Legal

Privacy Policy

Last updated: August 2026

What data we collect

First Light is designed to protect your privacy. Here is exactly what we collect and why:

• Assessment answers — Your responses to the estate planning questions are saved to our servers as you go, so you can leave and come back without losing them. This happens whether or not you have an account. Before you sign in, the answers are tied to a signed identity cookie in your browser rather than to your name or your email address; if your browser refuses that cookie, nothing is saved. Anonymous answers are kept for 90 days after you last change them and are then deleted automatically.
• Moving answers onto your account — Signing in does not by itself move answers you gave anonymously. The cookie shows that someone controls this browser, not who they are, so there are three separate paths and each has its own trigger. Same browser: answers saved on this browser can be picked up again on this browser, signed in or not. Onto your account: re-keying anonymous answers to your account is something you confirm — we ask, and it only happens if you say yes. After a purchase: answers attached to something you bought move to your account once we have established the purchase is yours. Once you are signed in, new answers save straight to your account, and account answers are kept until you ask us to delete them.
• Account information — If you create an account, we collect your email address through Supabase (our authentication provider). We do not collect your name unless you provide it.
• Vault data — If you use First Light Vault to store your documents, your document data is encrypted and stored in Supabase. We do not read the contents of your documents.
• Payment information — Payments are processed by Stripe. First Light never sees or stores your card number, expiration date, or CVV. Stripe handles all payment data.
• Email addresses you give us on a form — If you ask for the new-parent checklist, ask for the free planning resources on your results page, join the attorney list, submit a correction to a published rule, or write to us through the contact form, we store the address you entered along with what you asked for. This is stored on our servers whether or not you have an account. If you ask us to send a one-time note to a person you named in your plan — an executor or agent — we store the address you entered for them together with the record of that delivery. These notes are one-time messages: sending one never adds the recipient to any list.

What we do not collect

• No advertising trackers, retargeting pixels, or social media tracking
• No ad-targeting cookies or cross-site advertising identifiers
• No payment card data (handled entirely by Stripe)
• No contact details bought, scraped, or obtained from anyone but you

We do collect names and contact details, but only where you enter them, and the purpose differs by surface. Planning, document, and intake fields take whatever the documents require — that can include your name and address, and the names of people you are naming, such as a guardian, an executor, or a beneficiary. Contact and support forms take an email address so we can reply, and a name only if you choose to add one; it is optional and the form works without it.

How we use your data

We use your email address to:

• Send you a sign-in link when you ask for one
• Tell you when documents you purchased are ready, with a link to your account — never the documents themselves
• Send you the specific thing you asked a form for, once
• Send a one-time note to a person you named in your plan, when you explicitly preview and send it from your vault
• Reply to you when you contact us

That is the complete list. We do not send marketing or newsletter email, and asking a form for something never adds you to a mailing list by itself — every message we send is a direct response to something you did. Where a form offers an optional updates checkbox, that choice is recorded separately, starts unchecked, and is the only way onto any future list. Purchase receipts come from Stripe, not from us.

The emails we generate — sign-in links, the notice that your documents are ready, form confirmations — never contain your estate planning answers, your documents, or attachments of any kind. They link to your account, where access is controlled by your sign-in — or, for the free planning resources, to a private signed link that opens only your own free resources and expires after seven days.

The one exception is a message you write yourself. If you use the contact form, exactly what you typed is emailed to our support inbox — we cannot filter what you choose to include, which is why the form asks you not to paste document contents or account numbers into it.

We do not sell your data. We do not share your data with third parties except as required to operate the service (Supabase for auth and storage, Stripe for payments, Resend for sending email).

Analytics and diagnostics

First Light loads two third-party browser tools, for two limited purposes. Google Analytics measures aggregated traffic — page views, device category, referral source, and which steps of the check people reach. We configure it as measurement only: advertising storage, ad personalization, and Google Signals are disabled, and the events we send contain no names, email addresses, or account identifiers. Sentry is error monitoring, so we can detect and fix bugs; we redact request contents before error reports leave our systems. Neither tool builds advertising profiles, and we do not use either for ad targeting, retargeting, or to sell your data.

First Light and this policy are intended for United States residents; the service is designed and operated for a US audience.

Your analytics controls

You can turn analytics off entirely, without an account. If your browser sends a Global Privacy Control signal, we honor it automatically — analytics never loads. You can also disable it manually for this device:

Supabase

First Light uses Supabase for authentication and document vault storage. Supabase stores data in the United States. You can review Supabase's privacy practices at supabase.com/privacy.

Stripe

Payment processing is handled by Stripe, Inc. When you purchase a document, you interact directly with Stripe's secure payment form. First Light receives a confirmation of the transaction but never your payment card information. You can review Stripe's privacy policy at stripe.com/privacy.

Resend

Resend, Inc. is our transactional-email processor — every message described above is delivered by them, and they are the only email processor we use. To send you a message, Resend receives your email address, the subject, and the body of that message. First Light's system-generated templates do not include assessment answers, generated legal documents, or attachments, so Resend never receives those. A contact form message is the exception: its body is whatever you wrote. You can review Resend's privacy practices at resend.com/legal/privacy-policy.

Cookies

First Light sets two kinds of cookies: functional cookies needed to operate the site (for example, to keep you logged in), and first-party analytics cookies used to measure aggregate site usage. We do not set advertising or retargeting cookies.

Data retention

If you create an account, your data is retained until you request deletion. If you gave us an email address on a form — the checklist, the attorney list, a rule correction, the contact form — that address is retained until you ask us to remove it, whether or not you have an account. We also keep a record of each email we tried to send you — the address, which message it was, and whether our email provider accepted it. That record is what stops us sending the same message twice. It is not a delivery confirmation: we do not receive notice of whether a message reached your inbox, and we do not track whether you opened it.

To request deletion of your account and data, email legal@planfirstlight.com.

Changes to this policy

We may update this policy as First Light evolves. Changes are published on this page, and the date at the top reflects when the policy was last updated. We do not currently send a notification email when it changes.

Contact

Questions about your data or this policy? legal@planfirstlight.com