AmberKey

Legal

Terms of Service

Draft, pending legal review. AmberKey is in development. These terms reflect how the product actually works and the commitments we intend to be bound by, but they will be reviewed by counsel before launch and may change. The two guarantees that matter most, that we can never decrypt your vault (Section 4) and our wind-down commitment (Section 9), are structural and will survive review in substance.

Last updated: July 8, 2026 · Operated by Tarnover, LLC.

1. Who we are, and what this covers

"AmberKey", "we", "us", and "our" mean Tarnover, LLC, a limited liability company, and the AmberKey service it operates at amberkey.app and related subdomains. "You" means the individual who creates an AmberKey account (the "owner"). "Circle members" are the people you designate to help recover your vault; they are not parties to these terms and are never required to hold an account. By creating an account or using the service, you agree to these terms. If you do not agree, do not use the service.

2. Eligibility and your account

You must be at least 18 and able to form a binding contract. You are responsible for your account and for the security of the device and authentication method (passkey or authenticator app) you use to access it. Notify us promptly at security@amberkey.app if you believe your account has been accessed without your authorization. One person, one account; you may not share account credentials.

3. What the service does

AmberKey provides tooling for end-of-life planning: client-side encryption of a continuity bundle, secret-sharing kit generation, liveness monitoring (check-ins and an escalation ladder), circle health checks, coordination of a recovery ceremony, and delivery of your encrypted bundle to your circle when a recovery is legitimately triggered. All cryptographic operations happen on your devices. We store and transmit only encrypted material and the minimum coordination metadata described in our Privacy Policy.

4. What we never hold (the core guarantee)

We never hold your vault key, any share of it, or the plaintext of your bundle. We are technically incapable of decrypting your vault, and no term of service, support process, business change, or legal instrument directed at us can change that. Recovery of your vault requires your circle's printed cards, which exist only in their hands. This section is not a promise of good behavior; it is a description of an architecture in which the promise is unnecessary.

5. Your responsibilities

Because we cannot decrypt or regenerate your vault, some duties are yours alone:

  • choosing your recovery circle and the people you trust with it;
  • distributing printed cards, and destroying old cards after a re-share;
  • keeping your contact channels and your circle's contact details current;
  • responding to check-ins so the liveness system reflects reality;
  • exporting and safely keeping a copy of your continuity bundle when prompted.

Loss is unrecoverable by design. If every copy of your bundle is lost, or if a reconstructable quorum of cards is lost or destroyed, your vault cannot be recovered by you, by us, or by anyone. This is the direct consequence of Section 4 and is not a defect.

6. Recovery triggers and the veto window

A recovery ceremony can be initiated by a circle member only after the liveness escalation completes, or immediately if a member asserts a death certificate (an informational flag we do not independently verify). Every ceremony notifies you on all channels and opens a veto window you configure (3 to 14 days). Any check-in or explicit veto by you cancels the ceremony and resets liveness. You accept that if you do not respond during the full escalation and veto window, your circle may proceed and your encrypted bundle may be released to them; this is the intended function of the product, not a malfunction.

7. Text messages (SMS) and consent

If you provide a mobile number and opt in, you agree to receive transactional text messages from AmberKey: check-in reminders and account or recovery alerts. If you designate circle members and provide their numbers, you confirm you have their permission to be contacted for recovery purposes, and they receive texts only when a recovery or escalation involving you occurs. We send no marketing texts. Message frequency varies and is event-driven; message and data rates may apply. Opt out at any time by replying STOP to any message or by removing the number in the app, and reply HELP for help. Opting out of texts does not affect email notifications or the rest of the service. Mobile numbers and consent are never shared with third parties for their own marketing.

8. Not a will; not legal advice

AmberKey is not a will, trust, power of attorney, or any estate-planning legal instrument, and nothing in the product or its documentation is legal, financial, or tax advice. Our playbooks describe provider mechanisms and general procedures; they are not tailored to your situation and providers' policies change. We strongly recommend working with a licensed estate attorney. AmberKey complements legal documents; it does not replace them.

9. Subscription, billing, and cancellation

Planning features are free. Operational features (the dead man's switch, health checks, ceremony coordination, notifications, and server-side encrypted backup) are, at launch, a yearly subscription. Fees, renewal, and any refund terms will be presented at purchase and are subject to counsel review. You may cancel at any time. Cancellation stops hosted coordination but never affects your ability to decrypt your bundle with your cards and the offline tool. If a payment lapses, the switch continues to watch for twelve additional months, your bundles remain downloadable, and your cards and the offline tool never expire. Leaving is free.

10. Wind-down commitment (survives assignment)

If we decide or are compelled to cease operating the hosted service, we commit to the following, and this section survives any assignment, sale, merger, or acquisition of AmberKey or its assets:

  • Twelve months' notice before shutdown, by email to every account, on the website, and in the public repository.
  • Final-state offline conversion: a final release converting the product to a fully offline flow (guided export, kit re-printing, and the documented offline ceremony in place of hosted coordination).
  • Continuous availability: your encrypted bundles remain downloadable throughout the entire wind-down period.
  • No new lock-in: during wind-down we will introduce no change that increases dependence on our infrastructure.

Independently of this commitment, the recovery tool and specifications are already open source and mirrored (see the continuity plan), so even a disorderly failure on our part does not prevent recovery.

11. Acceptable use

Use the service lawfully and for its intended purpose. Do not abuse the notification channels, attempt to access another owner's account or data, probe or disrupt the service except through our stated security-disclosure process (see SECURITY.md), or use AmberKey to store material you have no right to store. We may suspend an account that endangers the service or other users; we will still honor Sections 4, 8, and 9 with respect to your data.

12. Service "as available"; warranty disclaimer

The hosted service is provided "as is" and "as available", without warranties of any kind to the extent permitted by law. We do not warrant that check-ins, notifications, or coordination will be uninterrupted or error-free. Because the system is deliberately slow and forgiving (multi-week escalation, veto windows, local-first bundles), transient outages are designed to be survivable, but we do not guarantee delivery of any individual notification. The open-source recovery tool and specifications are provided under the Apache-2.0 license, whose disclaimer applies to them.

13. Limitation of liability

To the maximum extent permitted by law, AmberKey and Tarnover, LLC will not be liable for indirect, incidental, special, consequential, or punitive damages, or for loss arising from your loss of cards or bundles, a circle member's action or inaction, or your failure to respond to check-ins. Our aggregate liability for any claim is limited to the amount you paid us in the twelve months before the claim. Some jurisdictions do not allow certain limitations; where that is so, these limits apply to the fullest extent permitted. Final caps and carve-outs will be set with counsel.

14. Changes to these terms

We may update these terms. Material changes will be announced by email and on the website with reasonable notice before they take effect. Changes will never contradict Sections 4, 8, or 9. Continued use after changes take effect constitutes acceptance.

15. Governing law and contact

Governing law and venue will be specified with counsel prior to launch (expected: the state of Tarnover, LLC's formation). Questions about these terms: hello@amberkey.app. Security matters: security@amberkey.app.

See also the Privacy Policy and the security & threat model.