Data and deletion
Version 6. Effective 1 November 2026.
Last updated: 1 November 2026.
This page explains how to export and delete your record, what happens when you close your account, and how long we keep each kind of data. It follows our Privacy Policy and Terms of Service, which say the same in full. Health information in a record is also covered by our Consumer Health Data Privacy Policy.
1. Exporting your record
While you are living, you can export your whole record at any time, from Settings. You receive one ZIP file holding:
- a searchable PDF/A book of every entry, by category and date, with your own writing last, then your family tree;
- a BagIt archive with each entry as its original UTF-8 text and JSON details, your family tree, your wishes, a plain-English README and checksums.
The download needs a recent sign-in, and its link works for 14 days. Your own export is not encrypted; keep it somewhere safe. An exported copy can never be brought back into ToldForward.
2. Deleting part of your record
You can delete any answer or piece of writing, or remove a person from your family tree, at any time while you are living. We ask you to confirm first. Deleting an entry removes it and every earlier version of it at once, for good. Editing an entry instead keeps your earlier wording, with its date, as part of your record.
3. Deleting your whole record
“Delete my record”, in Settings, deletes at once:
- every entry and every earlier version, and the search index built from them;
- your family tree;
- your conversations with the guide;
- the people you designated, and any death reports;
- your Historical Deposit, if you chose one: it is withdrawn, and its fee is not refunded, even in its first 14 days. Only withdrawing the deposit in Settings within 14 days of buying it refunds the fee, so do that first if you want the refund.
It also cancels everything that renews; time already paid for is not refunded. Your account stays open, and we confirm the deletion by email.
4. Withdrawing your consent to sensitive information
You can withdraw your consent to sensitive information in Settings, as easily as you gave it: either part of it, to keep it or to hand it to the people you designate after your death. From then on we save nothing new. Because anything you have written may be sensitive, we also delete your answers, your writing, the notes in your family tree and your “About you” answers within 15 days. Before you withdraw, we offer you a full copy to download. The people you designated would then receive only what is left, such as the names and dates in your family tree. You can agree again later, and start afresh.
5. Closing your account
“Close my account”, in Settings, deletes your record as in section 3, cancels everything that renews, steps you down from every record you are designated for and from helping anyone, and removes your name, contact details and sign-in methods. You can no longer sign in. We confirm it by email, at the address you had.
6. What we keep, and why
Some things outlast a deletion or a closed account, because the law or the protection of others needs them:
| What | Why | How long |
|---|---|---|
| That the account existed (its id only) | To link the records below | As long as they are kept |
| Payments and invoices | Tax and accounting | 7 years |
| What you agreed to and acknowledged: the version, a fingerprint of the text, the time, your IP address and browser | To show what you agreed to, if it is ever questioned | 7 years after the record leaves ToldForward, or after the account closes |
| The access log: who read a record, when and which entry, never the content | Accountability for every read of a record | Permanently |
| A do-not-send entry at our email marketing provider, if you had agreed to news and offers | So that we never email you again by mistake | Permanently |
We never keep your record’s content after you delete it.
7. Deletions you did not ask for
Apart from your own requests, no record is ever deleted automatically or without a final action: a member of our staff proposes it with the reason and the evidence, an administrator approves it, and every step is kept in a permanent audit trail. Before such a deletion, an encrypted safety copy is kept for 1 year, in case of a serious error, and then deleted. This is how a record is deleted after it leaves the service: after the hand-over, when no designee continues the guide, or when no designee can receive it. A Historical Deposit the member chose is made first.
We never delete a record because payments stopped. We keep it, visible only to our staff, to carry out what the member arranged for after their death, and we try to reach the member, and then their trustee, to understand why.
8. After a member’s death
A member’s own rights to export and delete end at their death; their instructions take over. Nothing can be added, changed or deleted once a death is confirmed. Each designee’s copy can be downloaded for 12 months after their access opens. A designee’s conversations with the guide are kept for 90 days. The proof of death is kept until the hand-over is done. The Terms of Service, section 10, and the Privacy Policy, section 9, explain the rest.
9. How long we keep each kind of data
| Data | Kept until |
|---|---|
| Unfinished sign-up | Expires after 24 hours |
| Verification codes | Expire after 15 minutes; stored only as a fingerprint |
| Sign-in sessions | End after 14 days unused, and always after 30 days |
| Sign-in events | 2 years |
| Request logs | Our service’s own log lines are not stored; Cloudflare keeps its log of requests to our website for at most 7 days |
| Google Analytics data (public pages only) | At Google, at most 14 months |
| Contact-form messages | 2 years after our last reply |
| A wait-list place you did not confirm | Deleted 48 hours after we email you the link |
| A confirmed wait-list place | Until we invite you, or 365 days, whichever comes first; deleted at once if you leave with the link in our email |
| An account with no membership | 2 years after your last sign-in, with notices 90, 30 and 7 days before |
| Your record while you are living | Until you delete it, or withdraw your consent to sensitive information |
| Your “About you” answers | Until you change or delete them, or as for your record |
| A lapsed membership’s record | Kept, visible only to staff, until the hand-over and anything prepaid is done |
| Identity check results | While the account exists |
| Billing records | 7 years |
| Death report documents | Until the hand-over is done |
| Designees’ conversations with the guide | 90 days |
| Export downloads | 14 days |
| A Record Membership record after hand-over | Until every designee has downloaded their copy, or 1 year after their access opens |
| Safety copy of a record deleted by final action | 1 year |
| Backups | Each nightly backup 7 days; the database’s own history 30 days. Deleted data leaves them within 30 days |
| Access log | Permanently, without content |
10. Questions
Write to us through https://toldforward.com/contact (choose “Privacy and my data”) or by mail to D2X Enterprises LLC, 30 S 15th St Ste 1550 PMB 852931, Philadelphia, PA 19102. We answer within 45 days. If you ask us to delete your personal information, we delete it within 30 days of confirming who you are, for everyone, wherever you live, except what section 6 says we keep; it then leaves our backups within 30 days. Privacy Policy section 12 explains your rights, how to appeal, and what we cannot do about another person’s record.