Files you could open without us.

A backup ("vault") is a single JSON text file, usually named lifelook-vault-YYYY-MM-DD.json. Its envelope is identical on web and mobile, so a file made on one opens on the other:

{
  "app": "lifelook",
  "format": "lifelook-legacy-backup",
  "version": 1,
  "platform": "web",                    // or "mobile"
  "createdAt": "2026-07-12T09:30:00.000Z",
  "kdf": "HKDF-SHA256",
  "cipher": "AES-256-GCM",
  "salt": "<16 random bytes, base64>",
  "wrap":    { "iv": "<12 bytes, base64>", "data": "<wrapped data key, base64>" },
  "payload": { "iv": "<12 bytes, base64>", "data": "<encrypted JSON, base64>" }
}

All binary values are standard base64. The file deliberately contains no hash or hint of the recovery key — holding the file tells you nothing about the key, and holding the key tells you nothing without the file.

To decrypt it, any standard crypto library can follow these steps:

1. Normalize the 24-word phrase: Unicode NFKD, trim, lowercase,
   collapse every whitespace run to a single ASCII space.
2. KEK = HKDF-SHA256(ikm = UTF-8 bytes of the normalized phrase,
                     salt = base64-decoded "salt",
                     info = "lifelook-legacy-kek", length = 256 bits)
3. dataKey = AES-256-GCM-decrypt(wrap.data, key = KEK, iv = wrap.iv)
4. json    = AES-256-GCM-decrypt(payload.data, key = dataKey, iv = payload.iv)
5. Parse json — that's the vault, as plain JSON.

HKDF-SHA256 (RFC 5869), AES-256-GCM (NIST SP 800-38D) and BIP39 are all public, stable standards with implementations in every mainstream language.

The Mini Safe transfer file (a .lifelook file, made on mobile) uses this exact same envelope — same KDF, same cipher, same five decrypt steps — with its own inner JSON payload (a child's safe, every media file inlined as base64) and its own one-time 24-word key, shown as a QR with the prefix lifelook-minisafe-key:v1:.

The readers apply resource ceilings before decoding. On the web, the complete encrypted JSON file may be at most 400 MiB, the decrypted inner JSON at most 300 MiB, and an export may contain at most 500 inlined media files. Each web media file may be at most 200 MiB, with 215 MiB total media per export.

Mobile uses deliberately lower safety ceilings because reading text, parsing JSON, decoding base64 and decrypting briefly coexist in the phone's JS heap: the encrypted JSON file may be at most 30 MiB, the decrypted inner JSON at most 20 MiB, with at most 500 inlined media files and total inlined media at most 10 MiB (also 10 MiB per media file). Mobile checks the picked file's size before reading its text and checks media metadata before reading base64; oversized input is rejected without replacing an existing vault. These are safety limits for the current implementation, not additional encryption steps, and do not change the v1 envelope, KDF or cipher.

The recovery key is a standard 24-word BIP39 mnemonic (English wordlist) encoding 256 random bits, generated on your device. The words themselves are the key — LIFELOOK+ never stores or transmits them, and no LIFELOOK+ server could recover them for you, because no LIFELOOK+ content server holding your content.

When shown as a QR code, the payload is the literal phrase with the prefix lifelook-recovery:v1: so a scanner can recognise it. A raw 24-word phrase is accepted everywhere too.

An optional integrity code for any backup file: SHA-256 of the file's UTF-8 bytes, first 12 hex characters, uppercased, grouped in fours — e.g. A3F9-0B2C-77D1. The same file always produces the same code; any change produces a different one. It requires no key, opens nothing, and reveals nothing about the contents — it only lets someone confirm that the file they found is the exact file the code was written down for. One shell command reproduces it:

shasum -a 256 lifelook-vault.json   # first 12 hex chars, uppercase

An optional export of exactly the data scopes its owner authorized under their Continuation Consent directive. A standard ZIP archive containing:

manifest.json          format: "lifelook-continuation-package", specVersion: 2,
                        the owner's directive (decision, dates, acknowledgment,
                        approval, disable state, scopes, statement, boundaries)
                        and a full index of every file
README.txt             what this package is, in plain language
writing/*.json         memories and readable letters (if authorized)
personality/*.json     portrait answers and decision log (if authorized)
media/*                photos, audio, video (if authorized)

Every media entry in the manifest carries a kind of image, audio or video, plus its MIME type. Sealed, still-locked letters are never included. Family notes added to memories by other people are also never included — those are their words and are not covered by the owner's directive. Version 1 packages are not Continuation-Ready under the version 2 authorization rule. The package is plain — its honesty lives in the directive recorded inside it, which states what may and may not ever be done with the data.

The package builder must stop unless the directive says continuation, is acknowledged, is separately approved with valid approval and decision dates, and has continuationDisabled: false. Legacy Only is a vault-level disable and takes precedence. Implementers must honor allowed and forbidden topics, preferred tone, and the uncertainty response exactly.

The directive itself — its exact shape, and the strict rules for verifying that it authorizes anything at all — has its own open specification. You can check any package against those rules, in your browser, with the Continuation-Ready verifier — it reports a verdict and the archive fingerprint below, and uploads nothing.

LIFELOOK+ records the directive only and does not create, host, transmit, or operate an AI representation. It does not claim that it can enforce an independent implementer's conduct outside the app.

The Eulogy tool exports one self-contained, offline ZIP a funeral director can play with no internet and no LIFELOOK+:

index.html             the entire player, self-contained — double-click to play
README-FIRST.txt       instructions for whoever receives it
manifest.json          machine-readable slide list (below)
assets/*               the photos, audio and video, as ordinary files

{
  "app": "lifelook",
  "kind": "final-thoughts",
  "version": 1,
  "title": "...",
  "subtitle": "...",
  "playback": "manual" | "auto",
  "slideSeconds": <number>,
  "createdAt": "<ISO date>",
  "slides": [
    { "order": 0, "type": "image" | "audio" | "video" | "text",
      "file": "assets/slide-01.jpg" | null, "caption": "..." }
  ]
}

Even if the HTML player someday fails to run, the assets are ordinary image, audio and video files, and the manifest is ordinary JSON.

A legacy product that locks your data into a proprietary format is making a quiet bet that the company outlives you. We refuse that bet. Everything above is built from public standards precisely so that your files remain readable without LIFELOOK+, without our cooperation, and without our continued existence. Your things are yours — including the right to walk away with them.

This page must be updated in the same breath as any format change. If you find an export that doesn't match this spec, hold us to it.