UntilReady

Privacy Policy

Last updated: March 13, 2026

UntilReady (“we,” “us,” or “our”) operates the UntilReady platform, a cryptographic evidence preservation service. This Privacy Policy describes how we collect, use, store, and protect your information when you use our service.

UntilReady is operated by BB Codex, Inc., incorporated in the State of Wyoming, USA. For privacy-related inquiries, contact us at [email protected].

What We Collect

Account Information

Your email address, used for magic link authentication. We do not collect passwords.

Uploaded Files

Files you upload are encrypted client-side in your browser using libsodium (XChaCha20-Poly1305) before they ever reach our servers. We cannot read, access, or decrypt your file contents. We store only the encrypted ciphertext.

File Metadata

Filename, file size, upload timestamp, and unlock date associated with your capsules.

Cryptographic Hashes

SHA-256 hashes of your files, used to generate proof of existence. These hashes cannot be reversed to reconstruct your original files.

Payment Information

Payment processing is handled entirely by Stripe. We never receive, store, or have access to your credit card numbers or bank account details. We store only the Stripe customer ID and payment status for your account.

Usage Data

IP addresses, browser type, access timestamps, and pages visited. This data is used for service health monitoring and abuse prevention.

Blockchain Anchoring Data

Arweave transaction IDs associated with your cryptographic proofs. These are public, permanent, and cannot be deleted by anyone — including us. This is by design: permanence is what makes the proof tamper-proof.

How We Use Your Data

  • Provide the time-lock encryption and proof-of-existence service
  • Process payments via Stripe
  • Send transactional emails (magic link sign-in, capsule notifications) via Resend
  • Monitor service health and prevent abuse
  • Comply with legal obligations

We do not sell your data. Ever. We do not use your uploaded content for AI training, analytics, or any purpose other than encrypted storage and delivery at unlock time.

Data Storage and Security

  • Files are encrypted client-side with libsodium (XChaCha20-Poly1305) in your browser before upload
  • An additional server-side encryption layer (ChaCha20-Poly1305) is applied before storage
  • Encrypted files are stored on Backblaze B2 with server-side encryption at rest
  • Cryptographic proofs are anchored to the Arweave blockchain — permanent, public, and immutable
  • Database hosted on Railway with encryption at rest and private networking (no public internet access to the database)
  • All inter-service communication occurs over encrypted connections

Data Retention

  • Account data is retained while your account is active
  • Encrypted capsule data is retained until capsule expiration or user-initiated deletion (for non-permanent capsules)
  • Arweave-anchored proofs are permanent and cannot be deleted by anyone. This is a core feature of the service: once a proof is anchored to the blockchain, it exists independently and immutably. This permanence is what provides the tamper-proof guarantee.
  • Usage logs are retained for up to 90 days for security and abuse prevention purposes

To delete your account and all non-anchored data, contact [email protected].

Third-Party Services

We use the following third-party services to operate UntilReady:

  • Stripe — Payment processing
  • Resend — Transactional email delivery
  • Arweave — Blockchain anchoring for permanent cryptographic proofs
  • Backblaze B2 — Encrypted file storage
  • Cloudflare — CDN and DDoS protection
  • Railway — Application and database hosting
  • Sentry — Error tracking (no personally identifiable information is included in error reports)

Each of these services has its own privacy policy. We encourage you to review them.

Cookies

  • We use session cookies strictly for authentication. These are required for the service to function.
  • We do not use advertising cookies.
  • We do not use third-party tracking cookies.

Children's Privacy

UntilReady is restricted to users aged 18 and older. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us at [email protected] and we will delete it promptly.

Your Rights Under GDPR (EU Users)

If you are located in the European Economic Area, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate personal data
  • Request erasure of your personal data (subject to the blockchain permanence limitation described above)
  • Restrict or object to processing of your personal data
  • Data portability — receive your data in a structured format
  • Lodge a complaint with your local data protection authority

The data controller is UntilReady (BB Codex, Inc.), Wyoming, USA. To exercise any of these rights, contact [email protected].

Note on blockchain data: Cryptographic proofs anchored to Arweave are permanent by design and cannot be deleted or modified. These proofs contain only cryptographic hashes — not your files or personal information — but the hashes themselves cannot be removed from the blockchain.

Your Rights Under CCPA (California Users)

If you are a California resident, you have the right to:

  • Know what personal information we collect and how it is used
  • Request deletion of your personal information (subject to the blockchain permanence limitation)
  • Opt out of the sale of personal information
  • Non-discrimination for exercising your privacy rights

We do not sell personal information. To exercise your rights, contact [email protected].

Your Rights

Regardless of your location, you may:

  • Access, correct, or delete your personal data
  • Request a copy of your data in a portable format
  • Close your account at any time

All requests should be directed to [email protected]. We will respond within 30 days.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date. Your continued use of UntilReady after changes are posted constitutes acceptance of the revised policy.

This privacy policy is a draft and is subject to change. For questions, contact [email protected].