How We Keep Your Data Safe: The Security Behind WhenImGone

When you're storing bank account numbers, insurance policies, and personal messages for your loved ones, security isn't a feature — it's the foundation. Here's exactly how WhenImGone protects your data.

End-to-end encryption

WhenImGone offers optional client-side encryption using AES-256-GCM — the same encryption standard used by governments and financial institutions. Here's what that means in practice:

Your passphrase is used to derive an encryption key using PBKDF2 with 600,000 iterations
Encryption and decryption happen entirely in your browser — your passphrase never leaves your device
We store only a cryptographic hash of your passphrase (not the passphrase itself) for verification
Even our own team cannot read your encrypted sections

This is what "zero-knowledge encryption" means: we know that you have encrypted data, but we have no way to read it.

Authentication & access control

Password hashing via Supabase Auth (bcrypt)
Google OAuth for convenient sign-in
Row-Level Security (RLS) on every database table — your data is isolated at the database level, not just the application level
HMAC-signed check-in tokens with time-limited expiry and nonce rotation — each email link is unique and expires
Rate limiting on all sensitive endpoints

How trusted contacts access your page

When your pages are unlocked, your trusted contacts receive a unique, time-limited access token — valid for 30 days. This token:

Is cryptographically random (48 characters)
Is tied to a specific contact and specific page
Is immediately revoked if you check back in
Cannot be reused after expiration
Does not give access to other users' data

File storage security

Files are stored in a private storage bucket — not publicly accessible
Access requires signed URLs that expire after 1 hour
File type whitelist prevents malicious uploads
Each file is scoped to the user's folder
Signed URLs for trusted contacts verify the file belongs to the specific page

Infrastructure security

HTTPS everywhere with HSTS preload (forced for 1 year)
Content Security Policy prevents XSS and injection attacks
Webhook signature verification on all payment events
No hardcoded secrets — all credentials in environment variables
Strict security headers on every response

What we don't do

We don't sell your data
We don't show ads
We don't track you across the web
We don't store your passphrase
We don't have a "backdoor" to your encrypted data
We don't share your information with third parties

Data portability

You can export all your data at any time from Settings. The export includes your profile, all pages, sections, contacts, and activity log in a human-readable text format. If you delete your account, everything is permanently removed — files, database records, and authentication data.

Security is not a checkbox for us. It's the reason people trust WhenImGone with their most important information. We take that trust seriously.

Learn more at whenigone.com