Privacy

Last updated 4 September 2026.

You are about to write down some of the most private things you will ever write. Here is exactly what happens to them.

Who holds this

Farewell Notes is operated by Qualeto LLC, a limited liability company in Volusia County, Florida, United States. Every “we” on this page means Qualeto LLC, which is the data controller for everything described below, and the party to write to about any of it: questions@farewellnotes.org.

The short version

We store what you write so that we can show it to the people you addressed it to, when you say so. We do not read it, sell it, mine it, train anything on it, or show it to anybody you did not name. We run no advertising, and no analytics of any kind on the pages where you write or read — see below. There is one thing we cannot honestly promise, and it is in the next section rather than at the bottom.

What we cannot promise

Your letters are not encrypted in a way that would stop us reading them. They are stored in a database on a rented server. Somebody with the hosting credentials — us, or anybody who compromised us — could read them.

This is a deliberate choice, not an oversight. Encrypting properly would mean a decryption key that has to outlive you and be usable by a grieving, non-technical relative on the worst week of their life. Every scheme we could design for that either kept a copy of the key (which is the same as not encrypting) or risked losing your letters permanently at the exact moment they were needed.

The practical consequence, which the app repeats where you write: record where things are and who to ask, never the credentials themselves. “The password manager is on my desk and Sarah has the master password” belongs here. The master password does not.

What we store

• Your account: name, email address, a hash of your password if you set one, your language and timezone.
• What you write: letters, practical notes, titles, dates, signatures, and any translations you write yourself.
• Who they are for: the names, email addresses, relationship notes and private notes you record about each person.
• State: whether things are sealed or open, your timer settings, when you last checked in.
• A log: sign-ins, releases, and which letters were opened, with the IP address and browser of each. Its purpose is to let you check that somebody you gave a code to actually got in, without having to ring them and ask.
• Payments: the amount, the currency, and an identifier from Stripe. We never see or store your card details.

What we do not store

• Card numbers. Those go to Stripe and never touch our server.
• Any advertising identifier, anywhere. Analytics runs on the public pages only and never behind a sign-in.
• The contents of anything you write, in any email we send. Our messages say “there is something here for you” and nothing else — no title, no excerpt, nothing that could appear on a lock screen.

Who can see what

You see everything in your own account and nothing in anybody else’s.

A person you have written to sees only what is addressed to them or to everyone, only once you have released it, and never anything you left in draft.

A keeper sees whether your notes are sealed or open, the log, and any practical notes you marked for keepers. They cannot read your letters, before or after opening them. They are trusted with the door, not with what is behind it.

We can technically read what is in the database, as described above. In practice we look at account records when somebody asks us for help, and we do not read letters. There is no interface in this software that shows us your letters; it would have to be done by hand, in the database, and we do not do it.

Third parties

Stripe handles payments. You are sent to their page to pay and your card details never reach us. They have their own privacy policy and are bound by it.

Google Translate is available for languages nobody has hand-written. Using it sends the text of the page you are reading to Google, which is why it is off by default anywhere private and is only turned on if you ask for it, having been told that. On the public pages — this one, the front page — it is simply on, because there is nothing private on them.

Our host stores the server and the database, and our mail provider carries the emails we send. Both can technically see what passes through them, in the same way any host or mail provider can.

Google Analytics runs on the public pages — this one, the front page, how it works, pricing — so that we know whether anybody is finding this. It is not loaded anywhere behind a sign-in: not on the pages where you write, and not on the pages where somebody reads what you left them.

That distinction is the whole point of the arrangement. Analytics reports the title of the page it is on, and on a reading page the title is the letter’s title. “The thing I never said” is not a thing we are willing to send to Google, so those pages do not load it at all. IP addresses are anonymised on the pages that do.

It is also off on any page you reach from a link in an email — claiming an invitation, resetting a password, confirming an address. Analytics reports the whole address of the page, and on those pages the address contains the code from the email. Sending that to Google would be handing over the key along with the note about the door.

We use no advertising networks, no social media pixels, and no content delivery network. The fonts are served from our own server. Once you are signed in, loading a page here tells nobody anything.

Cookies

Behind a sign-in: one, called fn_sid, which keeps you signed in. It is removed when you sign out. Nothing else, and nothing that tracks you.

On the public pages, Google Analytics sets cookies of its own. If you would rather it did not, most browsers can block it, and doing so affects nothing about how this site works for you.

If you turn on machine translation, Google sets a cookie of its own. Turning translation off clears it.

Your rights

You can see everything we hold about you by signing in — it is all on the pages you wrote it on. You can correct it, and you can delete your account, which deletes your letters, your notes, your list of people, and your log.

If you are in the UK or the EU, you have rights of access, correction, erasure, restriction, objection and portability under the UK GDPR and GDPR. Write to questions@farewellnotes.org and we will answer within thirty days. Our lawful basis for holding your content is the contract between us; for the log it is our legitimate interest in security and in letting you verify access.

If you are in the United States — California, Florida, or anywhere else — you have the same rights here. Access, correction, deletion, portability, and a copy of what we hold, on the same address and the same thirty days. We give these to everybody, whether or not a statute obliges us to, because a right that depends on which state you happened to be in is not much of a right.

Two things the California acts ask to be said plainly, and which are true of us everywhere: we do not sell your personal information, and we never have. We do not share it for cross-context behavioural advertising, and there is no advertising here of any kind. And we will not treat you differently for exercising any of this — there is no worse tier, no reduced service, and nothing to lose by asking.

The awkward one: after you die

Being written to on this service creates a record about somebody — their name, their address, and the fact that you thought of them. They may not have asked for that.

A person you have written to can ask us to delete their own account and their address. We will. Doing so removes their way in; it does not delete what you wrote, because that is yours.

If you die, your account and its contents remain, because deleting them would defeat the entire purpose. The people you released to keep their access.

If your estate’s executor asks us to delete the account, we will — but only on court-issued probate documentation naming them as personal representative of your estate: Letters of Administration, Letters Testamentary, or the equivalent where you lived. A death certificate on its own is not enough, and neither is a solicitor saying so, because neither shows who has authority to act.

We record what document we were shown and its reference before anything is deleted, and that record is not editable afterwards. We will also make sure the executor understands that this destroys what you left for people — permanently, with no copy anywhere — before we act. The bar is deliberately high: this is the one request that cannot be undone if we get it wrong.

We will not open somebody’s notes because we were asked to, by an executor or anybody else. We cannot verify a death, and getting it wrong is not recoverable. That is what keepers are for.

How long we keep things

• Your content: until you delete it, or your account.
• The log: for the life of the account.
• Sign-in attempts: thirty days.
• Expired one-time links: seven days.
• Payment records: as long as tax law requires.

If something goes wrong

If we discover a breach that puts your content at risk, we will tell you what happened, what was exposed, and what we are doing about it — directly, by email, and without waiting to be forced to. If you are in the UK or EU we will also notify the relevant authority within 72 hours where the law requires it.

Changes

If we change this in a way that materially affects you, we will email you rather than quietly changing the date at the top.

Contact

questions@farewellnotes.org. A real person reads it.