administrative tools query counts and dates and are built so they cannot display an entry; that rule is written into the code, not only into this page.

• While you are alive: only you. Not your family, not the trustees you appoint, not our staff.
• Trustees are only ever contacted as part of the verification process described in our Terms of Service, and only receive the vault contents once that process has fully confirmed a release.
• After a confirmed release: vault contents are shared with the trustees, and through them the heirs and recipients you specified.
• Our staff can see your name, email address, when you were last active, how many entries each section of your vault holds, and — if you gave one and consented — your phone number. They cannot see the entries themselves.

On this public website we use Google Analytics to count visits, so we know which pages help and which confuse. It is off until you agree — nothing is stored on your device and nothing is sent until you accept the banner, and declining is a real answer that we remember.

Two things we do deliberately: we never send the query string of a page, because trustee invitation links carry an email address in the URL; and we redact identifiers from the path, so an invitation page is reported as /invitations/[id], never with the real id.

The mobile app measures one thing: how many people get from installing it to having a vault set up. That is where people give up, and knowing where is how we fix it. Nothing inside your vault is measured — not which sections you open, not how many entries you keep, not anything you do with your trustees. The automatic screen tracking that would have reported all of that is switched off in the build. You can turn the whole thing off in Settings.

Advertising signals are disabled permanently on both, not merely left unconsented.

Running Isti’dad means relying on a small number of established providers — for hosting the application and its database, delivering email, storing the files you upload, sending push notifications, and, on this website only and only with your consent, measuring visits. Each of them processes data strictly on our instructions and only so far as is needed to run the service. None of them is permitted to use it for their own purposes.

If you would like the current list by name, write to whatnextlegacyapp@gmail.com and we will send it.

After a vault is released to trustees, each trustee closes their access when they are done. It is deleted only once every trustee has closed it, and remains recoverable for 30 days after that.

Vault contents are kept for as long as your account is active, or until a release and the subsequent closure by every trustee.

When you delete your account, or when the last trustee closes a released vault, everything is marked for deletion and destroyed after 30 days. The window exists so a decision made in grief or by mistake can be undone. After it, we cannot recover any of it.

This is our current approach. As we grow, we will review our retention practices against the data protection laws of the countries our users live in, and update this policy accordingly.

While your account is active, you can:

• Access, update, or delete any information in your vault at any time.
• Export everything as a PDF, built on your own device so a printed copy never passes through us.
• Change your trustees.
• Withdraw consent to be telephoned, which deletes the number in the same action.
• Turn reminders, notifications and analytics off.
• Delete your account and everything in it, from the app or this website — or by writing to us.

Depending on where you live you may have further rights: access, portability, restriction, objection, and to complain to a supervisory authority. Write to whatnextlegacyapp@gmail.com.

Isti’dad is not intended for anyone under 18, and we do not knowingly collect data from minors.

We may update this Privacy Policy from time to time. We will notify you of material changes by email and in the app before they take effect.

Questions about this Privacy Policy or your data: whatnextlegacyapp@gmail.com