This is the most delicate system in LTL. The design goal is to minimize friction for families acting in good faith while maximizing protection against premature or malicious memorialization. Every state change is enforced server-side and appended to an immutable audit log.
Account State Machine
An account moves from ACTIVE through a COOLDOWN window into MEMORIAL, with a side path to DISPUTED if anyone raises a valid objection.
- ACTIVE — default, living user.
- COOLDOWN — a transition has been initiated. Notifications are sent and objections are accepted. Lasts 14 days on Path A, 30 days on Path B.
- DISPUTED — an objection routes the account to manual support review.
- MEMORIAL — the terminal memorial state.
Additional housekeeping states exist for edge cases: DORMANT (no app open in 24 months, not a death signal), FROZEN (voluntarily paused; no transition can start here), and a short-lived DECEASED_UNVERIFIED while a certificate is checked.
Path A: Legacy Contact
Precondition: the user designated at least one Legacy Contact while alive.
- The Legacy Contact begins the memorial transition from settings.
- They upload a death certificate (or defer per the certificate rules).
- The account enters a 14-day COOLDOWN.
- Notifications go to all other Legacy Contacts, active Pairing partners, Family Space admins, and the user themselves at their registered address.
- Any notified party can raise a one-tap objection, moving the account to DISPUTED.
- At the end of cooldown with no objection, the account becomes MEMORIAL and the Legacy Contact becomes the default memorial admin.
Path B: Fallback (no Legacy Contact)
Precondition: no Legacy Contact, or all are unreachable.
- A family member with an active relationship requests the transition.
- They upload a death certificate (required; no defer option).
- A second family member must attest within 7 days.
- The account enters a 30-day COOLDOWN (double Path A).
- Same notification set and objection handling as Path A.
- An additional manual support review reads the certificate and checks the account’s recent activity before completion.
Why Notify the User
Notifying the account holder is a deliberate, critical defense. If the user is alive and someone has initiated memorialization, they must know immediately, which also protects against hostile memorialization by estranged family or abusers. If the user has in fact passed away, the notification simply lands in an inbox no one is checking, which is correct.
What Changes in Memorial Mode
| Aspect | Active | Memorial |
|---|---|---|
| The user’s own authored content | Editable by the user | Frozen; never editable by anyone |
| Profile structured fields | Editable by the user | Editable only by the legacy contact / memorial admin |
| Pairings | Daily cadence | Converted to Candles |
| Family Space presence | Full member | Posthumous member |
| New contributions by others | N/A | Queued for memorial admin approval |
| Login | Possible | Disabled; credentials invalidated |
Legacy Contact Rights and Limits
A Legacy Contact may curate the memorial profile, approve or reject contributions, manage access, transfer the role, and invoke Sunset. They may not edit the deceased’s authored content, delete others’ authored contributions about the deceased, or post as the deceased; there is no mechanism to impersonate the person.
Sunset, Resurrection, and the Threat Model
- Sunset: at any time a Legacy Contact may export a full memorial as a zip and a bound PDF book, then have it deleted from servers after 30 days. The app should never be the prison of someone else’s memory.
- Resurrection: if a memorialized user turns out to be alive, the account is revived via stricter-than-signup identity verification; authored content is unfrozen and contributions made during the memorial period are preserved but clearly marked.
- Threat model: mitigations include user-and-admin notifications and abuse tracking for malicious memorialization, designated-in-advance Legacy Contacts and two-attestor Path B against hostile takeover, MFA on transition initiation against account takeover, and an additive-only audit log so no data is ever deleted during COOLDOWN or DISPUTED.
Related
- The Four Tracks (Memorial Candles)
- Privacy and Security
- Product Vision