Terms of Service

1. Who we are, and what this covers

"AmberKey", "we", "us", and "our" mean Tarnover, LLC, a limited liability company, and the AmberKey service it operates at amberkey.app and related subdomains. "You" means the individual who creates an AmberKey account (the "owner"). "Circle members" are the people you designate to help recover your vault; they are not parties to these terms and are never required to hold an account. By creating an account or using the service, you agree to these terms. If you do not agree, do not use the service.

2. Eligibility and your account

You must be at least 18 and able to form a binding contract. You are responsible for your account and for the security of the device and authentication method (passkey or authenticator app) you use to access it. Notify us promptly at security@amberkey.app if you believe your account has been accessed without your authorization. One person, one account; you may not share account credentials.

3. What the service does

AmberKey provides tooling for end-of-life planning: client-side encryption of a family backup, secret-sharing kit generation, liveness monitoring (check-ins and an escalation ladder), circle health checks, coordination of a recovery ceremony, and delivery of your encrypted bundle to your circle when a recovery is legitimately triggered. All cryptographic operations happen on your devices. We store and transmit only encrypted material and the minimum coordination metadata described in our Privacy Policy.

4. What we never hold (the core guarantee)

We never hold your vault key, any share of it, or the plaintext of your bundle. Our servers are technically incapable of decrypting your vault — they only ever hold ciphertext — and no term of service, support process, business change, or legal instrument directed at us can change that. Recovery of your vault requires your circle's printed cards, which exist only in their hands. This section is not a promise of good behavior; it is a description of an architecture in which the promise is unnecessary.

5. Your responsibilities

Because we cannot decrypt or regenerate your vault, some duties are yours alone:

• choosing your recovery circle and the people you trust with it;
• distributing printed cards, and destroying old cards after a re-share;
• keeping your contact channels and your circle's contact details current;
• responding to check-ins so the liveness system reflects reality;
• exporting and safely keeping a copy of your family backup when prompted.

Loss is unrecoverable by design. If every copy of your bundle is lost, or if a reconstructable quorum of cards is lost or destroyed, your vault cannot be recovered by you, by us, or by anyone. This is the direct consequence of Section 4 and is not a defect.

Compliance with your providers' terms. Many online services restrict or prohibit sharing account credentials, treat accounts as non-transferable on death, or forbid anyone from signing in as the account holder, and some laws (such as the U.S. Stored Communications Act) and fiduciary-access statutes similarly limit posthumous access. Whether and how you may store a given account's credentials, or arrange for someone to reach that account after your death, is governed by that provider's terms and by applicable law, not by AmberKey. You are responsible for ensuring that the plan you build, and any access your circle later exercises, complies with each provider's terms and the law. Where a provider offers a native legacy or beneficiary tool, using it is generally safer and more likely to be honored than relying on stored credentials; our playbooks point you to those tools first. For services with no such tool, exporting your own data through the provider's export feature and encrypting it to your archive key for your circle is the sanctioned path, and does not require anyone to sign in as you.

6. Recovery triggers and the veto window

A recovery is "legitimately triggered" when, and only when, this sequence completes: you miss your check-ins; the escalation ladder runs in full (repeated reminders by email and, if configured, text message, then a query to your trusted contacts, over a period of weeks); only then may a circle member holding a valid link initiate a recovery ceremony. Release additionally requires confirmations from the quorum you configured and a veto window you set (3 to 14 days) passing without any response from you. AmberKey attempts to notify you through every channel you have configured at each stage. Any check-in or explicit veto by you cancels the ceremony and resets the watch, including after a mistaken release: checking in revokes the released state and its download links.

AmberKey verifies process, not facts: we verify link validity, confirmation counts, and time windows. We cannot and do not verify that you have actually died or become incapacitated; the protections against a wrongful release are the escalation's length, your veto, and your circle's honesty. You accept that if you do not respond during the full escalation and veto window, your circle may proceed and your encrypted bundle may be released to them; this is the intended function of the product, not a malfunction.

7. Text messages (SMS) and consent

If you provide a mobile number and opt in, you agree to receive transactional text messages from AmberKey: check-in reminders and account or recovery alerts. If you designate circle members and provide their numbers, you confirm you have their permission to be contacted for recovery purposes, and they receive texts only when a recovery or escalation involving you occurs. We send no marketing texts. Message frequency varies and is event-driven; message and data rates may apply. Opt out at any time by replying STOP to any message or by removing the number in the app, and reply HELP for help. Opting out of texts does not affect email notifications or the rest of the service. Mobile numbers and consent are never shared with third parties for their own marketing.

8. Not a will; not legal advice

AmberKey is not a will, trust, power of attorney, or any estate-planning legal instrument, and nothing in the product or its documentation is legal, financial, or tax advice. Our playbooks describe provider mechanisms and general procedures; they are not tailored to your situation and providers' policies change. We strongly recommend working with a licensed estate attorney. AmberKey complements legal documents; it does not replace them.

9. Subscription, billing, and cancellation

Planning features are free. Operational features (the check-in watch, health checks, ceremony coordination, notifications, and hosted storage of your client-side-encrypted family backup) are a yearly subscription billed through our payment processor (Stripe): currently $79/year for The Watch or $119/year for Household (two people), plus any applicable taxes. The exact price and the renewal date are shown at checkout before you pay.

Subscriptions renew automatically each year until you cancel. You can cancel online at any time from your billing page; cancelling stops the next renewal, and the watch runs to the end of the period you already paid for. Every paid plan comes with a 30-day full refund, no questions asked.

If a renewal payment fails, or a cancelled period runs out, we tell you immediately and the watch keeps running through a 90-day grace period while you sort it out. After the grace period the watch pauses. Pausing never affects planning features, your stored bundles, your ability to decrypt with your cards and the offline tool, or your printed cards, none of which expire. Leaving is free.

10. Wind-down commitment (survives assignment)

If we decide or are compelled to cease operating the hosted service, we commit to the following, and this section survives any assignment, sale, merger, or acquisition of AmberKey or its assets:

• Twelve months' notice before shutdown, by email to every account, on the website, and in the public repository.
• Final-state offline conversion: a final release converting the product to a fully offline flow (guided export, kit re-printing, and the documented offline ceremony in place of hosted coordination).
• Continuous availability: your encrypted bundles remain downloadable throughout the entire wind-down period.
• No new lock-in: during wind-down we will introduce no change that increases dependence on our infrastructure.

Independently of this commitment, the recovery tool and specifications are already open source and mirrored (see the continuity plan), so even a disorderly failure on our part does not prevent recovery.

11. Acceptable use

Use the service lawfully and for its intended purpose. Do not abuse the notification channels, attempt to access another owner's account or data, probe or disrupt the service except through our stated security-disclosure process (see SECURITY.md), or use AmberKey to store material you have no right to store. We may suspend an account that endangers the service or other users; we will still honor Section 4 (what we never hold) and Section 10 (the wind-down commitment) with respect to your data.

12. Service "as available"; warranty disclaimer

The hosted service is provided "as is" and "as available", without warranties of any kind to the extent permitted by law. We do not warrant that check-ins, notifications, or coordination will be uninterrupted or error-free. Because the system is deliberately slow and forgiving (multi-week escalation, veto windows, local-first bundles), transient outages are designed to be survivable, but we do not guarantee delivery of any individual notification. The open-source recovery tool and specifications are provided under the Apache-2.0 license, whose disclaimer applies to them.

13. Limitation of liability

To the maximum extent permitted by law, AmberKey and Tarnover, LLC will not be liable for indirect, incidental, special, consequential, or punitive damages, or for loss arising from your loss of cards or bundles, a circle member's action or inaction, your failure to respond to check-ins, or any provider suspending, closing, penalizing, or declining to transfer an account or any other consequence of a plan that conflicts with a third-party provider's terms or applicable law. Our aggregate liability for any claim is limited to the amount you paid us in the twelve months before the claim. Some jurisdictions do not allow certain limitations; where that is so, these limits apply to the fullest extent permitted. Final caps and carve-outs will be set with counsel.

14. Changes to these terms

We may update these terms. Material changes will be announced by email and on the website with reasonable notice before they take effect. Changes will never contradict Section 4 (what we never hold), Section 9's cancellation and refund rights, or Section 10 (the wind-down commitment). Continued use after changes take effect constitutes acceptance.

15. Governing law, disputes, and contact

Tarnover, LLC is a California limited liability company, and these terms are governed by the laws of the State of California, without regard to its conflict-of-law rules. Any dispute that can't be resolved informally (email us first. Most things can be) will be settled by binding arbitration in California, on an individual basis; either party may instead bring qualifying claims in small-claims court. Final arbitration provider, rules, and any opt-out mechanics are subject to counsel review before general availability. Questions about these terms: hello@amberkey.app. Security matters: security@amberkey.app.

See also the Privacy Policy and the security & threat model.