ToldForward Privacy Policy

Version 6. Effective 1 November 2026.

Last updated: 1 November 2026.

If someone designated you

Someone who uses ToldForward has designated you for a role for their record: as a designated recipient, who receives the record after their death, or as a designated trustee or backup designated trustee, who reports their death and never reads the record. They gave us your name, relationship to them, email, mobile phone and date of birth, and perhaps your home address. We use these only to invite you, to reach you about your role, and to check your identity when your access opens. We do not sell them, and we never send you marketing because someone designated you. You can decline the invitation at any time, and you can ask us what we hold about you. Section 3.4 has the details, and section 12.1 explains what we can and cannot tell you about someone else’s record.

If you are only mentioned in someone’s record or family tree, you have no role, no account and no right to the record because of it. Sections 3.5 and 3.6 explain what we hold.

If you help someone

A member has asked you to help them use ToldForward. You have your own account, with your own name, email, mobile phone, date of birth and sign-in. While your link lasts, you can see what you help the member with, and every request you make on their account is logged and summarized for them by email. We use your details only to run your account and the help you give, and to keep the member’s record safe. Section 3.4a has the details.

If you only visited our website

On our public pages, such as the home page, our information pages and our legal pages, we ask whether you accept analytics. Only if you accept does Google Analytics count your visits, using two cookies. It never runs on sign-in, your account or your record, and never when your browser sends Global Privacy Control (section 16). Cloudflare, which hosts our website, sees your IP address and browser, as every website host does. On the contact form, the wait list and the form for acting for someone (/act-for), and at sign-in after several wrong passwords, Cloudflare Turnstile checks that you are a person (section 7.3). If you use the contact form, we email your message to our support mailbox.

If you joined our wait list

We keep your email, and your name and state if you gave them, only to invite you to ToldForward. We never sell them or use them for marketing. If you do not confirm your place, we delete it after 48 hours; a confirmed place is kept for 365 days, or until we invite you. The link in our email takes you off the list at any time. Section 3.9 has the details.

1. Who we are

ToldForward is a service provided by D2X Enterprises LLC, 30 S 15th St Ste 1550 PMB 852931, Philadelphia, PA 19102, USA (“we”). We are responsible for the personal information described here. Contact us through https://toldforward.com/contact (choose “Privacy and my data”) or by mail at that address.

ToldForward is offered only in the United States. This is version 6, written for our soft launch, when membership is by invitation only. Where something here is temporary until our public launch, we say so.

2. The short version

• Your record is private to you while you are living. It is never public or searchable. If you choose a helper, they can see what they help you with. A few staff can reach it in an emergency, and every such access is logged.
• Text only. We never receive your voice or your image, except a live video call you ask for to recover your account, which we never record and never use for face matching. If you would rather speak, your own device’s dictation turns your words into text before anything reaches us.
• We never sell your information and never use your record for advertising. We email you news and offers only if you ask for them, and you can stop them at any time (section 5.2).
• No AI training on your record unless you separately opt in. We never use personal information to train large language models, except a member’s own record under that separate, standalone opt-in.
• Only the people you designate receive your record, and a library or archive if you choose a Historical Deposit. Your own direction, which you can withdraw and give again, tells us never to give it, or a catalogue of it, to an executor, agent, guardian or other fiduciary unless a court orders it (section 7.5).
• Hosted on Cloudflare, stored in the United States. Cloudflare runs ToldForward, and its network carries every request, worldwide. Your record, and the database and files that hold it, are stored, encrypted, in the United States; encrypted backup copies also go to our Google Drive (section 8). Our email, payment and marketing email providers may process your name and email address elsewhere, never what your record says.
• Analytics only if you accept, on our public pages only. Google Analytics counts visits to the pages anyone can read, only after you accept it in our cookie banner. It never runs on sign-in, your account or your record, and never when your browser sends Global Privacy Control (section 16).
• After your death, your designees receive your whole record, no sooner than 6 months after your death is confirmed.
• You can export or delete your record at any time while you are living.
• We run ToldForward and hold the records ourselves. There is no custodian. If the service ever ends, every record is released early, and never sold (section 9.1).

3. What we collect

3.1 Every account

• Account details: first and last name, email, mobile phone, language, full date of birth, and, for members, full postal address. Your address is encrypted; the state in it at sign-up is your state of residence, which we keep as it was even if you move.
• Sign-in details: a fingerprint (hash) of your password, never the password itself, your passkeys’ public keys and labels, an authenticator secret (encrypted), sign-in sessions, and verification codes (stored only as a fingerprint).
• Invitations to sign up: if we invited you, your email, the name we entered, when we sent the invitation and when you used it. The code itself is stored only as a fingerprint.
• Consents and agreements: which version you agreed to, a fingerprint of the exact text where we hold it, when, from which IP address and browser, and whether you withdrew it: your acceptance of the Terms of Service (which include the Acceptable Use Policy) and of this Privacy Policy, which everyone gives when they create an account; your consent to sensitive information; your direction on who may receive your record; automatic renewal; training; biometric; news and offers by email, if you choose them (section 5.2); and agreements you sign, with your typed name.
• Account changes: what we showed you and what you acknowledged when you started, changed or cancelled a membership or an add-on.
• Billing: your membership and add-ons, their status, trial and renewal dates, the notices we sent, and cancellations. Card details go to Stripe, not to us.
• Technical data: the service writes one line about each request: the path asked for, with private links and anything after a ? hidden, the method, the time and the result. It never holds what you sent or your IP address, and these lines are not stored. Cloudflare keeps a log of the requests to our website for at most 7 days. We count requests from each IP address, in our database, to limit abuse.
• Messages we send you: that we sent an email or text, and its type, but never anything from your record. If you agreed to news and offers by email, our email marketing provider also holds your email address and whether you have unsubscribed (section 5.2).

3.2 Every member’s record

• Your answers and writing, with the question, the date you first wrote it and the date of each edit. Encrypted.
• Earlier versions. When you edit an answer, we keep your earlier wording as a dated version. It is part of your record, is included in your exports, and is received by the people you designated. To remove words for good, delete the entry.
• Your family tree: the relatives you add (names, relationship to you, birth and death dates, and notes, with names and notes encrypted), and invitations you send relatives to connect their own tree (their email).
• Your “About you” answers: the optional questions after sign-up: the name you would like your record to use, where you were born and grew up, your gender (optional, like every answer here), marriages and partners, children and grandchildren, retirement, and military service. Encrypted, private to you, never part of the record handed over, and used only to choose which questions to show you.
• The people you designate (section 3.4), and your settings for them: your waiting period, which is the same for all of them, guide retirement, and whether they may share their copy privately.
• Questions you skipped, so you can return to them.

3.3 Archive Membership, in addition

• The search index the guide uses: sealed (encrypted) passages, embeddings, names, places and periods, built from your entries. It is rebuilt when models change. Record Membership’s record is never indexed.
• Your identity check result, once the identity check opens: pass or fail, whether your name and date of birth matched, and when. Not the images (section 13.2).
• Your signed Participant Agreement (section 3.1).
• Your training choice.
• Preview conversations with the guide, encrypted.
• Your Historical Deposit choice and deed of gift, if you make one, and when we offered it to you and your answer.

3.4 People a member designates (designated recipients and designated trustees)

This section is for the people a member chose for a role: designated recipients (“designees”), designated trustees and backup designated trustees. Being mentioned in a record is not a designation (section 3.6).

• From the member: your first and last name, relationship to them, email, mobile phone, date of birth, and optionally your home address.
• From you, if you accept: your own ToldForward account (section 3.1), the version of the Access Terms you accepted, your typed name, and when.
• After the member’s death: your identity check result when your access opens (section 13.2), the day you choose to begin, your orientation, your Dialogue purchases, your Dialogue conversations (encrypted, kept 90 days), the hand-over package’s download and your confirmation that it is for you.
• If you are a trustee: any death report you file, with its documentation and your statement that it is true (section 3.7).
• If you decline: that you declined, which the member can see, with the details the member gave us, until the member removes you or the record is deleted.
• If the member sealed your designation, we hold your details without telling you until after their death.

We use these details only to carry out the member’s instructions, to keep the guide and the record safe, and to reach you about them.

3.4a Helpers

• Your own account: your first and last name, email, mobile phone, language, date of birth and sign-in (section 3.1), and your acceptance of the Terms of Service and this Privacy Policy. You must be 18 or older.
• Your link to the member: who invited you, when you accepted, and when the link ended. The member can end it at any time; it ends when their death is confirmed.
• What you do: every request you make on the member’s account is logged as an access by a helper (who, when and what), answers added with your help are marked so, and the member receives a summary of your activity at their own email.
• Your identity check result, once the identity check opens (section 13.2).

While your link lasts you can see the parts of the member’s account you help with: the questions and their answers, their writing, their family tree and their “About you” answers. You cannot see or make the choices that are the member’s alone. Keep what you see to yourself (Acceptable Use Policy, section 11.2).

3.5 Relatives in a family tree

A member may add relatives, including living people and children, with their names, relationship, birth and death dates and notes. We keep this only for the member, privately, while they are living. The family tree is part of the record the member’s designees receive, and of a Historical Deposit if the member chose one. If you believe a member has added you, you can contact us (section 12.3); section 12.1 explains what we can and cannot do about another person’s record.

3.6 Other people mentioned in a record

Members’ stories naturally mention other people. Being mentioned in a record gives you no role, no account and no right to the record, and we do not contact you because of it. We do not extract, flag or index other people’s details separately for any purpose other than letting the guide find passages in that one record. The guide presents what a member said about others as their account, not as fact.

3.7 Death reports

The trustee’s report: date and place of death, a document that shows the death (a death certificate, or an obituary together with a letter from the funeral home), encrypted, and the trustee’s statement that what they report is true and the document genuine. We keep the documents until the hand-over to the member’s designees is done (section 11).

3.8 Contact form

Your name, email, topic and message, and Turnstile’s check (section 7.3). We email the message to our support mailbox; it is not stored in the ToldForward service itself. Our staff read it there to answer you. We keep it, with our replies, for 2 years after our last reply, then delete it. Please do not send sign-in codes, identity documents or anything from your record through the form.

3.9 The wait list

While sign-up is by invitation, anyone without an invitation can join our wait list.

• What we keep: your email, and, if you give them, your name (encrypted) and your state. When you join, Cloudflare Turnstile checks that you are a person, using your IP address and browser signals (section 7.3), and the service counts requests from your IP address to limit abuse (section 3.1, technical data).
• Why: only to invite you to ToldForward. Our staff see confirmed places on our management site and send invitations from it.
• How long: we email you a link to confirm your place. If you do not confirm it within 48 hours, we delete it. A confirmed place is kept until we invite you, or for 365 days, whichever comes first, and then deleted; you are welcome to join again.
• Leaving: the link in our email takes you off the list at once.
• Never sold, never marketing. We never sell your place on the list or use it for marketing, and joining does not sign you up for news and offers. Only the providers that send our email and run the bot check handle it for us (section 7.1).

4. What we never collect or keep

• Your voice, any audio or video of you, or a voiceprint. We never receive them: if you dictate, your own device turns your speech into text, and only the text reaches us. If you ask us to recover your account, we confirm who you are on a live video call (Terms of Service, section 15.2), which we never record and never use for face matching.
• Images or video of you, ID document images, selfies, or face templates. Your identity check provider handles these and deletes them (section 13.2).
• Translations of your record. They are made when someone reads, labeled, and never saved.
• Data from anyone but the member about the member’s own life. We do not accept uploads of other people’s writing.
• Your full card number.

5. How we use it

We never use your record for advertising, profiling or selling. We do not use your personal information for advertising either, except to send you news and offers by email if you asked for them (section 5.2). We never use what is in a record to choose what we send you.

5.1 The emails we send about your account and record

The service’s own emails come from toldforward.com, sent through Cloudflare Email Service (section 7.1): sign-in and verification codes, notices about your account, membership, billing and record, invitations, wait-list emails, receipts, and messages about a death report, a waiting period or a hand-over. They are part of the service, so you receive them while you have an account, whatever you choose about news and offers. They carry your name and email address, and sometimes the name of a member or of a person they designated, but they say only that something happened, never what a record says. Every one of them includes our postal address. They carry no advertising, with one exception: an invitation we send you to join ToldForward is itself an offer, so it also tells you how to ask us to stop sending invitations, and we send no more to your address once you ask.

5.2 News and offers by email (optional)

• Only if you agree. When you create an account, you can tick “Send me occasional news and offers from ToldForward by email”. It is unticked unless you tick it, and it is never a condition of anything. You can turn it on or off at any time in Settings.
• What we keep as evidence: the version of the wording you saw, when you agreed, your IP address and your browser, and when you withdrew. We keep this record while you receive these emails and for 3 years after you withdraw, to show what you agreed to.
• Who sends them. We have not started sending them yet. When we do, we will send them from e.toldforward.com, a separate address from the service’s own emails, through our email marketing provider, Brevo (section 7.1), and only to people who agreed. Brevo receives your email address, your first name and whether you have unsubscribed, and nothing from your record. We switch off Brevo’s tracking of when you open these emails and which links you click, so there is no open or click tracking.
• Never because of a role. We never send news and offers to anyone because a member designated them, and never to a person a member designated while the member’s waiting period runs.
• Stopping them. Use the unsubscribe link in any of these emails, or turn the choice off in Settings. Each email includes our postal address, and its unsubscribe link works for at least 30 days after we send it. We stop within 10 business days at most, and we never charge you or ask for anything but your email address to unsubscribe. Stopping them never stops the emails in section 5.1. After you unsubscribe, Brevo keeps your email address only on a do-not-send list, so that we do not email you again by mistake.

6. How we use AI

AI runs only on the record of an Archive member. Record Membership’s record is never indexed or sent to an AI model.

• The search index the guide uses is made from your entries by an open embedding model (BGE-M3) that Cloudflare runs for us on Workers AI. We send it the text of each passage, and each question asked of the guide, and store what it returns sealed (encrypted). Cloudflare’s terms say it does not use what Workers AI processes to train models, and does not keep it once the request is answered. They do not say where the model runs, which may be outside the United States.
• The guide (Preview and Dialogue) finds passages and composes answers about the member, quoting them exactly. It says it is an AI at the start of every conversation and every 3 hours. To compose and check an answer, it sends the question and the passages it found to its model. The same model checks each question, and what the guide is about to show, for signs of suicide or self-harm (Terms of Service, section 13.6).
• Display translation translates for reading, and is never saved.
• Reviewing documents: automated tools, AI among them, help us review proof of death sent to us. They read the document, compare its details with what we hold about the member, and flag anything that looks inconsistent or altered. These checks can miss a forgery and can flag a genuine document, so they never decide on their own: a member of our team reviews every proof of death and makes every decision to confirm a death, and reviews any other document that is disputed or unclear. They are sent only what each check needs. Identity checks are run only by our identity verification provider (section 13.2), never by these tools.

Which model, during the soft launch. Until our public launch, the guide and the document checks use Claude Haiku 5.5, a model made by Anthropic, PBC, through Anthropic’s API. Anthropic processes what we send only in the United States, does not use it to train its models, and keeps it only for the limited time its standard commercial data retention allows (as we write this, deleted within 30 days, unless kept longer to investigate a breach of its usage policies or because the law requires it). Before our public launch, we will replace Anthropic’s model with our own models, and we will update this policy, with where they run, before we do. We send only what each task needs. No model ever decides what someone may read: those rules run in our own software first.

Training. Your record is used to train models only if you opt in, separately from anything else, and that choice never changes your price. You can withdraw at any time in Settings. Withdrawal excludes your record from every later training run, and models already trained on it are retired when we next retrain. Only ToldForward’s own models are ever trained on a record; we never let a provider train on it. We never use personal information to train large language models, except a member’s own record under that separate, standalone training opt-in.

Profiling. We choose which questions to show a member from their age and their “About you” answers. That is automated, but it decides nothing about you beyond which question comes next: we do no profiling that produces legal or similarly significant effects.

7. Who receives your information

7.1 Service providers

They process information only for us, under contracts that limit them to that.

Not yet chosen. We do not send text messages yet, and the identity check is not open yet. Before either starts, we will name its provider here, with where it processes your information.

7.2 People you choose

The people you designate, when and as your instructions say (section 9). If you choose a Historical Deposit, the partner library or archive (section 10).

7.2a If the service ends: the wind-down escrow agent

Before our public launch, we will appoint an independent escrow agent for the wind-down (section 9.1). If ToldForward then ends while a record is still in its waiting period, the agent holds encrypted copies for the member’s designees and releases them when the waiting period would have ended. It will receive only what that release needs: the encrypted records, and the names and contact details of the people who receive them, may use them for nothing else. We will name it here, with where it processes them, once it is appointed.

7.3 Cloudflare Turnstile

To stop bots, we use Cloudflare Turnstile, in invisible mode, in four places: the contact form, the wait list, the form for someone acting for a member under a power of attorney or guardianship (/act-for), and sign-in, once several wrong passwords have been entered for the same email address. When one of these loads, your browser loads Turnstile from Cloudflare, which processes signals such as your IP address, TLS fingerprint, browser (User-Agent) and the site you are on to tell people from bots. When you send the form or sign in, the service sends Cloudflare the resulting token and your IP address to confirm the check. Cloudflare does not receive your name, email, password or message through Turnstile. For this check, Cloudflare processes the signals on our behalf; Cloudflare also uses them to improve Turnstile, as its own controller. Cloudflare’s use is described in the Cloudflare Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/ and Cloudflare’s Privacy Policy. To exercise your rights over the bot check, contact us.

7.4 Our staff

A small number of staff can use a separate, protected management site to review death reports, place legal holds and, in an emergency, read a record. It sits behind an access gateway, and staff sign in to it with a password, with an optional authenticator app and optional passkeys. Emergency access lasts at most an hour, alerts our security contact at once, logs every entry read, and is reviewed weekly. We do not give researchers access to records.

7.5 The law

We disclose information when the law compels us, such as a court order or a warrant, and only what it requires. A request from a member’s executor, personal representative, agent, guardian, conservator or trustee is answered under the member’s instructions and the law that binds us. The member’s instructions include their separate direction that their record, any part of it and any catalogue of it go only to the people they designate, never to a fiduciary without a court order (Who may receive your record). The digital-assets law of the state where the member lives decides how that direction ranks: most states give it priority over a will, trust or power of attorney; Delaware, Louisiana and Massachusetts may not (Terms sections 10.9 to 10.12). We may ask for a court order first. We tell the person concerned unless the law forbids it or it would put someone in danger. A legal hold can stop a deletion while it lasts.

7.6 Business transfers

We run ToldForward and hold the records ourselves; there is no custodian. We never sell personal information. If ToldForward is merged, sold, or goes through bankruptcy, personal information and records may pass only to a successor that continues the service under this Privacy Policy and every member’s instructions for their record. If there is no such successor, we release records as section 9.1 says and delete the rest; we do not sell them. If we later move the records to a custodian, the same condition applies, and we will tell you at least 90 days before.

7.7 Never

We never sell your personal information, never share it for cross-context behavioral advertising, and never give it to data brokers. Our analytics does not change this (section 16).

8. Where it is processed

ToldForward is offered only in the United States. Cloudflare, Inc. hosts and runs all of it: our website, the service, our management site and our backups. This is where your information goes:

• Stored in the United States. Our database, the files we store and the encrypted safety copies of deleted records are kept in Cloudflare’s United States jurisdiction, which keeps them stored in the United States. We encrypt record text, names and other personal fields ourselves before they are stored.
• Processed on Cloudflare’s network, worldwide. Every request to our website and the service, and every answer, passes through Cloudflare’s network. Cloudflare decrypts each one at its data center nearest the person using the site, which may be outside the United States, and the service runs there to answer it, opening only what that answer needs, in memory. Our scheduled work, such as building the search index, runs on Cloudflare’s network too.
• The search index. Workers AI, which makes it, may run outside the United States (section 6).
• Exports. Export packages and hand-over copies are put together and encrypted in a Cloudflare Container that has no internet access and keeps nothing. Cloudflare chooses where it runs. The finished package is stored in the United States.
• Backups. Every night we copy our database and files and encrypt the copy, with a key that neither Cloudflare nor Google holds, before we store it: for 7 days in Cloudflare’s United States jurisdiction, and the two newest copies in our own Google Drive, wherever Google keeps Drive files, in case we lose our Cloudflare account. The database also keeps its own history for 30 days. Deleted data leaves every backup, copy and history within 30 days.
• Email. Cloudflare Email Service, which sends the service’s own emails and contact-form messages, may process them outside the United States. These emails carry names and email addresses, never what a record says. Our support mailbox is kept by its provider under its own terms.
• Payments. Stripe processes payments under its own terms, which may include processing outside the United States.
• Marketing email. Brevo, which sends news and offers by email only to people who agreed, stores their email address and first name in France and Belgium (section 5.2).
• The bot check. Turnstile, on the contact form, the wait list, the form for acting for someone and sign-in, runs on Cloudflare’s global network (section 7.3).
• Analytics. Google Analytics, on our public pages only and only if you accept it, sends Google what section 16 lists. Google may process it outside the United States.
• The guide’s model. Anthropic processes what the guide sends it only in the United States (section 6).

A partner library or archive (section 10) is in the United States. We will say where the wind-down escrow agent processes information when we name it (section 7.2a).

9. After a member’s death

• A trustee reports the death, with a document that shows it and a statement that the report is true. We email the member, and text them once we send text messages, a link to stop the report, wait 7 days, and we review the documentation.
• When confirmed, the record is frozen exactly as the member left it and billing stops; nothing is released until the waiting period ends.
• The member’s own privacy rights end at death (export and deletion are personal), and their instructions take over.
• No one receives the record or uses the guide until at least 6 months after confirmation (never counted from the date of death on the documents), or longer if the member chose. No one can shorten this, including our staff.
• Hand-over: each of the member’s designees receives their own encrypted copy of the whole record, after a recent sign-in, a one-time code sent at the moment of download and an identity check, with the passphrase sent separately. The trustee receives none. Each copy holds every dated version, the family tree, the member’s wishes (including the names and relationships of the others they designated, and whether they may share their copy privately), and a README. Contact details of the people designated are never included. Designees’ own conversations with the guide are never included.
• If no designee accepts the record within 90 days of our notice, our staff open a case and keep trying to reach them, recording every attempt. The record never goes to anyone the member did not designate: only when staff are certain that no designee can receive it is it deleted, by a final action an administrator approves. We keep an encrypted safety copy for 1 year, and a permanent record of every step. A Historical Deposit the member chose is made first.
• Under Record Membership, we keep the record until every designee has downloaded their copy, or until 1 year after their access opens, whichever comes first, and then delete it by final action.
• Under Archive Membership, designees may use the guide on the member’s remaining paid Archive time, and then continue it by paying for Dialogue. Their questions, the guide’s answers and the passages it cites are kept encrypted for 90 days, then deleted; they are never exported, and are deleted with the record.
• When the record leaves the service, we delete it by final action, with the safety copy kept for 1 year and then deleted, and issue a signed deletion certificate.
• The member’s instructions in the service are what we follow, including their direction that only the people they designate receive the record (Who may receive your record). A will or other direction that conflicts with them is resolved under the law that binds us, and executors, heirs and courts have legal powers we must respect (Terms sections 10.9 to 10.12).

9.1 If ToldForward ends

We release every record early, electronically (Terms section 16.4): a living member’s record, or one whose reported death is not confirmed, goes to the member alone; after a confirmed death, it goes to each of the member’s designees, and copies still in their waiting period are held in escrow until it would have ended. The guide ends with the service. We have a written wind-down plan, and our founder is personally responsible for it; before our public launch, an independent escrow agent will hold the money and tools for it (section 7.2a). When every release is done, we delete what we hold, except what the law requires us to keep.

10. Historical Deposit

A Historical Deposit is optional, never the default, and chosen by the member while living, by a separate signed deed of gift. If a member chose it, when their record leaves ToldForward after their death, we submit the same whole record to one partner library or archive for their state of residence at sign-up, with the deed of gift.

• What the partner receives: the whole record, including the family tree and what the member said about other people, the member’s wishes (including the names and relationships of the people they designated, but not their contact details), and the deed of gift.
• From submission, the partner holds it under its own policies, including how long it is kept, who may read it and when, and its own review of details about people still living. The member’s wishes, stated in the deed, go with the record as requests under the partner’s own policies; we run no seals and do not enforce them. If you are designated by a member, or mentioned in their record, the partner’s policies, not ours, govern that copy.
• We then delete our copy, and record that the deposit was made.
• Our partners. We show members the partner options for their state before they pay, and we list an institution as a partner only once it has signed a standing agreement with us.
• For now, the Historical Deposit is not offered to members whose state of residence is Florida, Virginia or Indiana.
• If the service ends before a member’s record leaves us, Terms section 16.5 applies.

11. How long we keep it

Our Data and deletion page sets out the same periods, with how to export and delete.

12. Your choices and rights

12.1 Everyone, in every state

Whether or not your state’s law requires it, you can, for your own personal information:

• see and export your record, and ask for a copy of the other personal information we hold about you, with a list of the third parties and service providers that received it, and how to contact them;
• correct your account details in Settings, and edit your record;
• delete single entries, your record, or your whole account, or ask us to delete other personal information we hold about you;
• withdraw your consent to sensitive information, training consent, your direction on who may receive your record, or a Historical Deposit choice while living;
• stop texts by replying STOP (we will still email important notices, such as a safety check), and stop news and offers by email at any time, with the unsubscribe link in any of them or in Settings (the emails about your account and record continue while you have an account, section 5.1);
• decline an invitation from a member, or step down from a role you accepted.

Your own information, not someone else’s record. These rights cover your own personal information. A member’s record, including what they wrote about other people, and their choice of the people they designate, are the member’s own, kept under their instructions. So we cannot let anyone see, correct or delete what is in someone else’s record, or tell anyone whether a member designated them. A member may seal a designation so that the person learns of it only after the member’s death, and a sealed designation stays private while the member lives. If you ask us about someone else’s record, or whether you are in one or designated for one, we answer in writing: we act on the personal information we hold about you outside any member’s record, such as your own account, your messages to us and our invitations to you; we tell you that we cannot disclose, correct or delete anything in another person’s record, or confirm whether you are in one or designated for one, and why; and we tell you how to appeal (section 12.3). If you have accepted a designation, you can always see it on your Designations page.

12.2 State privacy laws

Residents of states with comprehensive privacy laws (including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia; Oklahoma and Louisiana from 1 January 2027; Alabama from 1 May 2027; and Vermont from 1 January 2028) may have the right to know, access, correct, delete and port their personal information; to opt out of sale and targeted advertising (we do neither) and of profiling that produces legal or similarly significant effects (we do no such profiling, section 6); to limit the use of sensitive personal information (we use it only to provide the service you asked for, with your consent); and to appeal our decision. We honor these rights for everyone, for their own personal information as section 12.1 says, whether or not a law requires it of us.

We will not treat you differently for using your rights.

12.3 How to ask

Use the contact form (“Privacy and my data”) or write to us at the address in section 1. We verify requests by asking you to sign in, or, if you have no account, by confirming your email. An authorized agent may ask on your behalf with your signed permission. We answer within 45 days, and tell you if we need up to 45 more. When you ask us to delete your personal information, we delete it within 30 days of confirming who you are, except what the law requires us to keep (section 11), and it leaves our backups within 30 days after that. If we decline, you can appeal by replying; our founder reviews every appeal and answers within 45 days. If we still decline, we tell you how to complain to your state’s Attorney General, with a link to its complaint page.

12.4 Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control signal, our pages do not load Google Analytics at all, and do not ask you about it. We do not sell or share personal information for cross-context behavioral advertising, and we treat the signal as an opt-out of sale and sharing too. We do not respond to Do Not Track, which has no agreed meaning; Global Privacy Control and the choices in section 16 turn analytics off.

13. Sensitive information

13.1 Your record

Your answers and writing may reveal your health, including your reproductive or sexual health, religious or philosophical beliefs, sex life or sexual orientation, racial or ethnic origin, immigration status, or other sensitive information. We process it only to keep your record and run the features you chose, with your consent, which you give on its own page before you write anything. That consent has two required checkboxes: one to collect and keep it, and one to hand it to the people you designate after your death. It says what we do with it, who receives it and how to withdraw. It is encrypted. You can delete any of it at any time while you are living.

Withdrawing either part of that consent is as easy as giving it, in Settings. From then on we save nothing new, and we delete your answers, your writing, the notes in your family tree and your “About you” answers within 15 days, after first offering you a full copy to download.

Consumer health data (Washington, Nevada and similar laws). Some of what you write may be “consumer health data”. We collect it only as your record, with that consent; we use it only to keep your record, run the features you chose and deliver it as your instructions say; we share it only with the people you designate, a partner library or archive if you chose a Historical Deposit, the providers in section 7.1 that process it for us, and as the law requires; we never sell it; and you can see it, learn who received it, delete it and withdraw your consent as this section and section 12 say. Our Consumer Health Data Privacy Policy sets this out in full, as those laws ask.

13.2 Identity checks and biometric information

Preview and Archive Membership open without an identity check. Once our identity check opens, before each designee’s first access after a death (and, for a member who has a helper, before their answers are saved, and for the helper before they are linked), a person verifies their identity with a government ID and a live selfie. The check is done by our identity verification provider, which captures your ID image and your face to compare them. That comparison may use biometric identifiers (face geometry). Before the check we ask for your written consent.

• We receive only the result: pass or fail, whether your name and date of birth matched, the provider’s reference and the time. We never receive or keep the images or any face template.
• We tell the provider to delete everything it holds for the check as soon as it gives us the result, and in any case within the time the law allows (for Illinois, when the purpose is met or within 3 years of your last interaction, whichever is first).
• We never sell, lease, trade or profit from biometric information, and never disclose it except to the provider doing the check, or as the law requires.

This section is our written policy for biometric information under the Illinois Biometric Information Privacy Act, the Texas and Washington biometric laws, and Colorado’s biometric rules.

14. Children and teens

• ToldForward is for adults. Everyone who holds an account, and everyone a member designates, must be 18 or older.
• We do not knowingly collect personal information from a child under 13, or from anyone under 18 as an account holder. If we learn we have, we delete it. A parent who believes their child has given us information can contact us.
• A member may add children to their family tree, as part of their own record.

15. How we protect it

• Encryption in transit (TLS, HSTS) and at rest. Record text, conversations, authenticator secrets, your postal address, family tree names and notes, documents and exports are also encrypted field by field with keys we control.
• Backups are encrypted before they are stored, with a key that neither Cloudflare nor Google holds. Exports are put together in a Cloudflare Container with no internet access, which keeps nothing.
• Sign-in with a password, with an optional authenticator app and optional passkeys; never by text message.
• A rule layer decides who may read a record, before anything is retrieved. Every read of a record by anyone but its owner is logged, permanently, in a log no one can edit.
• Staff access as in section 7.4.
• We never write record content, messages or identity details into our logs.

No system is perfectly secure. If a breach affects your personal information, including your record’s content, we will tell you without unreasonable delay, and within 30 days, and tell regulators where the law requires, whether or not your state’s breach law covers that kind of information.

16. Our website, cookies and browser storage

• Google Analytics, only if you accept, on our public pages only. On the pages anyone can read without signing in (the home page, About, Offerings, our questions and answers, the page for people who were designated, our information, state and city pages, Accessibility, our crisis protocol, Contact and our legal pages), a banner asks whether you accept analytics, with “Reject all”, “Choose” and “Accept all”. Nothing from Google loads, and no analytics cookie is set, until you accept. If you accept, Google Analytics 4 counts visits and shows us which pages help people. It never runs on sign-in or sign-up, your account, your record, an invitation, a safety check, a download, or any other page.
• Your choice. “Essential” covers what the website itself needs and sets no cookies of ours; it is always on. “Analytics” stays off until you accept it. Your browser keeps your choice in its local storage, and it is never sent to us. You can change it at any time with “Cookie preferences” in our website’s footer, or by clearing your browser’s storage for toldforward.com, which brings the banner back.
• What Google receives: the page’s address, without anything after a ? or #; the address of the site that sent you, trimmed the same way; the page’s title; what you do on the page, such as scrolling or following a link; your browser, device, screen and language; and your IP address, which Google says it uses only to work out your approximate location, without storing it. Google Signals and ad personalization are off, so these visits are not tied to a Google account or used for advertising.
• Cookies. If you accept analytics, Google Analytics sets two cookies on toldforward.com: _ga, which tells one browser from another, and _ga_87NLVTP118, which keeps track of a visit. Each lasts up to 2 years unless you delete it. If you later reject analytics, Google Analytics stops loading and we delete its cookies for toldforward.com; you can also delete them in your browser. We set no other cookies.
• Google’s role. Google processes this data for us, as our service provider, under its terms for Google Analytics, and we do not let Google use it for its own products and services. We do not sell it, and we do not share it for cross-context behavioral advertising.
• Turning it off. Choose “Reject all”, or change your choice with “Cookie preferences”. If your browser sends Global Privacy Control, our pages load no analytics and show no banner. You can also block or delete cookies in your browser, or install Google’s opt-out add-on: https://tools.google.com/dlpage/gaoptout
• Our fonts are served with our website, never from a font service.
• When you sign in, your browser keeps your session token in its local storage, so you stay signed in. Signing out removes it.
• The demo pages keep example data in your browser’s session storage, which is cleared when you close the tab, and send nothing.
• Cloudflare Turnstile runs only on the contact form, the wait list, the form for acting for someone, and sign-in after several wrong passwords (section 7.3). Cloudflare’s own cookie use is described in its Cookie Policy and the Turnstile addendum.

17. Changes to this policy

We will tell you by email and on the website at least 30 days before a material change, and ask everyone with an account to read the new version. We will not use information we already hold in a new way without your consent, and a change made after a member’s death never changes what happens to their record. We will update this policy before our public launch, when we move to our own models.

18. State-specific notices

18.1 California

In the last 12 months we collected these categories, from you, from members who designated you, and from our providers. We do not sell or share any of them, and we keep each as section 11 says.

“Shine the Light”: we do not disclose personal information to third parties for their direct marketing.

18.2 Other states

• Nevada: we do not sell covered information. You may still send us a request not to, and we will confirm it.
• Washington, Nevada and other consumer health data laws: section 13.1 and our Consumer Health Data Privacy Policy.
• Illinois, Texas, Washington and Colorado biometric laws: section 13.2.
• Every other state: section 12 applies to you in full.

19. Contact

D2X Enterprises LLC, 30 S 15th St Ste 1550 PMB 852931, Philadelphia, PA 19102, USA. Privacy requests: https://toldforward.com/contact (“Privacy and my data”) or by mail.