1. Introduction
Trust Relay Services (“we,” “us,” or “Trust Relay”) provides an estate-continuity platform that helps you store where your important institutions and accounts are held, add beneficiaries or trusted contacts, and leave instructions so the people you’ve chosen know who to contact when needed.
This Privacy Policy explains what information we collect, how we use it, what we share, and the choices you have. We’ve written it in plain language. If anything is unclear, we’d rather hear from you than have you guess.
2. Information we collect
Account information
- Your name
- Email address
- Phone number (optional)
- Login and account credentials for the Trust Relay Services account itself
Institution information
- Institution names
- Account categories (e.g., bank account, life insurance, retirement)
- Optional account identifiers, such as nicknames or last four digits
- Optional notes
Beneficiary and contact information
- Names
- Relationships to you
- Email addresses
- Phone numbers (optional)
- Preferred languages
Instructions and messages
- Guidance you provide for each beneficiary or contact
- Optional personal messages
- Institution-specific instructions
Support messages
- Messages you send our team through in-app support chat, and our replies to you
Connected activity (optional)
- If you choose to connect a ring or watch — a wearable activity tracker, such as an Oura ring — we receive and store a daily yes-or-no — whether your device recorded movement that day — together with the date and which provider it came from
- Connection details needed to keep that link working, such as the provider name, connection status, and encrypted access credentials
- A record of when you turned the feature on or off
- We never store your step counts, heart rate, sleep, workouts, location, or any other health measurement. With Apple Health, a daily yes-or-no with its date leaves your phone, with a note of whether it came from the phone itself, the app being open, or a watch; with Oura, our server reads the day’s activity summary to work out that yes-or-no and keeps the answer and its date, not the summary
AI features (optional)
- If you choose AI-assisted import, the notes you paste or the document you upload are used to prepare drafts for your review — we do not store what you pasted or uploaded, and nothing is saved to your account until you confirm it (see Section 12)
- If you turn on suggestions in “Help me get started,” the choices you make in that setup (including each person’s relationship to you and the language for their emails) and the names, “What should they know?” notes, and home details you type for its entries are used to choose follow-up questions and tips for you, and to suggest skipping a later topic — we keep no copy of what was sent, and nothing is saved to your account unless you save it (see Section 12)
- A record that an import or a suggestion ran — the date, size and count measures, and whether it succeeded — never the content itself
Billing information
- Your subscription status and purchase history
- Payments are handled by our payment processor; we receive limited billing details (such as your card’s brand and last four digits, and confirmation of payment), and we do not store your full card number
Information from people who contact us about you
- If someone reports a concern about your wellbeing through our service, we may collect their name, contact details, and what they tell us, so a person on our team can review it
Usage and technical information
- Login activity
- Device and browser information (including basic diagnostics if you use our mobile app)
- IP address
- Page interactions
- Account update history
4. How we use information
We use information to:
- Provide and maintain the service, including our website and mobile app
- Allow you to manage your institutions, beneficiaries, and instructions
- If you choose AI-assisted import, organize the notes or document you provide into drafts for your review
- If you turn on suggestions in “Help me get started,” choose follow-up questions and tips for you from the ones we wrote, and suggest skipping a later topic because of something you wrote
- Respond to your messages and provide customer support
- Send account notices and annual review reminders
- Support subscription and billing activity
- Conduct verification reviews
- Prepare and send beneficiary or contact notifications you have authorized
- If you’ve turned on Connected Activity, use the daily yes-or-no signal for one purpose only: to time your routine check-ins if you choose the Connected Activity check-in schedule — standing in for scheduled check-ins while your signal shows steady movement, and a quiet signal simply starts your normal check-in. The signal is never used to verify anything, notify anyone, or release anything
- Improve security and prevent misuse
- If you created an account but didn’t finish setting it up, send you at most two reminders that your unfinished setup is still saved — each with a one-click link to stop them
6. Beneficiary and contact notifications
Trust Relay Services may contact beneficiaries and designated contacts you have provided if your passing is reasonably verified through our review process and you have authorized us to do so.
When contacted, beneficiaries may receive:
- Institution names and categories you have stored
- The instructions you wrote in your own words
- Any optional personal messages you created for them
If you chose to store them, a beneficiary can also retrieve the account or reference numbers, notes, and documents you left for them — delivered securely through an identity-verified, one-time-code page, not in the notification email itself.
Trust Relay Services does not determine legal beneficiary status, and does not guarantee insurance claims, payouts, account access, or any other financial outcome. Legal beneficiary designations are governed by the underlying institution or applicable law.
7. Verification review process
Before any notification of your passing is sent, a reasonable verification review takes place. Depending on what is available, this review may include:
- Whether you answered your recent check-ins
- Direct outreach attempts to you through the contact methods you provided
- Consultation of publicly available information
- Confirmation by a backup or designated contact, where you have provided one and that feature is available to you
- Manual human review before any such notifications are sent
This is an operational review based on your non-response and human judgment — not a legal determination of death. We err strongly toward not contacting anyone unless the picture is unambiguous.
9. Information about other people
To use Trust Relay, you give us information about other people — your beneficiaries and contacts. By doing so, you confirm you have a reasonable basis to share their contact details with us for this purpose. We use that information only to provide the service: to help you build and keep your plan — including with the AI features in Section 12, if you choose them — and, when the time comes and you’ve authorized it, to reach them with the guidance you left. If you choose AI-assisted import, what you paste or upload about them is sent to our AI service provider to prepare drafts for your review. If you turn on suggestions in “Help me get started,” we send our AI service provider the relationship to you and the language for their emails that you chose for each person in that setup, but never the name, email address, or phone number you enter for them in “Your people”; a name you type in an entry, such as a person to call for help, is sent with that entry (see Section 12).
If you’ve been named as someone’s beneficiary or contact and would like to know what we hold or ask us to remove it, contact support@trustrelayservices.com. Because that information belongs to the account that created it, we may need to coordinate with that account holder.
10. Data security
We use reasonable administrative, technical, and organizational safeguards to protect your information, including:
- Encryption of data in transit (TLS) and at rest, with the most sensitive fields — account or reference numbers, notes, and your written guidance and messages — additionally encrypted at the field level with their own key, kept in the database’s secrets vault rather than alongside the data
- Sign-in verification is required for members on the website and in the iPhone app from version 1.0.8. After your password, we email you a 6-digit code and ask for it before you are signed in. On the website only, you can mark a browser you trust for 30 days so it doesn’t ask every time. Earlier versions of the iPhone app do not ask for the code
- Access controls on stored information, with restricted administrative access to sensitive records
- Audit logging of administrative actions and of access to released documents
- Verification recorded as notes and references only; we do not collect death certificates or other documents for it
No security program is perfect. We are committed to continuous improvement and to disclosing material incidents in line with applicable law.
11. Your choices and privacy rights
You may at any time:
- Update your account information
- Add, edit, or remove institutions
- Add, edit, or remove beneficiaries and contacts
- Update or revise instructions and personal messages
- Disconnect your ring or watch at any time, or remove Connected Activity entirely — which deletes the connection, its credentials, and every stored daily signal
- Cancel your subscription
- Request deletion of your information by emailing support@trustrelayservices.com, or delete your account from within our mobile app
Depending on where you live, you may also have the right to access the personal information we hold about you, to correct it, to delete it, to receive a copy of it, and to not be discriminated against for exercising these rights. We do not sell your personal information or share it for cross-context behavioral advertising.
To make a request, email support@trustrelayservices.com. We’ll verify your request against your account before acting on it, and you may use an authorized agent where the law allows. If we can’t honor a request, we’ll tell you why.
12. Automated decisions and AI
Decisions that matter — especially whether to release your guidance — are made by a person on our team, not by an algorithm. Trust Relay does not use artificial intelligence to make verification or release decisions, or to handle your support conversations.
Two features use AI, and only when you choose them. AI-assisted import lets you paste rough notes or upload a document instead of typing everything into forms. What you provide there is sent to our AI service provider, Anthropic, to be organized into drafts, which you review before anything is saved. AI can make mistakes, so every draft waits for your confirmation — and what you confirm is protected exactly like information you entered by hand.
Suggestions in “Help me get started,” if you turn them on, send Anthropic the choices you make in that setup, including each person’s relationship to you and the language for their emails, and what you type for its entries (such as an account, a home, or a person to call for help): each entry’s name and its “What should they know?” note, and for a home, every box you fill in. This includes entries you made in that setup before you turned suggestions on. It is sent so Anthropic can choose which of our own follow-up questions and tips to show you, and whether to suggest skipping a later topic because of something you wrote. We never send the names, email addresses, and phone numbers you enter in “Your people,” the account and policy number boxes, who you chose to receive an entry, your personal notes, or your wishes. Before anything is sent to Anthropic, we take out email addresses, phone numbers, and numbers with four or more digits, and we leave out a box entirely if it looks like it holds a password, PIN, Social Security number, card number, or similar secret, or if it is too long. Filtering can miss things, so a name or other detail you type in an entry may still be sent; please leave out anything you would not want shared. The AI only chooses among questions, tips, and suggestions we wrote; a suggestion to skip a topic shows the words of yours it is based on, but the AI does not write anything you read, and it does not save or change anything. You can turn suggestions off on any topic; that stops anything more from being sent, but it cannot recall what was already sent.
We do not store what you pasted or uploaded — it is processed and returned, and unsaved drafts live only in your browser, where they expire on their own. For suggestions, we keep no copy of what was sent; what you save in your setup is stored like your other entries. Anthropic does not use the content to train AI models, and under its standard policy deletes it within 30 days of receiving it — unless it must keep it longer to enforce its usage policy or to comply with the law. On our side we keep a record that an import or a suggestion ran — dates, counts, and status, tied to your account — never its content. We also keep your latest answer when we ask whether to turn on suggestions — yes or no, which version of the question you answered, and when — so we can honor a no and show you your choice if you ask.
AI assistance is optional; the regular forms, the simple-format import, and the questions in “Help me get started” always work without it. If we expand how we use AI, we’ll update this policy and explain the change before relying on AI for any decision that affects you.
13. Data retention
We retain information as long as needed to provide the service, comply with legal obligations, resolve disputes, enforce agreements, and maintain audit records related to verification and notification activity. When you delete your account in our mobile app, your account and its records are deleted at once, and the files you uploaded within a few days. When you ask us by email to delete your information, we do so within approximately 30 days. In every case, the records listed below under “What is kept after deletion” remain, each for the reason given.
When a membership ends. If you cancel, if a payment fails and is not resolved, or if you create an account but never start a membership, we delete the account and its records 30 days after the membership ends — or, for an account that never started one, 30 days after it was created. We email you a warning 7 days before. Signing in or answering a check-in starts the 30 days over, and resubscribing stops them. This does not happen while a verification review of your account is open, or once your information has been released to the people you named. After a failed payment, if you have not signed in or answered a check-in since, we keep the account and your check-ins continue.
The worksheet. If you ask for our free “Would they know?” worksheet, we keep your email address to send it and the three notes that follow, and delete it 90 days after the last one. If you create an account, that request is deleted at once. If you unsubscribe, we keep only a one-way fingerprint of the address, so we can never email it again.
Backups. We keep encrypted backups of our database and of uploaded documents for up to 90 days, so information that has been deleted can remain in a backup until that backup expires. Backups exist so the service can be restored after a failure, and they can be decrypted only with a key we keep offline.
What is kept after deletion. A few records outlive an account, each for the reason given:
- Payment records. Stripe, which handles payments on our website, and Apple, which handles purchases in the iPhone app, keep their own records of your transactions under their own legal obligations. We also keep your customer record at Stripe, with its invoices and payment history, because our billing, tax and refund records depend on it.
- Our operator audit log. When a person on our team acts on an account — for example, reviewing a case, issuing a refund, or deleting the account — we record who did what, and when. An entry can include the account’s email address. We keep this log for as long as we operate the service, because it is our proof that every action taken on an account was authorized.
- What you agreed to. Which versions of our Terms, billing terms and notices you accepted, when, and the email address you used at the time — and any arbitration opt-out you sent us — so we can show what was agreed and keep honoring an opt-out.
- That the deletion happened. When we delete an account, a record of when and why, without its contents.
- Reports about you. If someone reported a concern about you (Section 2), we keep their report — which names you — as part of our record of every concern we received and how we handled it.
- Email. Emails you exchanged with us, and the notices our system sends our team — for example, that a new account was created — stay in our support mailbox.
- AI usage records. A record that an AI-assisted import or a suggestion ran — dates, counts, and status, never content — stays in our cost and misuse records, no longer linked to your account once it is deleted.
Messages you exchange with our team through in-app support chat are kept for the life of your account — so past conversations stay available for context — and are deleted when you delete your account.
If you use Connected Activity, disconnecting a device stops its signal and erases its access credentials. The connection record and the stored daily signals stay until you remove Connected Activity in Settings on the website, which deletes them, or until your account is deleted. We keep a limited record of when you granted or withdrew consent and when data was deleted — that ledger is the proof those choices were honored.
Deleting your account also deletes your Connected Activity connection, its access credentials and every stored daily signal. When we delete an account on our side — at your emailed request or under the 30-day rule above — we first ask Oura to revoke our access. When you delete your account in the iPhone app, the Oura credentials are deleted with it but Oura is not notified, so you may also want to remove Trust Relay’s access in your Oura account. Apple Health gives us no credential to revoke: its permission lives on your iPhone, in the Health app.
14. Children’s privacy
Trust Relay Services is not intended for children under 18 years of age. We do not knowingly collect personal information from children.
Adult members may, however, identify a minor as a beneficiary or trusted contact. If a beneficiary is still a minor when information becomes eligible for release, we may require the involvement of a parent, legal guardian, or other legally authorized representative before sensitive information is delivered.
15. International users
Trust Relay Services is available worldwide. Prices on our website are in U.S. dollars. By using the service from outside the United States, you understand your information may be processed in the United States.
16. Mobile application
Trust Relay offers a mobile app that connects to the same account and is protected by the same safeguards described in this policy. The app collects the same categories of information described above, and may also collect basic device and diagnostic information to keep the app working.
We send notifications only with your permission, and you can turn them off at any time in your device settings. You can delete your account — and the information associated with it, except the records described in Section 13 — from within the app. If you use Trust Relay on the web, email support@trustrelayservices.com and we’ll delete it for you.
18. Updates to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top. Material changes will be announced through the service or by email where appropriate.
19. Contact us
Questions about this Privacy Policy or our handling of your information?
support@trustrelayservices.com
Or by mail:
Trust Relay Services
Attn: Privacy
7901 4th St N, STE 300
St. Petersburg, FL 33702, USA