Honest answers to the questions people actually ask

It's an end-to-end encrypted vault that releases content to specific people at moments you define — a date, a long absence, or when a trusted person says it's time.

Adults who have content that needs to land at a specific moment with the right person. Most often: parents writing letters to their kids; couples managing shared family documents; vacation rental hosts coordinating check-ins; people who want to leave behind a clear digital handoff if something happens to them. Around half of our beta users are couples with minor children.

No — and we deliberately built it so you'd use it for daily, low-stakes things first. Vacation rental info, future-self letters, scheduled birthday gifts, family document storage. The harder use cases are the same product configured differently.

Files, photos, voice memos, video, written notes, links. There's a per-file size cap (currently 100 MB on Free, higher on paid) and a per-Safe storage cap that depends on your plan.

Four kinds, used singly or combined: a Releasee (a trusted person you've designated) firing it on your behalf, a scheduled date, account inactivity past a configured threshold, or you manually firing it. If you combine multiple, the first one to occur wins.

The Pending Release window catches it. When any release fires, you're notified across every channel you've enabled, and you can cancel with one tap during the cooling-off window (24 hours by default). After the window closes, delivery is irrevocable — that line is intentional and we tell you exactly when it crosses.

No. Releasees see a count of Safes ("3 Safes ready to release"), and that's it. They can't see Safe names, contents, recipient names, or file lists. They fire all-or-nothing. We protect your privacy from your own helpers.

The system reaches out to your Releasees first, before any release fires — your spouse, your sibling, your closest friend. They confirm the situation. The inactivity-based release only fires as a fallback. Plus the 72-hour cooling-off window. Plus you get the check-in reminder as soon as you open your phone.

Released Safes wait for the recipient to verify and open them. We send reminders. If a recipient is unreachable, the Safe stays released-but-unclaimed, and you can configure a fallback recipient. Released contents don't disappear — they're held with the same encryption guarantees.

No. Content is encrypted on your device before it leaves your phone. We store ciphertext and metadata. We don't have a master key. We can't decrypt your content for you, for law enforcement, for anyone.

You'll need Designee recovery. You designate a small trusted circle (typically 3 people) when you set up the account. A quorum of them (e.g., 2 of 3) can verify it's really you and help you back into your encryption keys. There's a deliberate cooling-off period and you're notified at every step. No single Designee can do it alone, and neither can we.

If you lose access to your encryption keys with no recovery path, the encrypted content cannot be opened. We strongly encourage everyone to set up at least 2 Designees, and the app nudges you until you do. This is a deliberate trade-off: the same property that prevents an attacker from reading your Safes also prevents us from rescuing you if you lose every recovery path.

We comply with valid legal orders. We can hand over what we have: ciphertext, account metadata, billing records, audit logs. We can't hand over plaintext content because we don't have it. We publish a transparency report annually after launch.

The attacker walks away with ciphertext and metadata. They cannot read your Safes. We notify affected users within 72 hours per GDPR/CCPA, publish a post-mortem, and re-key any affected channel where it's prudent.

Yes — 500 MB, 3 Safes, 5 Recipients, all trigger types, full encryption. Most casual users won't outgrow it for a long time. We make money on people who choose to pay for more storage and unlimited Safes.

Your account drops to Free. Existing Safes within your Free quotas stay accessible. Anything beyond Free quotas (extra storage, extra Safes) becomes read-only — you can still open them, you just can't create new content there until you upgrade or delete some.

Pending Releases fire on schedule before we go dark. We publish a wind-down plan with at least 90 days of notice. We provide an export tool so you can take your encrypted content and metadata with you. We do not abandon users.

Yes, anytime. Delete the account in settings; encrypted blobs and metadata are zeroed out within 30 days (the brief retention is to absorb accidental deletions). Recipients of any released-but-unclaimed Safes are notified that the sender deleted their account.

Not until a Safe addressed to you is released. When that happens, you click a link, verify your email, and create an account in about 30 seconds. Until then, you do nothing. You can't browse the sender's other Safes, see other recipients, or anything else — only the one(s) addressed to you, and only after release.

It means they trust you to confirm their identity if they ever lose access to their account. You get notified if a recovery is initiated, and you tap to verify. You don't get any access to their content. You don't have to be a TRS user to be a Designee — verification works through email and phone.

It means they trust you to fire releases on their behalf when something happens. You'd hold a release key (which they'd give you separately, not through the app) and use it to fire releases when needed. You don't see any of their Safe contents — only a count.