Digital Legacy Ownership, Permissions, Succession & Data Retention

Section 1

Purpose & Scope

This document defines the foundational rules governing how Roadmap Legacy handles subscription billing, content ownership, access permissions, succession of authority, cancellation, storage limits, and data retention.

The rules in this document apply across all product tiers, all content types (family tree entries, profiles, photos, videos, audio, documents, stories, Digital Vault items, and Future Messages), and all account lifecycle events (active subscription, cancellation, downgrade, storage overrun, incapacity, death, and deletion).

Core Principle: A canceled subscription is not a deleted legacy. A person’s legacy content belongs to its designated content owner and is not automatically controlled by whoever pays the subscription.

Section 2

Product Tier Structure

Roadmap Legacy offers an Individual membership for one member, a Family package for four members, and a Family AI package for four members with AI features. Family prices cover the full package, not each person. People listed on the family tree do not count as paid users unless they are actively using the app.

Annual subscriptions are billed in one yearly payment. Prices exclude applicable state sales tax.

Section 7

Cancellation & Legacy Preservation

Canceling a paid subscription will never immediately delete a family’s tree, videos, documents, or other legacy content.

7.1 Process

1. Cancel billing, not the legacy. Auto-renewal stops at cancellation; paid features remain available through the end of the current billing period.
2. Legacy Preservation Mode. After the paid period ends, the account becomes read-only. Existing content remains visible to the family; new uploads, AI features, additional storage, and other paid features are disabled.
3. Defined preservation period. Content is preserved for 12 months after the paid subscription ends. During this period, the account owner may reactivate the subscription and regain full access without rebuilding the family legacy.
4. Multiple notices before deletion. The account owner will be notified at cancellation, and again at 90 days, 30 days, and 7 days before scheduled deletion, and immediately before permanent deletion.
5. Export before deletion. The owner may request/download an archive of eligible content before permanent deletion. “Eligible” means content the requesting user owns or has explicit export permission to obtain — not automatically the full family archive.
6. Separate actions. “Cancel Subscription” and “Delete My Legacy” are distinct, clearly differentiated actions. Canceling stops billing. Deleting permanently removes account/data, subject to legal, security, backup, and record-retention requirements.
7. Family ownership is content-level, not tree-level. If one member cancels, that will not automatically erase another member’s independently owned content simply because they appear on the same tree. Ownership and permissions are tracked at the content level (see Section 4).
8. Future Messages require explicit handling at cancellation (see Section 8).

Section 8

Future Messages

A Future Message follows its author/owner, not the person paying for the family subscription.

Example: if Mom creates a Future Message for her daughter but Dad pays for the Family Plan, Dad canceling the subscription must not delete Mom’s message. It remains Mom’s content. Cancellation can affect paid services available to the family; it does not transfer ownership or authorize deletion of another member’s content.

If Mom herself cancels or leaves the family plan, her Future Messages remain associated with her account and follow the applicable preservation/retention rules described in Section 7. A designated Legacy Contact may administer them only to the extent Mom explicitly authorized.

At the point of cancellation, the account owner must decide what will happen to their Future scheduled Messages. Options include:

• Preserve them during the retention period
• Transfer administration to an authorized Legacy Contact, where permitted
• Export them
• Delete them

Section 9

Storage Downgrade / Overrun Policy

If a billing change reduces a family’s storage allotment below what is currently in use (for example, Dad’s plan provided 500 GB and his cancellation drops the family to 50 GB), Roadmap Legacy must never randomly delete or evict content. The resolution order is fixed:

1. Preserve all existing content.
2. Place excess content into read-only archival status.
3. Notify the actual content owners of affected items (not only the billing owner).
4. Grace period: 60 days by default. During this period, existing content remains preserved, in read-only status if necessary. Owners may upgrade, remove content they personally own, or move to a preservation plan.
5. Only after the 60-day grace period expires does eligible content move toward archival/deletion handling, in accordance with the published retention policy — never as an arbitrary or automatic bulk deletion.

A cold-storage/archive tier is recommended as a future enhancement, since it preserves legacy data at materially lower cost than active storage.

Section 10

Export Rules

“Eligible content” means content the requesting user owns or has explicit export permission to obtain. A user cannot download another family member’s privately owned videos, documents, Future Messages, Vault files, or other restricted material merely because they share a Family Tree or because that user pays the subscription.

Example: Dad may export his own videos and documents, plus shared family material for which export permission has been granted. He may not export Mom’s private Vault documents or a confidential Future Message she created for someone else, unless Mom has authorized that access.

Section 11

Succession Verification Workflow

11.1 Death — Staged Verification

Roadmap Legacy will never change an account to deceased status based on a single family-member report.

1. A Legacy Contact or authorized family member submits a succession request.
2. The requester provides evidence, such as a death certificate or other acceptable legal document.
3. The account enters succession pending status.
4. The system immediately notifies the account owner, if reachable, that a succession request has been filed — before any authority transfers and before human review concludes. This gives a living owner an immediate opportunity to contest a false report.
5. The system freezes high-risk actions, including deletion, permanent ownership transfer, and unrestricted export.
6. A human review is completed.
7. If approved, the account status changes to deceased, and succession authority transfers according to the deceased user’s prior instructions.
8. Other authorized contacts receive notice of the change where appropriate.
9. An appeal or reversal process is available if the determination is made in error. A reversal restores the prior owner status.

End of Specification