Privacy & Encryption
Your words. Yours alone. Until the moment they're meant to be read.
WordsLater is built so that the most private words you'll ever write - letters to your children, final messages, deeply personal memories - stay private. Encrypted on our servers, encrypted in transit, kept under strict access controls, and only ever readable by the people you choose, at the time you choose. Here's how.
Privacy Built Into Every Layer
Six pillars that protect your messages from the moment you write them.
AES-256 Encryption for the Vault
Items you store in the Vault are encrypted at rest with AES-256 (CBC mode) and a fresh random IV per item. Scheduled messages and attachments are kept private in an access-controlled database and protected in transit with TLS.
TLS 1.3 in Transit
Everything moving between your device and our servers - and from our servers to your recipients - is wrapped in modern TLS encryption with forward secrecy.
Unique Per-Item Vault IV
Every Vault item is encrypted with its own random initialization vector, so identical items never produce identical ciphertext. The vault key is held server-side and never sent to your browser or recipients.
Sealed Posthumous Vault
Messages marked for posthumous delivery stay sealed and locked to your account under strict access controls. They are released only through the verified trusted-contact process, and only at the time of delivery.
Strict Access Controls
Internal access to any production system requires SSO, hardware MFA, and a documented business reason. Every access event is logged and reviewed.
Minimal Data Collection
We collect only what we need to deliver your messages reliably - and nothing we'd rather not have if a breach ever happened. No ad tracking, no data brokering, ever.
The Journey of a Message
Follow your message from the moment you write it to the moment it arrives.
You write
As you compose, drafts are saved over an encrypted TLS connection to your account.
We lock it to your account
When you save, your message is kept private and locked to your account under strict access controls. If you use the Vault, those items are additionally encrypted at rest with AES-256.
We store - safely
Content lives in geographically redundant storage, guarded by strict, audited access controls so it's reachable only for legitimate, logged reasons.
We wait
Your message sits sealed until its trigger fires - a date, a milestone, or a verified posthumous release. While waiting, it stays private and locked to your account.
We deliver
When the trigger fires, the message is delivered to your chosen recipients over TLS, and every delivery is logged.
We clean up
After successful delivery and any retention window you've chosen, the encrypted record is securely destroyed in accordance with our Data Retention policy.
Privacy you can hand down for a lifetime.
Start writing today. No credit card. Full encryption from your very first draft.
Start Free Security OverviewOur Privacy Promises
Clear lines, in plain language.
What we will do
What we will never do
Frequently Asked Questions
Can WordsLater employees read my messages?
Your message contents are kept private and locked to your account under strict, audited internal access controls. Access is forbidden by policy except for narrow troubleshooting situations with your consent or where required by law, and every access event is logged.
What happens if my account is hacked?
We protect against this with strong password requirements, optional two-factor authentication, anomalous-login detection, and a forced 7-day cooling-off window before any sensitive change (recipient swaps, posthumous release dates, trusted-contact changes) takes effect.
Do you use my messages to train AI?
Never. Your content is not used to train any AI model, ours or anyone else's. We don't share it with third parties for analytics, marketing, or model training under any circumstances.
Where is my data stored?
In geographically redundant, audited data centers in the United States by default, with options for EU residency on enterprise plans. See our Data Retention & Custody page for details.
Can I delete everything if I change my mind?
Yes - permanently. Account deletion securely removes all encrypted content, metadata, and backups after a short cooling-off period (so a malicious actor with momentary access can't wipe a lifetime of work).
What if I lose my password?
You can reset your password using your registered email or phone. For accounts with high-value posthumous content, we recommend turning on two-factor authentication and confirming your recovery contact information during periodic check-ins.
Is WordsLater GDPR and CCPA compliant?
Yes. We honor data access, portability, correction, and deletion requests under both GDPR and CCPA. See our Privacy Policy for the full details on how to exercise your rights.
Are attachments and recordings encrypted the same way?
Yes. Photos, documents, voice notes, and videos are encrypted at rest with AES-256, the same as your message text, and protected in transit over TLS on every delivery.
