Policies

Plain-English policies for the Legacy Asset Locator.

Questions? Email [email protected].

Privacy Policy

Last updated: Oct 13 2026

Done Once Lab makes the Legacy Asset Locator, a tool that helps you record what you have, where it is and who to contact, so the people you appoint can act when they need to. This policy explains what we collect, why, who helps us run the service, and the choices you have.

The short version

  • We never ask for passwords, PINs, security answers, full account numbers or Social Security numbers. Account numbers are the last 4 digits only.

  • Your map is private. Only you can see it, plus the people you choose to share it with after they confirm their email address.

  • We never sell your information or use it for advertising.

What we collect

  • Your account: your name and email address, plus your phone number and home address if you add them.

  • Your map: the answers you enter. That covers which accounts, policies, property and documents exist, who they’re with, where things are kept, who to contact, your wishes, and the people you appoint (their names, email addresses, relationship to you and roles).

  • Payments: our payment processor (Stripe) handles your card details. We never see or store your full card number. We receive your name, email address and a record of the purchase.

  • Messages you send us: feedback from the app, and emails to [email protected].

  • Technical information: the app keeps you signed in using secure browser storage. Our hosting providers keep standard technical logs, such as IP addresses and access times, to keep the service secure and working.

How we use it

  • To provide the Legacy Asset Locator: saving your map and showing it to you and the people you choose.

  • To send the emails you need: account confirmation, sign-in and password links, purchase confirmations, and messages about the people you’ve appointed.

  • To unlock the full map when you buy.

  • To answer your questions and improve the product.

  • If you’ve agreed to it, to send occasional emails about the Legacy Asset Locator. You can unsubscribe at any time.

  • We do not sell, rent or share your information for advertising.

Who can see your map

  • You.

  • The people you appoint, only after you add them and they confirm their own email address. They can view your map but can’t change it. If you remove someone, their access ends immediately.

  • Done Once Lab, only when we need to keep the service running, fix a problem you’ve asked us to look at, or meet a legal obligation.

Services that help us run it. Each one only receives what it needs to do its job:

  • Supabase (database and sign-in), hosted on Amazon Web Services in the United States. Your map is stored here.

  • Lovable (hosts the app at map.doneoncelab.com).

  • Resend (delivers the app’s emails).

  • HighLevel (our website, checkout and marketing emails).

  • Stripe (payment processing).

How we protect it

  • Encrypted when stored (AES-256) and while it travels (TLS).

  • Access rules are enforced by the database itself, so one person can never see another person’s map.

  • Our database provider, Supabase, is independently audited to the SOC 2 Type 2 standard.

No system is perfectly secure, but we designed the Legacy Asset Locator so that it never holds the keys to your accounts, only where things are.

Cookies and tracking

The app (map.doneoncelab.com) doesn’t use advertising or tracking pixels. It only uses the browser storage needed to keep you signed in. Our marketing website (doneoncelab.com) may use cookies and similar tools to understand visits and measure our advertising.

How long we keep it

We keep your account and map for as long as your account is open, so it’s there when your people need it. If you delete your account, your map and the people you’ve appointed are deleted. We may keep feedback messages and purchase records for our business and tax records.

Your choices

  • See and update your information at any time in the app.

  • Remove the people you’ve appointed at any time.

  • Delete your account from Settings, or email [email protected] and we’ll do it for you.

  • Ask us what information we hold about you by emailing [email protected].

Children

The Legacy Asset Locator is for adults. We don’t knowingly collect information from anyone under 18.

Changes

If we make important changes, we’ll update the date above and, where appropriate, let you know by email.

Contact

Done Once Lab, Boise, Idaho, USA · [email protected]

Refund Policy

We stand behind the Legacy Asset Locator completely.

If you’re not satisfied with your purchase for any reason, email [email protected] within 15 days of your purchase date and we’ll issue a full refund. No questions asked.

How it works

  • Refunds go back to the card you paid with. They usually appear within 5–10 business days, depending on your bank.

  • After a refund, your account returns to the free plan (Authority & Access). Nothing you’ve entered is deleted. The other five sections are simply locked again, and they’ll unlock if you buy again later.

  • If you’d prefer your account and map deleted entirely, just say so in your email.