Draft notice: this policy was drafted with AI assistance to accurately describe how DeLegacy actually works, and is a starting point rather than a finished legal document. It has not been reviewed by a lawyer — the details below (operating as an individual, Dubai/UAE jurisdiction, retention periods, and so on) reflect the owner's own stated decisions as of the effective date above, not legal advice. The whole document should still be reviewed for compliance with applicable law (UAE data protection law and, if any household member is based in the EU/UK, GDPR) before it is relied on as binding, especially once the business incorporates.
This policy describes how DeLegacy (operated by Raviraj Shetty, an individual based in Dubai, United Arab Emirates — not yet a registered company; this will be updated if and when the business incorporates, "we," "us") collects, uses, stores, and protects information when a household uses DeLegacy to record and manage its family office data — real estate, bank accounts, investments, vehicles, insurance, important dates, medical records, education certificates, travel and identity documents, a document vault, memories, and liabilities.
Within a household, DeLegacy is invite-only — once your household has an account, a household administrator invites each member individually, and this policy applies to every invited member the same way, regardless of role. A new household's first account is created differently: someone requests access via our public request form, we personally review the request, and — if approved — we set up their household by hand. See §2 for what we collect at that request stage, before any account exists.
Everything in DeLegacy is information a member or their household admin enters directly — there is no tracking pixel, no analytics/advertising SDK, and no data collected about you from any source other than what you or your household choose to record. Categories include:
Request-access data (before you have an account): if you submit our public request-access form, we collect the email and name you give us, your household's name, any optional message you add, and your IP address (used only to prevent spam/abuse of the form, never to track you). This is reviewed by a person, not processed automatically, and is not used to create an account unless we approve the request and set one up. See §8 for how long we keep it.
Account and identity data: your name, email address, password (stored hashed, never in plain text — we never see it), and, once you complete mandatory two-factor setup, a reference to your authenticator (not the authenticator's own secret key, which never leaves your device).
Financial and asset records: real estate, bank account, investment, vehicle, insurance, and liability details you or another household member with permission enters — this can include account numbers, values, and similar figures.
Sensitive personal data: medical records (private to the individual member by default — see §4) and passport/national ID/other travel document numbers. A small number of these fields (insurance policy numbers, travel document numbers, medical notes) are encrypted at the database level, not just access-controlled — see §5.
Other household records: important dates, education certificates, uploaded documents and photos (memories), and free-text notes attached to any of the above.
Activity data: an audit log of actions taken on records (created, edited, removed, restored, verified, or a hidden field revealed), each with who performed it and when. You can see your own activity log at any time at Settings → Privacy.
Solely to provide the service you and your household are using it for: storing, organizing, and reminding you about your own family office information. We do not use your data for advertising, do not build behavioral profiles, and do not sell, rent, or trade any of it to third parties.
Visibility is enforced at the database level, not just in the app's screens, using row-level security — even a bug in the app's own code could not bypass it. Within one household:
Medical records are visible only to the member they belong to, by default, with no administrator override of any kind — this is the one category where even a household admin cannot see your data without you explicitly sharing it.
Every other record type is visible to its owner, to anyone that owner has explicitly granted access to, and — for genuine emergencies — to a household admin through a logged "break-glass" action, which records who accessed what and when in the same audit log described in §2.
DeLegacy is single-household software: your data is never visible to members of a different household, and (subject to the medical-records exception above and the per-record sharing controls) is scoped to the people you've actually invited into yours.
Access control: row-level security on every record, described in §4.
Encryption: insurance policy numbers, travel/ID document numbers, and medical notes are encrypted at the database level; the app only ever displays the last 4 digits by default, and viewing the full value is a deliberate, individually logged action.
Two-factor authentication: required for every account — a password alone is not sufficient to sign in once your authenticator is set up, and setup itself is required before you can use the rest of the app.
Audit trail: every sensitive action is logged and visible to the person who performed it at Settings → Privacy.
Soft deletion: removing a record moves it to a recycle bin rather than erasing it immediately, and permanently deleting anything is restricted to household admins.
Transport and browser security: the site enforces HTTPS, and sends security headers (including a Content-Security-Policy) intended to reduce the impact of common web vulnerabilities.
No system is perfectly secure, and we do not claim DeLegacy is immune to every possible attack — these are the specific, real measures in place today, not a promise of invulnerability.
We use a small number of infrastructure providers to run DeLegacy, none of whom are permitted to use your data for their own purposes:
Supabase hosts our database, file storage, and authentication. Your data is stored on Supabase's infrastructure in the ap-northeast-1 (Tokyo) AWS region.
Resend sends reminder emails on our behalf (e.g. an upcoming insurance renewal or document expiry).
Slack (optional) delivers the same reminders to a household-configured Slack channel, only if your household has set this up.
We do not use any advertising, analytics, or data-broker third parties.
Depending on where your household is located, your information may be processed in a country other than your own (see §6 for where it's hosted). We rely on our hosting provider's own security and data-processing safeguards for these transfers. A formal transfer mechanism (for example, EU Standard Contractual Clauses) will be put in place if and when a household based somewhere that requires one signs up — this has not been needed yet.
Request-access data: if we reject a request or don't act on it, we delete it within 90 days. If we approve it and set up your household, the request record is kept as part of that household's history; you can ask us to delete it at any time (§12).
Account data: we keep your data for as long as your household account is active. Soft-deleted records remain recoverable in the recycle bin until a household admin permanently deletes them. If your household's account is closed, we will delete or anonymize your data within 90 days, except where we're required to retain it longer by law.
You can download a full export of everything you have access to at any time from Settings → Privacy — this includes every record type described in §2, in the same protected form (not decrypted) as it's stored. You can correct any record yourself by editing it directly.
Full account deletion is currently a household-admin-mediated request rather than a self-service button — contact your household admin, or support@delegacy.app, to request it.
Depending on where you're located, you may have additional rights under local law (for example, the right to object to certain processing, or to lodge a complaint with a data protection authority). Contact us at support@delegacy.app to exercise any of these.
DeLegacy accounts are created by invitation for adult household members only. A minor does not hold their own account, but an adult member may record information about a minor family member (for example, a child's birthday under Important Dates, or their travel documents) as part of the household's own records. The adult member entering that data is responsible for having the authority to do so.
If we make a material change to this policy, we'll update the effective date above and, where appropriate, notify household admins directly.
Questions about this policy or your data: support@delegacy.app. See also our Terms of Service.