This Privacy Policy explains how P and A LLC (“we”, “us”), a company registered in the Republic of Kazakhstan and trading as Panda LLC, handles your information when you use the Willowpath mobile application (the “App”) and the pages of this website about it.
Contact for privacy matters: privacy@pandallc.dev.
The short version
- No sign-up. The App works from the first launch.
- No name reaches the assistant. Questions to Ask carry the question and the shape of your situation, never who anybody is.
- Nothing in Willowpath is readable by a stranger. There is no public link anywhere in it.
- We show no ads, sell nothing, and train nothing on your case.
Whose data this is
Willowpath holds information about someone who has died, and often about their family. That person cannot consent, and much of what a bank or an agency asks for — a date of birth, an account number, a Social Security number — is precisely what the App’s own fraud warning tells you to guard. It is treated accordingly.
You enter this information as the person handling the estate. We do not verify that authority and we ask you to confirm you have it — see the Terms of Use.
What we collect
An anonymous account. Created on first launch so your case survives a lost phone. It holds no email address, no name and no password. If you later add a sign-in, it upgrades that same account rather than making a second one — nothing is migrated and nothing is lost.
Your case. The six answers from onboarding, the deceased person’s details you enter, your plan and which tasks you have completed, the organizations you are tracking and where each stands, your notes, and the certified-copy ledger.
Documents you photograph. Death certificates, letters, statements — whatever you attach.
Purchase information. The one-time purchase is processed by the Apple App Store or Google Play. We receive confirmation and never your payment card details.
Technical data. Our infrastructure providers automatically record basic technical logs — IP address, device type, timestamps — needed to operate and secure the service.
Ask — exactly what is sent
When you ask a question, the request carries:
- the question you typed;
- the shape of your situation: your relationship to the person, roughly how long ago, the state, whether there is a will, whether you are the executor;
- the ids of the tasks in your plan, so an answer can point at one.
It does not carry your name, the deceased person’s name, the dates, the address, an account number or a Social Security number. None of those would improve an answer about how probate works, and all of them are what the fraud warning is about.
If you attach a photograph of a letter to a question, that image is read to answer it — a photograph of a letter usually has names on it. Attach one only when you want its contents read.
The assistant runs on a model provided by Anthropic, which receives the request for the duration of the answer and is contractually bound not to use it to train models. Answers are grounded in our own corpus, and a citation that does not match a real task is filtered out before it reaches you.
What is logged. For every question: token counts, latency, which tasks were cited, and whether the assistant refused or handed you to an attorney. The text of a question and its answer is kept only in those last two cases — the ones worth auditing. A searchable archive of everything a bereaved person asked an app at three in the morning is not something to keep by default because it was easy to write.
Offline, questions are answered on the device from the same corpus, and nothing is sent at all.
Who processes your data
| Processor | What it does | What it receives |
|---|---|---|
| Google Firebase | Anonymous authentication, database, file storage, server functions | Your case, its documents, and your account identity |
| Anthropic | The Ask assistant | A question, the shape of your situation, task ids, and an attached photograph if you attach one. No names. |
| RevenueCat | Purchase management | A pseudonymous identifier and purchase receipts |
| Apple App Store / Google Play | Payment processing | Handled under their own privacy policies; we never see card data. |
Some providers are located outside the European Economic Area and Kazakhstan. Where required, those transfers are protected by recognised safeguards such as the EU Standard Contractual Clauses.
Who can read your case
Only you. Access is decided by membership of the case, and there is no route by which anyone outside it can read a document, a photograph or an answer. Unlike some of our other apps, nothing in Willowpath is shared by a link, so there is nothing that a stranger holding a URL could open.
The letters and the report you produce
A letter or a report is a file you generate and you send — to a bank, an agency, a relative. Once it has left, what happens to it is between you and them. We are not a party to it and we do not send anything on your behalf.
How long we keep it
Your case is kept while your account exists; settling an estate takes about a year and often longer. Delete a document, or delete everything, as described on the data deletion page. Purchase records may be kept longer where accounting and tax law requires it. Technical logs are short-lived and rotate automatically.
Your rights
Depending on where you live — including under the GDPR and the law of Kazakhstan — you have the right to access, correct, delete or receive a copy of your personal data, and to object to or restrict certain processing. Write to privacy@pandallc.dev. If you are in the EU or EEA you may also complain to your local data protection authority.
Data protection law protects living people. Information about the person who has died is still treated with the same care here, and the same deletion route applies to it.
Children
Willowpath is for adults handling an estate and is not intended for anyone under 16.
This website
This site is static. It sets no cookies and runs no analytics or tracking. Fonts and every other asset are served from our own hosting. Our hosting provider may briefly log IP addresses as part of normal operation.
Changes
We may update this policy as the App changes. The date at the top reflects the latest revision, and material changes are announced in the App.