Privacy Policy

The Nightside Planning Studio is an end-of-life planning platform operated by The Nightside Inc. in Canada. This policy explains what personal information we collect from you, how we store and protect it, who we share it with, and what your rights are.

We've written this in plain language because we believe you should be able to read and understand what we do with your information. If anything here isn't clear, contact us at contact@thenightside.net.

When you use The Nightside Planning Studio, we collect the following:

• Account information: your first name, last name, email address, password (stored as a secure hash, never as plain text), and province of residence.
• Content you create: everything you enter into the platform, including your wishes documents, practical planning documents, reflections, activity outputs (such as your Values Ranking, Fears Ranking, and Legacy Map), notes, and voice recordings (including their transcriptions).
• Legacy Contact information: the name, email, and relationship of the person (or people) you designate as your Legacy Contact, plus any personal message you choose to write for them.
• Usage and technical information: account creation date, last sign-in date, completion status of your documents and activities, last-edited timestamps, and technical information such as your IP address and browser type that is captured automatically when you use the platform.

What we don't store: certain fields in your documents are designed to be added at the moment you export your plan rather than saved to the platform. These include your Social Insurance Number, health card number, financial account numbers, passwords, PINs, and other access details. These fields exist for your export, but the actual values are never stored on our servers.

We collect this information for the following purposes:

• To create and maintain your account
• To authenticate you when you sign in
• To save your work and make it accessible to you across sessions
• To enable you to export your plan
• To send you essential emails related to your account (email confirmation, password reset)
• To release your designated planning materials to your Legacy Contact if you die

We do not use your information for marketing, advertising, profiling, or any other purpose beyond providing you with the planning platform.

We use a small number of third-party services to operate the platform. These services receive only the information necessary to provide their function, and they are contractually required to protect your data.

• Supabase stores your account information and content. Supabase is a database and authentication provider. Your data is stored on Supabase's Canadian servers (ca-central-1 region).
• Resend sends emails on behalf of the platform (account confirmations, password resets, and notifications to your Legacy Contact at the time of designation). Resend processes emails through US-based infrastructure.
• Our hosting provider hosts the platform itself and may process technical information such as IP addresses for hosting and security purposes. [Provider name and location will be specified once finalized.]

We do not sell your information. We do not share your information with third parties for marketing, advertising, or any commercial purpose. We do not use third-party analytics tools that track you across the web.

We take the following measures to protect your information:

• Your content is encrypted both when it's traveling between your device and the platform, and when it's stored on our servers
• Your password is stored as a secure hash, never as plain text
• Your account is accessible only through your authenticated session, using row-level security policies that prevent other users from accessing your data

We do not access your content in the normal course of operating the platform. There are limited circumstances where access may be necessary — to help you troubleshoot a problem you've reported, to investigate a security incident, to comply with a legal order, or to perform necessary database maintenance. We minimize this access and treat any content we encounter with care.

No security measure is perfect. While we take reasonable care to protect your information, no system can guarantee complete security. If we become aware of a security incident affecting your information, we will notify you in accordance with applicable privacy law.

We keep your information for as long as you have an account. The Nightside Planning Studio is designed for return. Your account stays active indefinitely so you can revisit and update your work over time. We do not deactivate accounts for inactivity.

If you delete your account, all of your content is permanently removed from our database. Backups follow Supabase's standard retention schedule (typically 30 days), after which the data is purged from those as well.

End-of-life planning that doesn't account for what happens to the plan after death isn't complete planning. Because the platform is designed to help you create materials for the people who will need them, every user designates a Legacy Contact when signing up.

What the Legacy Contact does and doesn't do

Your Legacy Contact is the person you designate to receive your practical planning materials if you die. They do not have access to your plan while you are alive. They do not have any legal authority over your estate, your healthcare decisions, or any other matter. Their role is solely to receive your materials from this platform.

Your Legacy Contact is not a substitute for an executor named in your will, a substitute decision-maker for healthcare, or any other legally designated role. If you want someone to have legal authority over those matters, you need to designate them through proper legal channels.

What gets released to your Legacy Contact by default

If you die, your Legacy Contact may receive an export of the following practical planning documents:

• Wishes for My Body, Funeral & Ceremony
• Important Contacts
• Financial Information
• Personal Admin
• Devices & Accounts
• Keepsakes Inventory

What you can choose to add to the release

You can choose to include additional content in what your Legacy Contact receives, such as your My Care Wishes document, your Legacy Map, your Values Ranking, or your Fears Ranking. By default, this content stays private even after your death. You decide what's released.

You cannot remove items from the default release. The practical planning documents listed above were created to be used by others after your death. Including them in your Legacy Contact's release is part of how the platform serves its purpose.

Most users may never need this mechanism

Most people who complete their planning will export and share their plan with the people who'll need it during their lifetime. If you do this, your Legacy Contact may never need to activate their role. The Legacy Contact mechanism exists as a safety net for cases where this didn't happen, where your plan was significantly updated after you last shared it, or where the people who need the information weren't aware of the export.

How the Legacy Contact activates their role

If you die, your Legacy Contact can contact us at contact@thenightside.net to begin the release process. They will need to provide:

• Documentation of your death (a Statement of Death from a funeral director, a death certificate, or other comparable documentation — we work with Legacy Contacts to verify the death using whatever reasonable documentation is available)
• Confirmation of their identity matching the Legacy Contact you designated

We review each request and use judgment in handling individual cases. In urgent situations where documentation is still being processed, we may release essential information (such as your decision-makers' contact information or your wishes for your body) while we wait for full documentation, at our discretion.

For very recent designations (within 7 days of designation), we may apply a brief waiting period before processing a release request, to protect against fraudulent designations.

If your Legacy Contact predeceases you or is unavailable

You can designate a secondary Legacy Contact when signing up, or update your Legacy Contact designation anytime in your account settings. If your Legacy Contact dies or becomes unreachable, you can update your designation to someone else.

If no Legacy Contact is reachable when you die

If your designated Legacy Contact (primary and secondary) is unreachable or cannot be verified, your data is not released. We do not release planning materials to people who were not designated by you.

You have the following rights regarding your information:

Access. You can view all of your information through the platform and export your full plan at any time.

Correction and updates. You can update your name, email address, and province through your My Account page. You can update or change your content (documents, activities, notes) at any time through the platform. You can update your Legacy Contact designation at any time. Changes to your email address and Legacy Contact require password confirmation.

Deletion. You can permanently delete your account and all associated information at any time through the My Account page. Deletion is immediate and cannot be undone.

Withdrawal of consent. You can stop using the platform and delete your account at any time.

Complaint. If you believe we have not handled your information appropriately, you can file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca. If you live in Quebec, Alberta, or British Columbia, you can also contact your provincial privacy commissioner:

• Quebec: cai.gouv.qc.ca
• Alberta: oipc.ab.ca
• British Columbia: oipc.bc.ca

We would prefer to address concerns directly first — please reach out at contact@thenightside.net before filing a formal complaint, if you're willing.

If you have questions about this policy or about how we handle your information, contact us at contact@thenightside.net.

The Nightside Planning Studio is intended for adults. We do not knowingly collect information from anyone under 18. If you become aware that a child has provided information to us, please contact us at contact@thenightside.net so we can address it.

If we change this policy, we'll update the “Last updated” date at the top. For material changes — such as changes to who we share information with, how long we keep it, or what we do with it — we'll notify you by email before the changes take effect. The current version of this policy is always available at [URL of privacy policy page — to be updated at production launch].