Lock legacy

Honestly this started from a dumb but real problem — what happens to all your accounts when you're gone and nobody else knows the passwords, the bank details, where the crypto wallet even is. Every "digital legacy" app we looked at either wants you to just trust them with your data in plain text, or they're basically a password manager that assumes you'll always be alive to unlock it yourself. That second one doesn't even make sense for what the product is supposed to do. If the whole point is "for when I'm not here anymore," then it has to actually work when you're not here anymore. That felt like the real problem nobody was solving properly. What it does LegacyLock is an encrypted vault for the stuff your family would have to go hunting for after you're gone — bank accounts, crypto, insurance policies, investments, digital accounts. You set up a check-in schedule (every 30/60/90 days), and if you go quiet past a grace period it starts an escalation. Your nominees get verified, and once release is approved they get a dossier built from everything you saved. The catch, which is also the whole point, is that none of that was ever readable by us before that moment happen We had 51 screens already designed (Tailwind, all static HTML) and had to wire the whole thing together with plain JS — no framework, just reading each screen's own buttons to figure out where they should actually go, plus real slider/form/toggle logic instead of it just sitting there looking clickable. For the encryption we used the Web Crypto API directly in the browser — AES-256-GCM for the actual data, PBKDF2 with a stupid amount of iterations for the key. But the part that took the most time wasn't the encryption itself, it was figuring out inheritance. If only your passphrase can unlock the vault, the vault is useless the second you're not around to type it. So the same key gets wrapped three different times — once with your passphrase, once with a recovery key, and once with a "release passphrase" you're supposed to tell your nominees separately, like writing it in a will. All three work independently and we never see any of them. Backend is Python, FastAPI, Postgres through Supabase, Firebase for auth. There's a cron job that checks who's overdue on their check-in, and we hooked up the Claude API to do a first pass on uploaded documents (death certificates, ID stuff) — it flags things a human should look at, it doesn't approve anything on its own. Challenges we ran into Mostly the crypto part. It's not hard to make a vault only one person can open, and it's not hard to make a vault a company can always open. Making one that nobody but us can read AND still works when the original person is gone took a few tries to get right. Also just wiring 51 separate screens without breaking or changing any of the actual design was more tedious than we expected — every button had different text, different structure, nothing was consistent. Accomplishments we're proud of Getting the three-way key wrapping actually working end to end, not just as an idea on paper. And having all 51 screens actually functional instead of just looking like a prototype. What we learned A lot of products say "zero-knowledge" without really thinking through what breaks if you take that seriously — recovery and inheritance specifically. If you don't design for that from day one it just quietly doesn't work when someone actually needs it. What's next Real ID verification instead of our current stub, splitting the release key across multiple nominees instead of one passphrase being a single point of failure, and getting an actual security audit done before this touches anyone's real financial data.