Privacy, in plain English

Only what the government forms and your checklist need. Here is the full list, and why each thing is on it. Most of it is optional, and the wizard says so as you go. We run one analytics tool, Google Analytics, through Cloudflare's tag service. It sees which pages you visit, that you started or finished a checkout, that you asked for a sign-in link, and which form or letter you downloaded, by catalog name. It never sees your email, your name, your case id, your IP address, or anything you typed. We use it to see which pages work and which do not. We never collect anything we do not use.

We also keep a short delivery log. It records when you download each filled form or letter, and when you mark a step done. With each entry we store a keyed hash of your IP address and your browser name: a code made from them with a secret key we hold, not the values themselves. Nobody with a copy of the database can read them back; someone holding our key could compare a known address against a row. Privacy laws treat that as personal data and so do we. We keep it only to show that you got what you paid for if a card payment is questioned. It is deleted with your case.

Three numbers are extra sensitive: your Social Security number, passport number, and driver's license number. All three are always optional. Leave them blank and hand-write them on the printed forms.

We never store your Social Security number on our servers. Not in our database, not in a cookie, not in a log. If you choose to enter it, it is kept only in your own browser on your own device, in that tab's session storage.

Be precise about what that means. It survives page reloads and moving between pages in the same tab. If you duplicate the tab, the copy gets it too. Some browsers restore it when they reopen a tab after a crash or restart. It stays until you close the tab or press "Forget it" on the SSN card. If you share a computer, press Forget it before you walk away.

Once an SSN is saved on your device, each form that can carry it shows an "include SSN" checkbox. That box is checked by default. Untick it to leave the SSN boxes blank on that one form. When the box is checked, the number travels to us only for that download or mailed packet. It is placed into that one PDF in memory, streamed back to you (or to the printer), and discarded. Our code strips any SSN from a profile before saving, every time. A breach of our database would expose zero SSNs.

Your whole profile, every field on the list above, is encrypted with AES-256-GCM before it touches our database, which runs on Cloudflare's infrastructure in the United States (see the region note below). The encryption key is held separately from the database, so a database dump alone exposes no readable personal information. The same goes for the name and address on a mailing receipt. Filled forms are generated on demand, streamed to you, and never archived. We do not keep copies of your completed paperwork.

A few things are stored in plain text, because we need to search or match on them. Here is the complete list:

• Your email address (to find your case when you sign in).
• About your case: which kind of name change, how far you got in the questions, which plan you have, your checklist's step statuses, and the download log above.
• Our sign-in send log: the address a sign-in link was sent to, kept for one day so we can cap how many links one address or one connection can request.
• Our support desk's search log: the email address or case ID a staff member typed to find a case, which staff member, and when. This is how we can answer "who has looked at my record."
• About payments: the plan, the amount, Stripe's reference IDs, and the status. Never card numbers.
• The recipient addresses you give us for letters we send on your behalf, and when you consented to each send.
• For gifts: the buyer's email, the recipient's email, and the gift note.
• For a kit another company sold you: the code, the email address that company sent us, its reference for your order, and the dates the code was made, redeemed, voided, revoked or disputed.
• For a mailed packet: the page count and the titles of the documents in it (the name and address on the receipt are encrypted).
• For a sign-in session: the IP address and browser signature of that sign-in, and the name on your account if you set one.

Everything from the wizard itself (your names, dates, addresses, identifiers, and household facts) is inside the encrypted profile. Our database and file storage run in Cloudflare's Eastern North America region; we confirmed the placement on September 4, 2026.

There are no passwords to steal. You sign in with a one-time link we email you. It works once and expires in 15 minutes, and we store only a cryptographic hash of it. Each sign-in creates a session that records the IP address and browser it came from. A session lasts a week from your last visit (it renews while you keep using the site, and ends a week after you stop) and is removed when you sign out, when it expires, or when you delete your account. Every successful sign-in also triggers an alert email to your address, so you would know quickly if someone else got in.

Two cookies of ours, both strictly functional: one remembers which case you are working on, one keeps you signed in. Both are httpOnly and signed. A third, short-lived one holds a gift code you entered before starting, until it is applied. The analytics tool above keeps its own random visitor id in your browser so it can count you once rather than on every page. No advertising cookies, no cross-site trackers. Two honest footnotes: our pages load their fonts from Google Fonts, so your browser requests those font files from Google's servers and Google sees your IP address for that request; and the checkout page loads Stripe's payment form, which sets Stripe's own cookies for fraud prevention under Stripe's privacy policy.

Four service providers, each only for its job — and, if another company sold you your kit, that company as well. We never sell your information or share it for advertising. Ever.

• Cloudflare hosts the application and the encrypted database, and delivers our email.
• Google, through Cloudflare Zaraz, receives the page views and the four events named above (that you visited a page, started or finished a checkout, asked for a sign-in link, or downloaded a form or letter, by catalog name). Cloudflare's edge, not your browser, talks to Google, and Cloudflare withholds your IP address from that request. Google's advertising features are switched off in our account, and we do not use Google Signals.
• Stripe processes payments. Your card number goes to Stripe directly and we never see or store it. What we send Stripe: your case's ID number and the plan you picked (tagged onto the payment so refunds find the right case), plus your email so Stripe can pre-fill checkout and send you its own receipt. For a gift, the buyer's email and the gift's ID instead. We never send Stripe your name, address, or anything from your forms. Whatever you type on Stripe's own checkout page (card, billing address) goes to Stripe only.
• Lob, a print-and-mail provider, is used only if you order a mailed packet. To print it, Lob receives the finished PDF (every filled form and letter, including an SSN you chose to include at that moment), your name, and your mailing address. Lob keeps a copy of that PDF on its own systems for its own retention period. We do not keep one. The packet ships to your address, never to anyone else and never to a government agency.
• The company that sold you your kit, if that wasn't us. This one is different in kind: a reseller is not a provider working for us, it is a separate company that took your money and bought the kit from us to give you. It is on this list because this list is meant to name everyone who touches your data, and a reseller does. Exactly what crosses, in both directions, is the next section.

Some kits are sold by other companies — a reseller that offers the Paperwork Kit alongside its own service. If yours came that way, your email address reached us from them, usually before you had ever visited this site. Here is exactly what crosses between the two companies, in both directions.

From them to us, at the moment they sell a kit: your email address, a second address if the kit is for someone else, their own reference for your order, a short note naming the product, and how many codes to make. That is the entire list. We do not receive what else you booked with them, what you paid, your card, your postal address, or anything else they hold about you. We use it to make the code and to find your order when you or they ask us about it.

From us back to them, when they ask about an order or when the two companies settle the month: the code, the same email address they gave us, and the state the code is in — when it was made, whether it has been redeemed, whether a filled form or letter has been downloaded, and whether it was voided, revoked or disputed. Say the awkward part out loud: the company that sold you the kit can see that you started using it. It cannot see anything in it. Nothing from your profile, your answers, your checklist or any form we filled goes back to them — not your name, not your dates, not your identifiers, not a page of paperwork.

Why it works that way: they took your money and owe you a working kit, we make the kit and owe you the paperwork, and neither company can do its half without knowing whether the code is alive. Neither of us is the other's sub-processor — each decides its own purposes for its own half, and a short, fixed set of facts passes at the boundary. Separately, a named support contact at a reseller can be on the staff list that may look up a case, and only for kits that reseller sold; what they see there is what our own staff sees, never your profile, and every search is logged (see "Who at Change Your Name can see your record" below).

Deleting your account still deletes your case, your encrypted profile, your checklist and your download log. One record stays: the code itself, with the order reference and those dates — it is the bill between us and them, the same way a gift receipt stays for the person who bought it. The email address the reseller sent us does not stay; it is cleared the moment you delete your account, along with a second address if the code was addressed to someone else. What stays holds nothing from your paperwork and, once cleared, nobody's address either. A deletion request at either company is a request at both: tell us or them and it is relayed to the other by the order reference alone.

Sign-in links, a note when someone signs in to your account, your receipt, gift emails, and a resume link if you start a checklist under an address that already has one. One more: if you gave us a wedding date that is still in the future, a daily job checks for cases whose wedding just passed and sends one congratulations email with the next steps. To do that it reads the wedding date out of your encrypted profile. That email carries a one-tap unsubscribe link, and we send it at most once per case. Nothing we send is advertising, and we never share your address with anyone to send you theirs.

A support view lets a short, named list of staff look up a case by email or case ID to answer a question or settle a refund. It shows your email, your plan, your payments, and your download log. It never decrypts your profile, so no one on staff sees your names, dates, addresses, or identifiers through it. Every search is written to an access log with the staff member's account and what they searched, so if you ask "who has looked at my record" we can tell you. That list is set in configuration and today names the owner, and one support contact at Vowed and Clear, a company that resells the kit, who can look up only kits sold through Vowed and Clear; access to the underlying production systems (the database, hosting, and payment accounts) is limited to the owner.

If you have an account: your case data stays as long as your account does, so you can work through a name change over weeks or months. Delete your account and it is removed from our live database immediately — except the one or two purchase records named under "Deleting your data" below, which are somebody's proof of payment and stay, and an identifier-free record of each payment that we keep for 180 days (also described there). Short-lived backup copies age out automatically within about 30 days.

If you started a case but never signed in: there is no account to delete, so a daily job cleans up on a schedule. It counts from the last time you touched the case.

• Picked a state and typed nothing else, not even an email: deleted after 7 days. There is no address to come back with, so nothing is lost.
• Entered an email and nothing else: deleted after 30 days.
• Got partway through the questions: deleted after 180 days.
• Finished a free checklist: deleted after 18 months.
• Paid for a plan: never deleted automatically. It is your purchase. Sign in to delete it yourself, or email us.

Want it gone sooner? Sign in with the same email you used, open your account page, and delete. That takes the guest case with it. Stripe and Lob retain their own transaction records under their own policies. We cannot delete a payment record out of Stripe, and you would not want us to; it is your proof of purchase.

Go to your account page, type DELETE, and everything goes: your account, cases, encrypted profile, checklist, letter addresses, mail receipts, the download log, the sign-in send log for your address, and the support search log entries that name your email or your case IDs. No waiting period, no retention "for quality purposes." (If your sign-in has gone stale we ask you to sign in again first; that is the only step.) Any case you started under the same email before signing in goes too, however it was capitalized; a guest case entered under a different email is not touched, so sign in with that email to delete it. One deliberate exception: if someone bought a gift (for you, or you for them), the purchase receipt (the buyer's email, the gift code, and their note) belongs to the buyer and stays, since it is their proof of purchase and refund path. After you delete your account we keep an identifier-free record of each payment for 180 days, so a refund or chargeback can still be honoured; it holds the amount, dates and payment-processor references, never your name, email or case. The code record for a kit another company sold you stays too, as the bill between that company and us — but not the email address: deleting your account clears the purchaser and recipient email off that record, leaving the code, its order reference, and the dates. Deleting your account unlinks it from your case. A gift is a request at both companies: if you'd rather we handled it, email us and we forward it to that company by the order reference alone, never your profile. Two records also sit outside our database and survive deletion: Stripe keeps your payment, whose metadata carries your case ID, and Lob keeps its record of any packet it printed and mailed for you, each under its own retention policy. If you would rather we handle deletion for you, email support@changeyourname.app and a human will do it.

We build to one standard for everyone: you can see everything we hold (it is your dashboard and wizard), correct it (edit any step, any time), take it with you (download your forms), and erase it (self-serve, above). We do not sell your personal information, and we do not "share" it as that word is used in privacy laws like the CCPA: the one analytics tool described above sends Google only the page-view and event data listed there, under Google's own data-processing terms, never for advertising or profiling on us. Telling a reseller whether the code it bought has been redeemed and used is part of filling that order and settling the bill between the two companies, not a sale of anything about you; it is set out in full above, and nothing from your paperwork is in it. Our pages do not change their behaviour in response to a browser's Do Not Track or Global Privacy Control signal, because there is nothing to opt out of: we sell and share nothing, and the one analytics tool above runs the same for everyone and receives no personal identifiers. No other company collects information about you across websites through our pages. We are not certified under any privacy framework and do not claim to be. The practices on this page are simply how the product works. If you believe we have fallen short, email support@changeyourname.app and we will fix it.

To ask for a copy of what we hold, a correction, or deletion by email rather than self-serve, write to support@changeyourname.app from the address on your account or gift. We confirm receipt within 10 business days and finish within 45 days; if we need longer we tell you before that date and why. To check it is you we ask you to sign in once, or to show you control that email address, plus a gift code or order reference if two records need telling apart. We never ask for a Social Security, passport or licence number to verify a request. If your kit came from another company, we pass the request to them within three business days by the order reference alone, and tell you when both halves are done.

This service is for adults changing their own names. It is not directed at children, and we do not knowingly collect information about anyone under 16. If you believe a minor's information ended up here, email support@changeyourname.app and we will delete it.

If we change how we handle your data, we will update this page and note the date below. For meaningful changes we will email account holders. Questions? Email support@changeyourname.app (a human reads it), or write to Change Your Name LLC, Change Your Name LLC, 2501 Chatham Rd Ste N, Springfield, IL 62704.