How Gopniya works

Your vault

It works like a drive. You make folders, upload documents and photos, keep passwords and write notes in the app. Search finds anything by name, on any of your devices.

Passwords live inside folders, with a generator and one-tap copy that clears itself after 30 seconds.
Documents and files of any kind are encrypted before upload and decrypted only when you download them.
Notes are written and previewed in the browser, like a document that saves as you type.

Everything is encrypted on your device, including file and folder names. We store only encrypted data, and we cannot read it. The one exception is what you set aside for handover. We can open that only at handover, as described below.

When you sign up you set a master password and two-factor login, and you save an Emergency Kit with two keys only you hold. More on that in Security.

Who gets what

You can set aside a folder, a file or your passwords for someone without sharing it now. They are told nothing until the handover.

Each person gets only what you set for them. Your accountant can get the business folder while your daughter gets the family documents, and neither sees the other’s.

You add the people you choose to a private contact list: their full name and at least one government ID, plus any phone numbers, emails and addresses you have. The more you give, the easier they are to find. We do not contact them while you are active, so they learn of it only at the handover.

When a handover starts

We cannot know why someone stops using the app. They may have died, be in hospital or have lost their phone. So a handover does not depend on a death certificate. It starts only after you have been inactive for a period you choose. Any use of the app counts as activity, and so does tapping “I’m still here” in a reminder.

Your default: reminders start after 30 days of quiet, and handover happens on day 180.
Your choice: handover can be anywhere from 30 days to 3 years. Any folder or file can have its own timing.
Reminders: weekly, by email and SMS, listing what goes out and when.
Final warning: seven days before each handover date.

Making any timing shorter needs your master password and two-factor login, and we notify you when it happens. Your timing is signed by your own device, so no one can bring a handover forward without your knowledge.

The handover

For each nominee, you choose how they receive what you left them: online, which is free, or in person, which costs ₹10,000 per nominee. See pricing.

In both cases we first find them. We use every detail you gave us, and a tracing agency if needed. Nothing we send while finding them contains your secrets, only that something was left for them and how to receive it.

Online

We send a notice by email and SMS, to the details you gave us.
They verify their identity online, through DigiLocker and a live face match, against the ID you gave us.
They download their own encrypted copy and the secret to open it. No account is needed.

In person

They choose the time and place. Our staff never pick the location.
Two of our staff visit. They check your nominee’s original ID in person, with a DigiLocker check and a face match on the spot, against the ID you gave us.
They hand over a sealed envelope. It holds what you left your nominee, as printed pages, on a USB drive, or both. It is prepared in-house, sealed and serial-numbered, and its custody is logged from our office to their hands.
The whole visit is recorded, from arrival to the signed receipt. The envelope stays sealed on camera, so its contents are never filmed.

If the identity check fails, nothing is handed over. If you log in before a handover is delivered, that handover is cancelled.

What your nominee receives

Your nominee receives the passwords you left them, in full, and the files you left them. Online, this is their own encrypted copy to download, with the secret to open it. No account is needed.

In person, you decide for each password list and each note whether it is printed or given as a document on a USB drive. Documents, photos and other files cannot be printed, so they always go on the USB drive. You can change this at any time. The printed pages and the drive are not encrypted, so your nominee can read them on any computer. They are protected by the sealed envelope until the handover, and by your nominee after it.

Each nominee gets their own copy. Deleting one doesn’t affect anyone else’s.
Ten wrong secrets lock an online copy. We contact the nominee ourselves and unlock it after the same ID check.
If a nominee loses their secret, we verify them again and issue a new copy. The old secret stops working.
If a nominee loses their pages or their drive, we verify them again at a visit and hand over new ones. Pages or a drive already handed over cannot be recalled, so they should be kept as carefully as the secrets on them.
Online copies are deleted three years after first download, or ten years after handover if never opened, with a reminder 30 days before.

Every handover also includes a one-page notice of what we owe your nominee under your agreement, and our care number.

When it gets complicated

A nominee may be a minor, or unable to manage their own affairs. A nominee may have died. There may be a family dispute, a court order, or someone who cannot be found. We take responsibility for each of these cases until it is resolved, through the courts if necessary. Your family does not have to start legal action.

Three rules apply in every case:

What you left goes only to the person you named, or their court-appointed guardian. We never add anyone.
What you left a minor is held until they turn 18, unless a court appoints a guardian.
In these cases, we hand over your secrets only at a recorded, in-person visit, even if you chose online delivery.

Customer care

One phone number for everything, printed on every handover envelope and shown in every reminder and in the app. One call is enough. We open a case, one person is responsible for it, and that person calls you back.

We also reach out first: when a nominee’s copy gets locked, when an online copy hasn’t been opened 60 days after the notice, or when someone misses a visit.
Verification is our responsibility. We come to you, and you need only your ID.
Each kind of help has a published fee, quoted on the call and paid before work starts. If we can’t finish, you get it back in full.
A phone call alone never changes anything. Our staff never ask for passwords or keys.

If you lose your keys

By default, no one can open your vault without your keys, including us. That is what makes it private. If you lose both your master password and your Emergency Kit, your data is gone.

If you want a way back, you can turn on account recovery. You register your own ID, and a sealed copy of your account key is kept under the same two-person lock as handovers. If you lose everything, we verify you in person, wait seven days with notices to every phone and email you registered, and then restore your access. Turning it off deletes the copy.

The custody agreement

The custody agreement is the contract between you and Gopniya. Signing up means signing it. It lists every commitment on this site, in plain language, and both of us sign it. You get a copy as a PDF. We will publish the full text before launch.

We cannot take a commitment back on our own. Changes that only add to what we owe you apply after 30 days’ notice. Anything else applies only once you sign it.
Our responsibility remains valid even if you stop paying. Until you pay again, you can no longer add new secrets or open the ones you saved. They stay encrypted and stored. If you then stop logging in for the period you chose, the handover still happens. Paying again restores full access.
If you are inactive, nothing changes. No one can accept new terms on your behalf.
An independent trustee holds a continuity reserve. If Gopniya stops growing, the reserve pays to run the service, so every handover still happens. Gopniya cannot draw on it, and no lender has a claim on it.
In-person fees are held by the trustee until the handover is delivered or the fee is refunded. They are not used to run the company.
If we are sold, the buyer is bound. If we ever wind down, you get six months’ notice and a free export, and your handover passes to a named successor bound by the same terms.
Your rights stay. The agreement follows Indian law, and nothing in it limits your rights as a consumer.

It is not a will. A handover delivers your information to the people you chose. It doesn’t transfer ownership of anything or override a will or succession law.

Common questions

Two members of staff cannot open a handover early

Opening a handover needs two of three staff keys and our hardware security module. The module opens only for an account whose inactivity period has passed. Two staff keys on their own cannot open anything, and every attempt is logged. All three keys are held by Gopniya staff, so this protects you against individuals, not against the company as a whole. Security states this limit.

A long stay in hospital can start a handover

Gopniya acts on inactivity, not on death. If you cannot use Gopniya or answer a reminder for the period you set, the handover begins. If you expect to be away, choose a longer period before you go. If you use Gopniya again before a nominee receives what you left them, that handover stops.

If Gopniya is sold, your agreement goes with it

A buyer must take on every custody agreement unchanged. Your handover, your timing and your nominees stay as they are.

If Gopniya shuts down, your handover still happens

You get six months’ notice and a free export. Your handover passes to a named successor bound by the same terms, and the continuity reserve pays for it.

Your data is stored on two cloud providers

Your encrypted data is kept on Microsoft Azure and copied to Amazon Web Services. Both copies are encrypted, and neither provider can read them.