Somewhere in your phone is a video of your kid at two years old, mispronouncing a word you've since stopped correcting. Nobody else has a copy. Your partner has never seen it. It lives in a cloud account that is protected by your password, your face, and a code sent to your phone. If you died tonight, the most irreplaceable thing you own would be locked inside the most carefully secured thing you own.

The people who build things alone tend to think about this problem in business terms: the domains, the payments, the code. But a quieter version of the same problem sits in the camera roll. It's worth a look, because what's at stake is not recoverable.

The photos are not where you think they are

Most people picture their photos as theirs, like a shoebox in a closet. In practice they are a service you're renting. Your photos live on a company's servers, under a license agreement, tied to an account, which is tied to a payment method and a phone number.

That has a few consequences that surprise families.

First, a spouse who knows the phone passcode may still be unable to reach the cloud library. A passcode opens the device. It doesn't open the account, and it doesn't pass a security prompt that sends a code to the device that's now sitting in a hospital bag or an evidence envelope.

Second, the law is not on the side of the grieving. In the US, most states have adopted some version of the Revised Uniform Fiduciary Access to Digital Assets Act. Its core idea is that an executor can usually get a catalog of your digital activity, but access to the actual content of your communications and files generally requires that you consented in advance, either through the provider's own tool or in your estate documents. If you did neither, the platform's terms of service tend to win, and your family may need a court order, a lawyer, and months of patience to get what is, to them, priceless.

Third, accounts decay. Cloud storage is a subscription. If the card on file expires after you die and your storage was above the free tier, the provider will eventually start warning, and then restricting, and then, depending on the terms, deleting. Google has said that personal accounts inactive for two years may have their content, including Google Photos, removed. The memories don't need a villain to disappear. They only need nobody to notice.

Why the photo problem is different from the password problem

If a family loses access to an invoicing tool, it's a mess, but it's a mess with workarounds. The vendor has support. The money can be traced. A new account can be opened.

Photos are the opposite. There is no second copy of the afternoon at the lake. The loss is permanent, and it lands at exactly the moment people are reaching for the evidence that a person existed and was loved. Families putting together a memorial slideshow in the first week are not asking for a file. They're asking to see someone's face.

There is a well-documented human reason this feels so heavy. Researchers who study grief describe "continuing bonds," the idea that healthy mourning often involves keeping an ongoing, symbolic connection with the person who died, rather than severing it. Photos, voice memos and videos are the raw material of those bonds. Losing them doesn't just remove data. It removes one of the main tools people use to grieve.

What the built-in tools actually do

The big platforms each offer a way to name someone. Each has limits, and it's worth knowing them before you rely on them.

Apple's Legacy Contact. You designate a person, and Apple gives them an access key. After your death, they submit the key and a death certificate, and Apple can grant access to much of your iCloud data, photos included. The catch is that the key has to be somewhere the person can find it. A key you generated and forgot about is the same as no key.

Google's Inactive Account Manager. You choose a period of inactivity (somewhere between three and eighteen months), a set of trusted contacts, and which data to share, which can include Google Photos and Drive. After the timer runs out and Google fails to reach you, it notifies your contacts and shares what you chose. It's useful precisely because it doesn't wait for a lawyer. Its limit is that it's all-or-nothing by service and by time. It won't separate the family album from the client folder sitting in the same Drive.

Facebook and Instagram memorialization. These let a legacy contact manage a memorialized profile, but they are not designed to hand over the full-resolution library.

None of these is a plan. They're switches. A plan is knowing which switches you've flipped, who's behind each one, and whether those people know.

The founder complication: one login, two lives

If you run a business alone, the camera roll often shares an account with the company. The same Google login that holds your kid's first steps holds your client contracts and your admin console. The same Apple ID that stores your wedding photos receives your two-factor codes.

This is where an otherwise tidy plan goes wrong. If you give your spouse full access to the account, you've given them the business too, which may be fine or may be a legal and privacy problem, depending on what's in there. If you restrict access, you've locked them out of the photos. The cleanest fix is separation: keep the family archive in its own place, with its own named recipient, apart from the account that runs the work.

Your next moves

None of this takes longer than an evening. Do it in this order.

  • Count what you have and where it lives. Open your phone's photo settings and write down every place photos are stored: iCloud, Google Photos, Dropbox, an old external drive, a messaging app that auto-saves. Most people find three or four, not one.
  • Make one local copy that doesn't depend on any login. Export your library, or the years that matter most, to an external drive. Keep it somewhere physical and findable, such as a fireproof box or a drawer your spouse knows about. A drive in a drawer survives an expired credit card.
  • Flip the switch on each platform today. Set up Apple Legacy Contact and print or save the access key. Configure Google's Inactive Account Manager with a person you trust and a timeout you're comfortable with. Then tell both people, in plain words, what they've been given.
  • Pay for storage in a way that outlives you. If your photo storage runs on a personal card, note when it expires and which account it's tied to. Ask your executor or spouse to be able to see the billing email so a lapse doesn't quietly start a deletion clock.
  • Say it in your will or letter of instruction. One sentence is enough: you consent to your executor accessing the content of your photo and cloud accounts, and here is where the access key and the drive can be found. That sentence is the consent the law often looks for.

If you do only one thing, make the local copy. Everything else is a convenience layered on top of it.

The kindest version of a plan

The goal isn't a perfect digital estate. It's that the person who loves you can open one thing and see your life. That could be a drive, a shared album, or a short note that says where to look.

The same logic applies to the rest of what you leave behind: the accounts, the access, the "who do I call." Heirloom is the app we built for exactly that handoff. It's a vault and a set of named beneficiaries where you can record where the photo archive lives, who holds the keys, and what each person is allowed to open, so the instructions are there when someone is in no state to go hunting. If that sounds useful, you can look at it at heirloom.lumenlabs.works. But start with the drive. The two-year-old mispronouncing a word is worth saving by whatever means you have.