Safeguards
How Tellr protects what you keep
Tellr holds private things, so here’s exactly how it’s protected and how messages for after you’re gone are handled. Open any section for the details.
Tellr is a free beta, so this describes how it’s built to work, not a guarantee. Please read our Terms and keep your own copies of anything irreplaceable.
How messages for after you're gone are releasedEight rules that stop a release from happening by mistake, or by anyone's say-so alone.
- 1
One person can't trigger a release
A trusted contact can report your death, but that releases nothing. Several of your contacts have to confirm it separately. You choose how many, with a minimum of two. Only contacts who have accepted your request count.
- 2
There is a waiting period
Once enough contacts have confirmed, a waiting period starts. You set it between 7 and 60 days, and it's 14 by default. Nothing is released until it ends.
- 3
You're told right away
As soon as someone files a report, you get an email and a notification in the app. You get a reminder every day while the report is open.
- 4
You can cancel with one click
If you're still here, click “I'm here”. The report is cancelled, your contacts are told, and the person who filed it can't report again for 90 days.
- 5
Any contact can stop it
If one of your trusted contacts disputes the report, it's put on hold for good. Waiting won't release it.
- 6
It's checked again at the end
When the waiting period ends, Tellr checks again that your contacts are still active, that enough of them confirmed, and that no one disputed the report. Only then does it release anything.
- 7
Inactivity alone doesn't release anything
If you turn on check-ins, Tellr will remind you to respond, and may eventually tell your contacts that you've been quiet. Check-ins can't start or finish a release. The one exception is a choice only you can make, and only if you have no trusted contacts: automated release (explained below).
- 8
Every step is logged
You can read the log in your account.
What gets released, and what Tellr can't do
What gets released
Only memories you marked “after I’m gone”, and only to the people you shared them with. Vault items go to your trusted contacts only if you turned that on for each item. Your account is then closed to sign-in, so no one can log in as you.
What Tellr can’t do
Tellr can’t check a death certificate. The people you trust do the confirming, which is why it takes several of them, a waiting period, and a way for you to cancel. Choose people who know you well and who you can trust.
If you have no one to askAn optional, automatic alternative, off unless you choose it.
Some people don’t have anyone to name as a trusted contact. If that’s you, you can turn on automated release. It only happens if you stop signing in for the time you choose, from 6 months to 5 years. It covers your “after I’m gone” memories and, if you choose, the Vault items you marked for sharing.
- You have to turn it on yourself, confirm it’s you, and tick a box saying you understand there’s no person checking first.
- Before anything happens you get three reminders over about three weeks, then a final notice with the exact date and 14 more days. Signing in at any point cancels it.
- You decide who gets your shared Vault items: one person from your Spaces who’s already on Tellr, or no one. It’s the same single choice, and you can see exactly what it covers before you accept.
- Your account stays open, and Spaces you named someone to take over are not handed over.
- It’s less safe than trusted contacts, because it can’t tell “gone” from “away”. If you add a trusted contact later, it switches itself off.
Passing on a SpaceChoose who looks after a Space if you're gone.
You can name one member of a Space to take it over if you pass away. They have to accept first, and it only takes effect through the same steps as above. Being quiet for a long time never triggers it.
- They can invite people, remove people and add memories. They can’t delete the Space.
- No one can delete memories written by someone who has passed. They stay as they were left.
- If you didn’t name anyone, or they declined, the Space becomes a read-only archive. Its members can still read it, but nothing new can be added.
How your information is encryptedLocked while it's stored and while it travels.
Your words
Titles, memory text, file names, Vault notes and the names in your relationship tree are encrypted before they’re saved. Each Space has its own key, and your Vault has a key of its own. Those keys are protected by AWS Key Management Service, a hardware-backed key store that we can’t read keys out of.
Your photos, videos and recordings
They’re stored encrypted in private storage with the same protection. There are no public links. Each time you view one, a link is made just for you that expires within minutes.
On the way to you
Everything travels over HTTPS, and the site tells browsers never to use an unencrypted connection.
When you delete
Deleting a Space or your account removes the data and files, then destroys the keys. Any copy left in a backup becomes unreadable.
One honest limit
Tellr isn’t end-to-end encrypted. Our systems have to be able to open your memories to show them to you and to release them when the time comes. That’s why the rules on who can access them, covered in the next section, matter as much as the encryption.
Our security principlesThe habits behind the rest.
- 1
Private until you say otherwise
Nothing is visible to anyone until you invite them and they accept. Memories can also be limited to specific people inside a Space.
- 2
Access is checked every time
Every page, photo and download is checked on our servers each time it's requested. Hiding a button is never the only thing standing in the way.
- 3
Nothing is public
Photos, videos and recordings are kept in private storage. The links used to show them are created only after we've checked you're allowed, and they expire within minutes.
- 4
Your password is never stored
We keep a scrambled version that can't be turned back into your password. You can skip passwords entirely and sign in with a passkey, which can't be phished and can't be used on a look-alike site.
- 5
Sensitive areas ask again
The Vault, exporting your data, deleting your account and changing passkeys all ask you to confirm it's you, even if you're already signed in.
- 6
Guessing is slowed down
Repeated sign-in attempts, sign-ups, resets and similar actions are limited, so someone can't try thousands of passwords.
- 7
Staff see numbers, not your memories
The tools our team uses show how many accounts there are and how the product is used. They don't show what anyone wrote, uploaded or named. Staff can help with sign-in problems, every action is logged, and they can't read your Vault or memories.
- 8
It's yours to take or delete
You can download everything, or delete your account. Deleting removes your data and files and destroys the keys, so even leftover backup copies can no longer be read.
For how we handle personal information, read the Privacy Policy. If you think you’ve found a security problem, please tell us so we can fix it.