A service that keeps your most private words should be unable to read them. This page says, in plain words, how Legacy Drawer manages that, what we can see, and what we ask of you in return.
Locked on your device before it leaves
When you write a message or add a document, your browser locks it with keys that exist only on your device before anything is sent to us. What travels to our servers, and what sits in storage, is a locked box. We hold the box; we do not hold the key, and neither does anyone who might break into our servers.
Your password is the one thing that opens your keys, and it never leaves your device either. We do not receive it, store it or see it, which is why we cannot reset it.
What we can see, and what we cannot
We can see
Your name and email address.
The titles of your items, a document's file name and size, and the folders you file them in.
Who you have shared with, when things unlock, and when you answered a check-in.
Your plan, and messages you send us through the contact form.
We cannot see
What a message says.
What is in a document, a photo or a recording.
What you and your contacts say to each other in conversations.
Your password, or your keys.
Titles are visible to us and, before an item unlocks, to the people you chose. Keep anything private out of the title and inside the message.
The spare key
Because we never have your key, a forgotten password cannot be reset by us. The app offers a spare key instead: a code you print or store somewhere safe. With it you can choose a new password and lose nothing. Without it, a lost password means starting over with an empty drawer; the items you had already sealed are still delivered to the people you chose.
Make the spare key in Settings on the day you sign up, and keep it where your family would find it.
What arrives is what you sealed
Everything you seal is signed by your device. When one of the people you chose opens it, their browser checks the signature: that the title, the timing and the content are exactly what you sealed, and that it came from you. If anything had been altered on the way, even by us, the item would not pass the check.
Where things live
Storage and servers: Amazon Web Services in the United States. Your locked content goes from your browser straight into storage; it never passes through our own servers.
Payments: Stripe. Card details go to Stripe directly and never reach us.
Email: check-in reminders, invitations and unlock notices are sent through Amazon's email service. They contain titles and names, never content.
The check that you are a person: Cloudflare's widget on the sign-up and contact forms. It is the only outside script this site loads, and only on those two forms.
The Privacy Policy lists these providers and how long each kind of data is kept.
Checked, and kept checked
In September 2026 we put the whole of Legacy Drawer, the app, the servers, this site and the accounts behind them, through a full security review against the OWASP Application Security Verification Standard, a widely used checklist. Its headline finding was that the central promise holds: the server never receives a password or a key, and content never passes through it. The review also produced a list of smaller improvements, and we are working through it. We will repeat the review as the product grows.
If you believe you have found a security problem, please write to us and say so in the first line. Those messages come first.
If Legacy Drawer ever closed
A service that promises to deliver things years from now owes you an answer to this. If we ever decided to stop, we would tell every account holder by email well in advance and give you time to download everything in your drawer before the doors shut. That promise is written into the Terms of Service, not only on this page.
What we ask of you
Choose a password you will not forget, or keep it in a password manager, and make the spare key.
Keep our emails out of your spam folder. If you use the check-in release, missing them is what releases the item.
Keep anything private out of titles.
Sign in from your own devices. Legacy Drawer runs in the browser, and a shared or public computer can keep what you typed.