Our promise

Encrypted, and no one on our team can browse it

Every Later gets its own random key. That key is itself locked with a master key kept outside the database. Text, photos and video are stored only in encrypted form. Our admin tools have no screen that shows a Later; the code that can decrypt one runs in exactly three places: when you edit it before sealing, when it is opened for you on the opening day, and in the shutdown delivery below. Each time, a line is written to an audit log.

We do not say "even we cannot open it". On the opening day our server has to decrypt your Later to show it to you, so that would not be true. What is true: nobody here can browse it.

If we ever close, your Later is delivered to you first

A written, tested procedure exists today. Running it decrypts every Later, packs it with its photos and video, and e-mails each owner and recipient a download link before anything is switched off. It is tested on fake data as part of our normal test suite.

We check in every December

Once a year you get one e-mail: how long is left, and a link to update your address or add a backup one. If a message bounces, we try the backup. Please give us one.

Sealed means sealed

After 23:59 on 31 December in your time zone nothing can be added, changed or removed from a Later. The only exception is deleting your account, which destroys it unread.

The wall is a yearbook

Each year's Laterwall is sold once, locks on New Year's Eve and is then kept read-only for as long as we exist.

Refunds

Anything is refundable in full until sealing. After sealing, nothing is refundable, because the brick and the moment are already spent.