Privacy Policy

1. 1The short version

   What you write inside the Legacy Organizer is locked in your own browser, with a password only you know, before any of it is sent to us. We store the locked copy so you can carry on from another device. We cannot open it, and neither can your advisor.

   We do hold ordinary details about you: your name, your email address, your telephone number and the postal address you gave when you activated. Those are how we reach you and how the printed copy finds you. They are not part of the locked document.

   We keep the locked copy until you tell us to delete it. There is no timer on it, deliberately: the most likely reason an Organizer sits untouched for two years is that its owner has died, which is the moment their family needs it most.

2. 2What we collect, and why

   • Your name, at activation. So an advisor knows who to ask for, and so the printed document has a cover.
   • Your email address, at activation. So we can send your activation code, the link back into your Organizer, and the annual reminder to review it.
   • Your telephone number, at activation. So we can reach you about your thirty minute session. This audience prefers a call, which is why we ask.
   • Your postal address, at activation. For anything shipped, and to find advisors near you if you ask us to.
   • Approximate coordinates for that address. Worked out from it once, so the list of advisors near you can be measured without asking a mapping service every time you open the page.
   • Which sections of your Organizer you have marked finished. A list of section names and nothing else. It is what your advisor's dashboard runs on, and it never records what is in a section.
   • Your encrypted Organizer. Ciphertext. We hold it, we cannot read it.
   • An email address, if you ask for the Readiness Checklist or sign up for occasional notes from Jim. Those are two separate things and you choose them separately: asking for the checklist sends you the checklist and nothing else.
   • The box next to that form, which asks whether you also want occasional notes from Jim, starts ticked. Clearing it before you send the form means you get your checklist and nothing else, ever. We say so on the form itself rather than leaving you to notice.
   • Whether that box was ticked when you sent the form, and when. We keep the answer because it is the record of what you agreed to. If it was cleared, you are not on the list that campaigns go to, and nothing puts you there later without asking.
   • Every note from Jim carries a link that takes you off the list in one click, with nothing to sign in to and no form to fill in.

3. 3What we cannot read, and why that is not a promise we could break quietly

   Your answers are encrypted in your browser before they are sent, using a key derived from your password. The password never leaves your device and is not stored anywhere, in any form. There is no column in our database that holds a key, a password, or a plaintext answer, and there is no administrative override that would produce one.

   The practical consequence is one we would rather state plainly than bury: if you forget your password, we cannot recover what you wrote. There is no reset link and no phone call that gets around it. Write it down somewhere you will find it in ten years.

4. 4What your advisor can see

   If an advisor gave you your activation code, or you connected to one yourself, they see your name, your email address, your telephone number, when you started, and how many sections you have marked finished.

   They see nothing you wrote unless you switch sharing on. If you do, your browser makes a copy, leaves out every question that asks for an account reference or for where a key or a password is kept, and locks that copy to your advisor and to nobody else. You can read the whole copy before you decide, and you can switch it off again, which deletes it. We cannot open it at any point, and neither can anybody else here.

   What switching it off cannot do is unsee anything your advisor has already read.

5. 5Who else is involved

   We use other companies to do specific jobs. Each of them sees only what that job needs.

   • Shopify, in the United States and Canada, takes your order and your payment and sends the eBook. It collects your card details directly and we never see them.
   • Brevo, in France, sends our transactional email: your activation code, the link back into your Organizer, the annual reminder, and the warning before anything is erased. It is sent your email address and the contents of that message.
   • Calendly, in the United States, books your thirty minute session. It is sent nothing by us; it sees whatever you type into its own booking form.
   • Vercel, in the United States, hosts the site. Supabase, in the United States, hosts the database holding your encrypted Organizer. Both hold the locked copy and neither can open it.
   • The United States Census Bureau geocoder, and OpenStreetMap's Nominatim in the United Kingdom, turn a postal address into approximate coordinates. They are sent the address alone, with nothing attached that identifies you.
   • Each is sent only what its job needs. None of them is given your password, and none of them can open your Organizer.

   For revieweach processor's role and location is stated above from what the code actually sends. A reviewer should confirm the legal characterisation (processor against independent controller, which differs for Shopify and Calendly because both collect directly from the customer under their own terms), add a link to each company's own policy, and decide whether a list of sub-processors has to be maintained and published separately.

6. 6How long we keep things

   A finished Organizer is never deleted on a timer. That is a deliberate decision and worth stating rather than leaving to a retention table: an inactivity timer would delete the document at exactly the moment it starts to matter to somebody's family.

   An Organizer that was activated but never started, where no password was ever set and nothing was ever saved, is removed after a year.

   When you delete, deletion is real. The encrypted copy is set to null. There is no archive, no soft delete flag, and no copy kept for support, because there is nothing for support to look at. There is no grace period and no undo.

7. 7Your rights

   You can ask us what we hold about you, ask us to correct it, ask us to delete it, and ask for a copy of it in a portable form. You can also tell us to stop sending you anything.

   Two of those work differently here, and the difference is worth stating rather than discovering:

   • Access and portability reach the ordinary details only: your name, email address, telephone number, postal address, which sections you have marked finished, and the dates things happened. We cannot include what you wrote in your Organizer, because we cannot read it. You already hold that, and you can take a copy of it whenever you like by finishing it or printing it.
   • Correction reaches the same ordinary details. What you wrote inside your Organizer you correct yourself, by signing in and editing it.
   • Deletion is real and immediate, and you can do it yourself from inside your Organizer without asking us. There is no grace period and no undo, which the page says before you press it.
   • You can stop marketing email with the link in any note from Jim. It takes one click and asks you to sign in to nothing.
   • To exercise any of these, write to info@beyondtherunway.net or call 480-798-4318. We answer within thirty days, and sooner if we can.
   • We will not treat you differently for exercising any of these rights.

   For reviewthis is drafted as the common ground between the main United States consumer privacy statutes, and the thirty day response window and the non-discrimination line come from that. Confirm which regimes actually apply, given the operator is assumed to be in Oregon and customers are nationwide, and whether any threshold for the Oregon Consumer Privacy Act is met. Add appeal rights and an appeal route where the applicable statute requires one, and add the authorised-agent and identity-verification wording if it does. If any customer is outside the United States, this section needs a lawful basis and a transfer mechanism as well, and neither is drafted here.

8. 8Cookies and measurement

   We set three cookies and no more. One when you are signed in to your Organizer and one when an advisor signs in, both signed, both only there to keep you signed in. The third remembers that you have already been offered the Readiness Checklist, so you are not asked again on every page. It holds one word and a date, and nothing that could identify you.

   None of them follow you anywhere, and there is no analytics or advertising cookie on this site.

   For reviewthis is accurate today and is a stronger statement than most sites can make, so it is worth keeping true. It stops being true the moment anybody adds analytics, a pixel, an embedded video or a chat widget, and at that point this section and a consent mechanism both change. Confirm nothing is planned before launch. Calendly's booking form sets its own cookies inside its embed, which a reviewer should decide whether to name here.

9. 9Children

   This site and the Legacy Organizer are meant for adults, and nothing here is directed at children. We do not knowingly collect anything from a child under 13.

   If you believe a child has given us something, write to us and we will delete it.

   For review13 is drafted from the federal children's privacy rule. Several state statutes attach further duties at 16 and at 18, so confirm the age this should state once the governing regime is settled. Worth a thought that this product is bought by people organising their affairs for the people who outlive them, so a reader may be elderly rather than young, and there is no plausible route by which a child buys one.

10. 10Changes to this policy

    If we change this policy we change the date at the top of this page, and the current version is always the one published here.

    If a change materially affects what we collect, who we share it with, or how long we keep it, we will email everybody who holds an Organizer before it takes effect, rather than relying on you to notice a date.

    For reviewthe promise to email before a material change takes effect is deliberate and is stronger than most policies offer. It is also operationally real, because every Organizer holder has a verified email address already. Confirm it is wanted, and set the notice period. Drafted without a clause saying continued use is acceptance, because this product is paid for once and used for years, so somebody may not visit between a change and their next sign in.

11. 11Getting in touch

    Write to info@beyondtherunway.net, or call 480-798-4318 and a person will answer.

    By post: CLCMGMT LLC, P.O. Box 513, Brookings, Oregon 97415.

    For reviewthe postal address above is the operator's mailing address. Confirm whether the registered address, a registered agent for service of process, or a named privacy contact has to be published instead of or alongside it.

Questions about any of this? 480-798-4318