Privacy Policy

Good Order is an online end-of-life planning platform operated by Morpheus Business Strategies, LLC DBA Good Order. You can reach us at Betsy@GoodOrder.io.

We collect information you provide directly, including: your name and email address when you create an account; personal planning information you enter into the platform, which may include healthcare preferences, financial account details, asset information, beneficiary designations, and end-of-life wishes; structured address information (street, city, state, ZIP, and country); documents you upload or generate through the platform; and communications you send to us.

We also automatically collect certain technical data when you use the platform, including your IP address, browser type, device information, pages visited, and timestamps of activity. This technical data is used for security monitoring and audit logging purposes.

We use your information to: provide, operate, and improve the Good Order platform; authenticate your identity and protect your account; communicate with you about your account; respond to your questions and requests; generate and maintain an activity log for your security; and comply with applicable legal obligations.

We do not sell your personal information. We do not share your information with third parties for marketing purposes.

Good Order uses a multi-layer security architecture to protect your information:

Encryption in transit: All data transmitted between your browser and our servers is encrypted via HTTPS. HTTP connections are not permitted.

Encryption at rest: Your data is stored in a PostgreSQL database with AES-256 disk-level encryption as standard. Highly sensitive fields — including government ID numbers, passport numbers, and driver's license numbers — are additionally encrypted at the application layer using AES-GCM encryption before being written to the database. This means even in the unlikely event of a database breach, these fields cannot be read without your unique encryption key.

Access controls: Every database table is protected by Row Level Security (RLS) policies scoped to your authenticated user ID. No user can ever access another user's data — this is enforced at the database level, not just the application layer.

Session security: Your session automatically expires after 15 minutes of inactivity. You will receive a 60-second warning before sign-out. Accessing sensitive sections of your plan (medical, legal, finances, household, and digital) requires re-authentication once per session as an additional verification step.

Password security: We enforce strong password requirements at signup (minimum 12 characters including uppercase, lowercase, numbers, and special characters) and check passwords against known breached password databases.

Two-factor authentication: You may optionally enable two-factor authentication (2FA) via an authenticator app in your account security settings. We strongly recommend enabling this feature.

Privacy mode: A privacy mode toggle is available in the app navigation. When enabled, sensitive information on screen is visually blurred, protecting your data in public spaces.

Good Order collects sensitive personal information as part of end-of-life planning, which may include health-related preferences, financial account details, government identification numbers, and location information. The most sensitive fields receive additional application-layer encryption beyond standard database encryption. This information is used solely to provide the planning services you request and is never used for advertising or shared with third parties except as required by law.

To protect your account and comply with security best practices, Good Order maintains an access log recording each time sensitive sections of your plan are viewed or modified. Each log entry records the section accessed, the action taken (view or edit), the timestamp, and your IP address and browser type. You can view your own activity log at any time at goodorder.io/account/activity. Log entries are automatically deleted after 90 days. These logs are not accessible to Good Order staff except under a valid legal process.

When you export your plan as a PDF, you will be prompted to set a password to protect the document. Good Order does not store this password — it exists solely between you and anyone you choose to share the document with. We strongly recommend choosing a password you can communicate to your designated family members or executor.

The following table describes the categories of personal information Good Order collects from California residents, the purposes for which we use that information, the categories of third parties to whom we disclose it, and the categories of third parties to whom we "share" or "sell" it for cross-context behavioral advertising or analytics, as those terms are defined under the California Consumer Privacy Act ("CCPA"). The table reflects our practices over the preceding 12 months.

If you are a California resident, you have the following rights:

The right to notice. You have the right to be notified which categories of personal information are being collected and the purposes for which they are being used.

The right to request. You have the right to request that we disclose information about our collection, use, sale, disclosure for business purposes, and sharing of your personal information. Upon a verified request, we will disclose: the categories of personal information collected; the categories of sources; our business or commercial purpose; the categories of third parties with whom we share it; and the specific pieces of personal information collected about you.

The right to opt out of sale. You have the right to direct us not to sell your personal information. To submit an opt-out request, contact us at Betsy@GoodOrder.io.

The right to delete. You have the right to request deletion of your personal information, subject to certain exceptions (such as completing a transaction, detecting security incidents, complying with legal obligations, or other lawful internal uses).

The right not to be discriminated against. You have the right not to be discriminated against for exercising any of your CCPA rights.

Exercising Your CCPA Rights

To exercise any of your rights under the CCPA, California residents may contact us:

By visiting: goodorder.io

By email: Betsy@GoodOrder.io

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable request. We will respond within 45 days of receiving a verified request (extendable by an additional 45 days with notice). Disclosures will cover the 12-month period preceding the request.

We retain your personal information for as long as your account is active or as needed to provide services. Activity log entries are automatically purged after 90 days. You may request deletion of your account and all associated data at any time by contacting Betsy@GoodOrder.io.

Good Order uses Lovable Cloud (powered by Supabase/PostgreSQL) for database and authentication infrastructure. These providers access your data only as necessary to provide hosting services and are bound by their own security and privacy obligations. We do not currently use third-party analytics, advertising, or tracking tools.

Good Order is intended for users 18 years of age and older. We do not knowingly collect personal information from children under 18.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. The date at the top of this page reflects the most recent update.

Questions or concerns about your privacy or security? Contact us at Betsy@GoodOrder.io.