Privacy Policy

Khaznad is an Islamic Estate Vault: a secure digital platform that allows Muslim and Somali families to document their assets, record their final wishes, and ensure their families are protected when they pass away.

Khaznad is operated by Khaznad LLC, a Limited Liability Company registered in the State of Minnesota, United States. You can contact us at any time at info@khaznad.com.

In this policy, when we say "Khaznad", "we", "us", or "our" we mean Khaznad LLC. When we say "you" or "member" we mean anyone who has created a Khaznad account.

Before reading the details, here is what we believe and how we operate:

• We will NEVER sell your personal data to anyone under any circumstances.
• We will NEVER share your data with advertisers, data brokers, or marketing companies.
• We will NEVER share your data with any government agency unless compelled by a valid court order, and even then we will notify you unless a court order prohibits us from doing so.
• We CANNOT read the contents of your encrypted documents, voice messages, or video messages. This is not a policy: it is a technical reality explained in Section 7.
• We will always tell you clearly what we collect, why we collect it, and who if anyone can see it.

When you create a Khaznad account, we collect:

• Your name and email address
• Your preferred language (English or Somali)
• Your country of residence
• If you sign in with Google: your name and email address provided by Google. We never receive or store your Google password.
• If you create a traditional account: your email address and a hashed version of your password. We cannot reverse a hashed password back to the original.
• Your profile information including spouse name, children names, and emergency contact, which you provide voluntarily to help organize your vault

IMPORTANT: The contents of your vault, meaning your uploaded documents, voice notes, video messages, notes, and asset information, are encrypted before they reach our servers using zero-knowledge encryption. We cannot read them. Our staff cannot read them. If the government asks for them, we can only hand over scrambled data that is mathematically impossible to read without your encryption key. This is explained fully in Section 7.

We do store the following vault metadata, meaning information about your vault but not the contents inside it:

• Which document categories you have completed and which remain incomplete
• The names and file sizes of uploaded documents (but not the content inside them)
• The date and time documents were uploaded
• The names of your designated executors (but not their access credentials)
• Your vault completion percentage

All payment processing is handled by a secure third-party payment provider. We do not store your credit card number, bank account details, or any payment credentials on our servers. Our payment processor handles all payment data according to its own privacy policy and PCI-DSS security standards.

We do store: your subscription plan, payment status, billing history dates, and whether your account is current or in a grace period.

When you use Khaznad, we automatically collect limited technical information:

• Your IP address at the time of login
• The type of browser and device you use
• The date and time of your sessions
• Which pages and sections of the portal you visit
• Error reports if the platform malfunctions

We use this data solely to operate and improve the platform. We do not use it for advertising or sell it to any third party.

If you choose to invite a support agent into your portal using our Support Token feature, we record the date, time, duration, and which sections of your vault the agent viewed. You can view this history at any time from your account settings. Support agents can never view the contents of your uploaded documents: only your vault structure and completion status.

If you contact us by email or through the in-portal messaging system, we retain those communications in order to help resolve your question and improve our service.

We collect data in three ways:

• Directly from you: when you sign up, build your vault, upload documents, contact support, or update your profile.
• Automatically: through technical systems when you use the platform, such as login timestamps and error logs.
• From third parties: when you sign in using Google, that service provides your verified email address and name to confirm your identity. We do not receive any other information from them.

We use your data for the following purposes and nothing else:

• To create and manage your account
• To store your encrypted vault content securely
• To track your vault completion and send you helpful reminders
• To process your subscription payments
• To communicate with you about your account

When an executor submits a death claim, we use the deceased member's account information and the executor's submitted documentation to verify the claim and coordinate vault release. This is the core purpose of the platform and is described in our Terms of Service.

We use anonymized and aggregated usage data to understand how members use the platform, identify problems, and improve the service. This data cannot be used to identify individual members.

In limited circumstances described in Section 8, we may be required by law to disclose certain information. We will always minimize what we disclose and notify you wherever legally permitted.

We will NEVER use your data to:

• Sell advertising or target you with ads
• Share with data brokers or marketing companies
• Train artificial intelligence models
• Profile you based on your religion, ethnicity, or background
• Any purpose not described in this policy

We share your data only in the following limited circumstances:

We use a small number of trusted technology companies to operate the platform. Each processes only the data necessary for its specific function and is bound by data protection agreements. We identify them below by category rather than by name, since the specific company can change as the platform grows without changing what it can or cannot see.

When you designate someone as an executor, they receive a unique access credential that allows them to access your vault after your death is verified. They do not have access to your vault while you are alive unless you specifically activate the Support Token feature to invite them for assistance.

This is described in full in Section 8. We share data in response to legal orders only when required by law and only to the minimum extent required.

If Khaznad is acquired by another company, merged, or ceases operations, we will notify all members at least 30 days in advance. Members will be given the opportunity to download all their data before any transfer. Any acquirer will be required to maintain the same privacy commitments described in this policy or we will delete all member data before transfer.

This section is important. Please read it. It explains the technical protection that makes Khaznad different from almost every other document storage service.

Zero-knowledge encryption means that your documents, voice messages, video messages, and vault notes are scrambled on your device before they are sent to our servers. By the time your files reach Khaznad's systems, they are already unreadable.

Think of it like this: you put your documents in a safe, lock the safe with your own key, and then hand us the locked safe. We store the locked safe. But we do not have the key. We cannot open the safe. We cannot read what is inside. Even if someone broke into our building and stole the safe, it would be completely useless without your key.

When you upload a document or record a message:

1. Your device (phone or computer) generates an encryption key from your access phrase. This happens entirely on your device. The key never leaves your device.
2. Your document is scrambled using military-grade encryption (AES-256-GCM) on your device before it goes anywhere.
3. Only the scrambled, unreadable version travels to our servers.
4. Our servers store only the scrambled data. We cannot decrypt it. Our staff cannot decrypt it. Not even the founders of Khaznad can decrypt it.
5. When you want to view your documents, your device retrieves the scrambled data and uses your access phrase to unscramble it, entirely on your device.

• If our servers are hacked, the attacker gets only scrambled data that is mathematically impossible to read.
• Our employees cannot read your documents, even if they wanted to.
• We cannot sell or share the contents of your vault even if we tried, because we cannot read it.
• If the government orders us to hand over your data, we can only provide scrambled data that is useless without your access phrase.

IMPORTANT: Because we do not hold your encryption key, we cannot recover your vault if you lose your access phrase. This access phrase is generated when you set up your account, and it is the ONLY way to unlock or recover your vault. Store it somewhere safe: write it on paper and keep it secure. If you lose your access phrase, your vault contents cannot be recovered by anyone, including Khaznad.

We know that many members of the Somali and Muslim communities have experienced government surveillance and have legitimate concerns about sharing sensitive information. We take these concerns seriously and we are committed to being completely transparent about what can and cannot happen.

If we receive a subpoena, court order, National Security Letter, or any other legal demand for member data, we will:

• Review it carefully to confirm it is valid and legally binding.
• Provide only the minimum data required: nothing more.
• Notify you immediately of the request, unless a court order specifically prohibits us from doing so.
• Challenge the order in court if we believe it is overbroad, unlawful, or targets you without proper legal basis.
• Publish a transparency report twice per year listing the number of legal requests we have received, even if we cannot describe their contents.

Khaznad uses zero-knowledge encryption as described in Section 7. This means:

When the government subpoenas Khaznad with zero-knowledge encryption in place: Khaznad hands over encrypted data. The government receives unreadable scrambled blobs. Without your access phrase, which we do not have, the data is mathematically impossible to decrypt. Khaznad has fully complied with the law and provided everything it possesses. We simply do not possess the keys to decrypt it.

In concrete terms, the following is what we can provide to government if ordered to do so:

• Your name and email address
• Your account creation date and login history
• Your subscription and payment records (no card details)
• The names and file sizes of your uploaded documents, but not their contents
• Your vault completion status and activity logs

The following is what we CANNOT provide, because we genuinely do not have it:

• The contents of any document, voice note, video message, or note you have uploaded, these are encrypted and we hold no decryption key
• Your access phrase
• Your executor access credentials

This is an important question and we want to answer it honestly. The government can in certain circumstances attempt to compel you, the member, to produce your vault contents, bypassing Khaznad entirely. Here is what you should know:

The Fifth Amendment to the United States Constitution protects you from being compelled to be a witness against yourself. Depending on the circumstances, being forced to provide your access phrase may constitute protected testimony. This area of law is actively being litigated in US courts and the protections vary by situation. We strongly recommend consulting a qualified attorney if you receive any legal order related to your Khaznad account.

US Customs and Border Protection has broad authority to search devices at international borders without a warrant. If you cross an international border with an active Khaznad session on your phone, this creates a vulnerability that encryption cannot fully protect against. Your vault automatically locks and clears its decryption key after 10 minutes of inactivity, but this does not sign you out of your account or close your session. We recommend logging out of the Khaznad app completely before international travel.

If law enforcement seizes your device while your Khaznad session is active, they may be able to access your vault through the open session. This is another reason to log out when not actively using the app.

Khaznad's zero-knowledge encryption protects you against our company being compelled to hand over your documents. It does not protect you if the government compels you directly, seizes your device with an active session, or conducts a border search. These are real limitations. No technology can provide absolute protection against all legal mechanisms. Zero-knowledge encryption significantly raises the difficulty and legal burden for government access. It does not eliminate all risk.

Khaznad will never voluntarily share your data with any government agency without a valid legal order. We will never hand over your data to law enforcement as a courtesy. We will never cooperate with informal requests that are not backed by valid legal process. We will always fight overbroad requests. We will always tell you what we can.

This is our commitment to you and to our community.

The FBI may issue National Security Letters (NSLs) to companies demanding data without court approval. NSLs come with gag orders that legally prohibit us from telling you we received one. If we receive an NSL, we will provide only what we are legally required to provide, which, due to zero-knowledge encryption, is only scrambled data we cannot decrypt. We will include a statement in our twice-yearly transparency report if we have received any NSLs, using language permitted by law.

Khaznad stores data on servers located in the United States. Encrypted vault files, account records, and the application itself are hosted with established cloud infrastructure providers, each bound by data protection agreements.

All data stored within the United States is subject to US federal law including the CLOUD Act and Stored Communications Act, as described in Section 8. We will consider requests from members in the UK and EU for data to be stored in those regions as our platform grows.

We take the following technical and organizational security measures:

• All data in transit is protected by TLS 1.3 encryption.
• All vault files are encrypted at rest using AES-256 encryption before storage.
• Zero-knowledge encryption for vault contents means even our servers hold only unreadable data.
• Your vault automatically locks, clearing the decryption key from memory, after 10 minutes of inactivity.
• Failed login attempts are limited and accounts are temporarily locked after 5 consecutive failures.
• All staff access to admin systems requires multi-factor authentication.
• Staff access to any member account requires explicit member permission via our Support Token system and is fully logged.
• We maintain cyber liability insurance covering data breaches and data loss incidents.
• All staff sign confidentiality agreements before accessing any system that touches member data.

We maintain multiple backup copies of all data following the 3-2-1 rule: three copies, two different storage types, one stored off-site. Backups are performed daily and retained for a minimum of 90 days. Backups are stored in encrypted form.

In the event of a data breach that affects your personal data, we will notify you within 72 hours of confirming the breach. Our notification will describe what happened, what data was affected, what we have done in response, and what steps we recommend you take. We will also notify the Minnesota Attorney General's office and any other relevant authorities as required by law.

Because vault contents are zero-knowledge encrypted, a breach of our servers would expose only scrambled data that cannot be read by anyone without your encryption key.

We retain your data for as long as you maintain an active Khaznad account. If your subscription lapses, we provide a 7-day grace period during which your account remains accessible. If your account is not renewed within 90 days of lapsing, your account will be suspended and you will receive 30 days notice before any data deletion.

You may request deletion of your account and all associated data at any time by contacting info@khaznad.com. Upon receiving a deletion request we will:

• Confirm your identity to prevent fraudulent deletion requests.
• Provide you with an opportunity to download all your data in a ZIP archive.
• Permanently delete all your data from our active systems within 30 days of your confirmed request.
• Delete all backup copies of your data within 90 days.
• Send you a written confirmation when deletion is complete.

After a death claim is verified and the vault is released to executors, we retain the member's account records for 12 months to assist executors with any follow-up questions. After 12 months, the account is archived and then permanently deleted at the 24-month mark unless the executor requests retention for ongoing estate proceedings.

If we receive a valid legal order requiring us to preserve data, we will retain that data for the duration of the legal hold regardless of your deletion request. We will notify you of any such hold unless legally prohibited from doing so.

Regardless of where you live, you have the following rights:

• Right to Access: You can request a copy of all personal data we hold about you at any time.
• Right to Correction: If any information we hold about you is inaccurate, you can request we correct it.
• Right to Deletion: You can request we delete your account and all associated data as described in Section 10.
• Right to Export: You can download all documents and data from your vault at any time from your account settings.
• Right to Object: You can object to any processing of your data that you believe is not covered by this policy.
• Right to Know: You can ask us at any time exactly what data we hold about you and why.

If you are located in the United Kingdom or European Union, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to Data Portability: receive your data in a structured, machine-readable format.
• Right to Restriction: request that we limit how we process your data while a dispute is resolved.
• Right to Lodge a Complaint: with your national data protection authority if you believe we have violated your rights.

For UK members, the relevant authority is the Information Commissioner's Office (ICO). For EU members, you may contact your national supervisory authority.

To exercise any of the rights described in this section, contact us at info@khaznad.com. We will respond to all rights requests within 30 days. We may ask you to verify your identity before processing your request to protect against fraudulent claims.

Khaznad is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children under 18. If you believe a minor has created a Khaznad account, please contact us at info@khaznad.com and we will delete the account promptly.

Adult members may document their minor children as beneficiaries or heirs within their vault. The children themselves do not have accounts and their information is stored only as part of the adult member's encrypted vault content.

Khaznad uses a minimal number of cookies, small text files stored on your device, that are strictly necessary to operate the platform:

• Session cookies that keep you logged in during your active session. These are cleared when you log out.
• Security cookies that help protect against cross-site request forgery attacks.

We do not use advertising cookies, tracking pixels, or third-party analytics that follow you across the internet. We do not use Google Analytics or Facebook tracking. We do not build behavioral profiles of our members.

The Khaznad platform may contain links to external resources such as attorney partner websites, community organizations, or legal information pages. This Privacy Policy applies only to Khaznad. We are not responsible for the privacy practices of any third-party website. We recommend reading the privacy policy of any external website you visit.

We may update this Privacy Policy from time to time. When we make changes, we will:

• Post the updated policy at khaznad.com/privacy with a new effective date.
• Send you an email notification at least 30 days before significant changes take effect.
• Display a prominent notice in your member portal.
• For any change that reduces your privacy rights, ask for your explicit consent before the change takes effect.

Continuing to use Khaznad after the effective date of a policy update constitutes your acceptance of the updated policy. If you do not agree with changes, you may delete your account before the effective date.

We take privacy seriously and we respond to all enquiries. If you have any questions about this policy, want to exercise your rights, or have a concern about how we handle your data, please contact us:

• Email: info@khaznad.com
• Mailing Address: Khaznad LLC, Minneapolis, Minnesota, United States
• Response Time: We aim to respond to all privacy enquiries within 5 business days.
• Languages: We can respond in English or Somali.

If you have contacted us and are not satisfied with our response, you have the right to escalate your complaint to the Minnesota Attorney General's office or, for UK and EU members, your national data protection authority.

Use the language toggle at the top of this page to read this policy in Af-Soomaali. If any conflict exists between the English and Somali versions of this policy, the English version is the legally binding version.