The Only Step

Legal

Privacy Policy

Only Step LLC  ·  Effective Date: September 1, 2026

What this means in plain English

We collect only what we need to run the Service. We never sell your data — not your personal information, not your financial account details, not to anyone, ever. The financial information you store is treated as sensitive and protected with security safeguards. You decide who sees your information. You can request deletion of your data at any time.

This Privacy Policy explains how Only Step LLC ("Only Step," "Company," "we," "us," or "our") collects, uses, discloses, and protects information when you use the Service.

1. Information We Collect

1.1 Information You Provide — Primary Users

  • Account details (name, email, login credentials)
  • Financial institution and account-related information you choose to store
  • Insurance policy information
  • Contact details and relationship information for designated Trusted Contacts and Survivors

Users are responsible for ensuring that information provided regarding trusted contacts, family members, executors, beneficiaries, or other third parties is accurate and that any necessary permissions, consents, or legal authority required to provide such information have been obtained. Only Step LLC does not independently verify any information entered by users.

We collect only the information necessary to provide the Service. You are not required to store any minimum amount of information, and you should avoid storing information that is not necessary for the intended purpose of the Service.

1.2 Information Collected From Survivors and Authorized Users

When a person accesses the Service as a result of an invitation or designation by a primary user ("Survivor" or "Authorized User"), Only Step LLC collects:

  • Account registration information (name, email, login credentials) if they create an account
  • Login and access activity associated with their account
  • Device and browser data
  • Any information they enter or update within their own account

Survivor and Authorized User accounts are subject to this Privacy Policy in the same manner as primary user accounts.

1.3 Payment Information

Payments are processed by Stripe or other providers as necessary. We do not store full payment card data. Payment processing is subject to Stripe's own privacy policy and terms of service.

1.4 Automatically Collected Data

  • IP address
  • Device and browser data
  • Usage and interaction data (pages visited, features used, time spent)
  • Log data and error reports

1.5 Sensitive Information

The Service is designed to store information relating to financial institutions, accounts, policies, and related matters. Only Step LLC treats all such information as sensitive and implements bcrypt password hashing, TLS encryption in transit, field-level AES-128 (Fernet) encryption of sensitive stored data at rest, and secure file storage via Cloudflare R2 to protect it.

Only Step LLC does not request or require full payment card information, bank login credentials, or other credentials that would allow direct access to financial accounts.

2. Purpose of Processing

We process data to:

  • Provide, operate, and improve the Service
  • Process subscriptions and payments
  • Maintain security and integrity of the Service
  • Communicate with users regarding their accounts
  • Enable designated Survivors and Authorized Users to access information as configured by the primary user
  • Comply with legal obligations

2.1 Marketing Communications

By creating an account, you are opted in to marketing communications at registration. Users may elect to receive newsletters, product announcements, surveys, and promotional communications from Only Step LLC. Consent may be withdrawn at any time by using the unsubscribe link in any marketing email or by contacting Only Step LLC. Users will continue to receive transactional and service-related communications (such as billing notices and account alerts) regardless of marketing preferences.

3. Legal Basis for Processing

Where applicable (including under GDPR and similar frameworks), we rely on:

  • Contract performance — processing necessary to provide the Service you signed up for
  • Legitimate interests — security monitoring, fraud prevention, and Service improvement
  • Legal obligations — compliance with applicable law
  • Consent — for optional marketing communications

4. Data Sharing

We do not sell personal data. We do not profile users for advertising purposes or share financial institution information with third parties for marketing purposes.

Information stored by a primary user may be disclosed to Survivors and Authorized Users designated by that user, in accordance with the access permissions configured within the Service. Only Step LLC does not independently determine whether any individual is legally entitled to receive such information.

We may share data with:

  • Service providers that assist in operating the Service, including payment processing (Stripe), hosting (Railway), email delivery (Resend), SMS and communications (Twilio), content management (Sanity), file storage (Cloudflare R2), cookie consent management (CookieYes), and analytics (Google Analytics)
  • Legal authorities when required by applicable law or in response to valid legal process
  • A purchaser, successor, or other entity involved in a merger, acquisition, sale of assets, reorganization, or similar transaction — you will be notified of such a transfer

We may also disclose information to protect the rights, property, or safety of Only Step LLC, our users, or others, or to investigate fraud, security incidents, or violations of these Terms.

4.1 Lapsed Account Survivor Access and Fees

If a user's subscription lapses and a designated Survivor subsequently requests access to stored information, Only Step LLC will contact the Survivor using the contact information provided by the primary user. At that time, Only Step LLC will disclose the existence of the account, the nature of the information stored, and the fee required to access it ($500 for the first year; $100 per year thereafter). Only Step LLC will process the Survivor's personal information (name, email, payment details) solely for the purpose of verifying their identity, collecting the applicable fee, and providing access to the stored information.

4.2 User Consent to Survivor Disclosure

By designating Survivors or Trusted Contacts within the Service, you expressly consent to Only Step LLC contacting those individuals and disclosing the existence of your account and any applicable access fees in the event your subscription lapses. This consent survives the cancellation, lapse, or expiration of your subscription and your death or incapacity.

4.3 Authorized Individuals and Survivor Access

When a Survivor or Authorized User accesses the Service, only the information that the primary user has authorized for sharing will be made available. The scope of access (Notify-level or Dashboard-level) is determined solely by the primary user's settings.

Only Step LLC does not independently verify the identity, legal authority, or relationship of any Survivor or Authorized User beyond the authentication required to access the Service.

4A. We Do Not Sell Your Personal Information

Only Step LLC does not sell, rent, trade, license, or otherwise transfer your personal information to any third party for their marketing, advertising, or commercial purposes.

We do not participate in data broker networks. We do not use your personal information or the financial account information you store to build advertising profiles. We do not share your data with ad networks, data aggregators, or any party whose business model involves monetizing personal information.

The financial account information and notes you store within the Service are treated as strictly private. They are never used for purposes beyond delivering the Service to you and your designated Survivors.

California residents have the right to opt out of the sale or sharing of personal information under the California Consumer Privacy Act (CCPA). Because Only Step LLC does not sell or share personal information for cross-context behavioral advertising, no opt-out is required. To submit a privacy rights request or ask questions about our data practices, contact us via the Contact Us form at only-step.com.

5. Data Retention

We retain your data as follows:

  • Active accounts — data is retained for the duration of your active subscription
  • Subscription cancelled or expired — data is retained until you close your account; there is no automatic deletion triggered by cancellation or non-payment alone
  • Payment lapsed — data is retained until you close your account
  • Deceased user accounts — data is retained until the account is closed or the Service is discontinued; designated Survivors may access stored information via the process described in our Terms of Service Section 9
  • As required by applicable law — certain records may be retained longer to comply with legal obligations

Only Step LLC will send at least one reminder notification to the address on file prior to permanent deletion following account closure. Once data is permanently deleted, it cannot be recovered. Users are responsible for maintaining current contact information to receive these notices.

6. Security and Encryption

Only Step LLC implements the following safeguards to protect your information:

  • Field-level encryption of sensitive stored data (financial institution names and notes) using AES-128 symmetric encryption (Fernet) at rest
  • All data transmitted over HTTPS using TLS encryption in transit
  • Access controls limiting employee access to user data
  • Periodic internal security reviews and access controls limiting employee access to user data

NO METHOD OF TRANSMISSION OR STORAGE IS 100% SECURE.

6.1 Security Incident Notification

In the event of a confirmed security incident involving personal information, Only Step LLC will investigate and provide notification as required by applicable law. Users are responsible for maintaining the confidentiality of their account credentials and for securing devices used to access the Service.

7. User Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access — request a copy of the personal information we hold about you
  • Correction — request correction of inaccurate information
  • Deletion — request deletion of your personal information (see Section 7.1)
  • Data portability — request your data in a portable format
  • Objection or restriction — object to or request restriction of certain processing

To exercise any of these rights, submit a request via the Contact Us form at only-step.com via the Contact Us form. We will respond within 45 days of receiving a verified request, as required by applicable law. California residents may have additional rights under the CCPA.

7.1 Data Deletion Requests

You may request deletion of your personal information at any time. Deletion requests can be submitted via the Close Account option in Account Settings, which initiates a 90-day deletion window, or via the Contact Us form. Upon verification, we will delete your personal information within 90 days, subject to retention obligations described in Section 5. Certain information may be retained as required by law, for security purposes, dispute resolution, fraud prevention, or legitimate business purposes.

7.2 Deceased User Data Requests

An executor, legal representative, or authorized next of kin of a deceased user may contact Only Step LLC to request access to, export of, or deletion of a deceased user's account data. Only Step LLC may require documentation (such as a death certificate, letters testamentary, or other proof of authority) before taking action on such a request. Only Step LLC will respond to verified requests within 15 business days of receiving valid documentation. Required documentation includes a death certificate and letters testamentary or other proof of legal authority.

8. Cookies and Tracking Technologies

We use cookies and similar technologies for:

  • Authentication — keeping you logged in securely
  • Performance — understanding how the Service is used to improve it
  • Analytics and user experience — using Google Analytics (behavior tracking), Microsoft Clarity (UX behavior), and Google Search Console (SEO tracking)

Cookie consent is managed through CookieYes, our consent management platform. You may review and update your cookie preferences at any time via the cookie banner. Disabling non-essential cookies through your browser settings or the consent manager may affect certain Service functionality.

9. Third-Party Data Entered by Users

When users enter information about third parties — including names, contact details, and relationships of Trusted Contacts, family members, executors, or beneficiaries — Only Step LLC processes that information on behalf of the user solely to provide the Service.

Users are responsible for ensuring they have the right to provide such information and that doing so does not violate applicable law or any obligation owed to the third party. Only Step LLC does not independently verify or use third-party information for any purpose other than delivering the Service.

10. International Transfers

Your information may be stored, processed, and transferred in the United States and other jurisdictions where our service providers operate. Data protection laws in those jurisdictions may differ from those in your place of residence. Where required, Only Step LLC will implement appropriate safeguards for international transfers in accordance with applicable law.

11. Children

The Service is not intended for individuals under 18 years of age. Only Step LLC does not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide notice via email to the address on file at least 30 days prior to the changes taking effect. Continued use of the Service following the effective date constitutes acceptance of the revised policy.

13. Contact

For questions about this Privacy Policy or to submit a data request, contact us via the Contact Us form at only-step.com. For privacy-specific requests, please indicate "Privacy Request" in your message so we can route it appropriately.