Pastpond — Terms of Service
Last updated: 2026-08-04. Provisional v0.8.
This is the binding agreement between you and NATIFY LIMITED when you use the service at pastpond.com. NATIFY LIMITED is a company incorporated in the Abu Dhabi Global Market (ADGM), registration number 17201, and operates Pastpond. "We" and "us" mean NATIFY LIMITED.
1. What Pastpond is
Pastpond is a software service that lets you store personal memories — photos, videos, documents, written messages — encrypted, replicated across cloud infrastructure, and released to people you designate under conditions you set.
2. Your account
You must be at least 18 years old to create an account. One account per person. You are responsible for keeping your sign-in email, any passkeys you add, and your encryption passphrase safe.
3. The passphrase. Critical.
Your data is encrypted on your device using a key derived from your passphrase. We do not store your passphrase. We cannot recover it. If you lose it, your data is permanently unreadable.
We strongly recommend you write down your passphrase and store it physically with a person you trust or in a locked container.
4. What we can and cannot see
We can see your email address, account metadata, the size and type of items you upload, and the beneficiary email addresses and release conditions you set.
We cannot see the contents of your uploaded files, your AI-generated descriptions (encrypted on your device before storage), your passphrase, or any key derived from it.
How AI processing works: when your capsule organizes a photo, your device decrypts it and sends it, via our server (held in memory only, never written to disk), to our AI provider OpenAI, which returns a description. The same path places photos on your timeline, and — only when you ask for it — writes your story from descriptions already produced this way plus the milestones you confirmed yourself. Your files are never sent for story writing. OpenAI retains API data for up to 30 days for abuse monitoring and does not use it to train models. Everything returned is encrypted on your device before it is stored — we hold only ciphertext.
5. Storage duration plans
You may purchase an active capsule as a Single or Family plan, billed monthly or annually. All plans are auto-renewing subscriptions and renew automatically until you cancel.
Lifetime plans are not sold to the public.
If your subscription ends or is not renewed, your capsule goes cold — it is not deleted. Archive storage is free and has no end date: what you already stored stays stored, and you can still sign in and read it. What stops is everything that needs an active plan — uploading new files, adding notes, AI organising, and story writing — until you subscribe again. We do not delete a capsule for non-payment. Deleting your account and its contents is your decision alone, from Settings.
6. Beneficiaries and succession
You may designate one or more beneficiaries and configure release conditions. The default succession behavior is a 12-month escrow window after a passing is verified or a missed-check-in trigger fires, during which heirs may claim or contest, after which the configured releases execute. If no plan is configured, the default is anonymized donation to a public archive, not erasure. You may change this default at any time.
7. Service availability
We make our best effort to maintain durability and availability of your capsule across redundant infrastructure providers and jurisdictions. We do not promise uninterrupted access. We do not promise that any single provider, jurisdiction, or technology underlying the service will exist for the full duration of your subscription.
8. Acceptable use
You may not upload material that is illegal under applicable law, depicts the sexual abuse of minors, is intended to threaten or harass a specific person, or contains malware.
We do not screen capsule contents (encryption — see Section 4). If we receive a verified report of illegal content under applicable law, we will act per applicable law.
9. Succession and disclosure
If we receive a verified report of your passing from a designated beneficiary or appropriate authority, we begin the succession process you configured. We do not voluntarily disclose your capsule's existence or contents to anyone other than your designated beneficiaries, except under lawful legal compulsion.
10. Termination
You may close your account at any time. On account closure with no succession plan, your encrypted data is deleted within 30 days from active storage and within 90 days from backups.
11. Liability
To the maximum extent permitted by law, our total liability to you for any claim arising from the service is limited to the amount you paid us in the 12 months prior to the claim.
12. Changes to these terms
Material changes will be communicated to you by email at least 30 days in advance. Continued use after the effective date constitutes acceptance.
13. Governing law
These terms are governed by the laws of England and Wales. Any dispute arising from them, or from your use of the service, is subject to the exclusive jurisdiction of the ADGM Courts.
If you use the service as a consumer, nothing in this section deprives you of the protection of the mandatory laws of your country of residence, or of the right to bring proceedings there.
Contact
NATIFY LIMITED, Sky Tower, Shams Abu Dhabi, Al Reem Island, Abu Dhabi, UAE. Registered in the Abu Dhabi Global Market (ADGM), registration 17201.