Cloud Photos and Social Media After Death: Digital Legacy

Cloud photos, social media profiles and online accounts do not automatically become easy for family to access when you die. Each platform has its own rules, evidence requirements and limits. A complete digital legacy directory records what exists, where it is held, how lawful recovery works, what should be preserved or deleted and who should be trusted to act.

This is not the same as leaving a spreadsheet full of passwords. The safer approach is to create a clear map of devices, emails, password-manager access, two-factor recovery, cloud archives, social profiles, subscriptions and digital assets. Sensitive credentials should remain protected while the directory explains where authorised access is stored and when it may be used.

The full directory below is designed to be genuinely useful. It includes questions and grey guidance boxes for devices, recovery methods, cloud photos, social media, monetised digital assets, privacy boundaries, deletion instructions and trusted access. You can complete it now, download it when finished, and continue updating it as your digital life changes.

Within this planning series, the digital directory works naturally beside the personal legacy letter, the living will guide and the memorandum of wishes.

There is no universal digital inheritance process. Access depends on the provider, the settings you chose while alive, the type of data involved, local law and the documentation available to the person making the request. A family member may know that photos exist without being able to unlock the phone, receive a verification code or prove authority to the platform.

Apple allows account holders to name one or more Legacy Contacts. Apple explains that a Legacy Contact may be able to access photos, messages, notes, files and device backups, but not iCloud Keychain passwords, passkeys, payment information or purchased media. The contact generally needs the access key and proof of death.

Google’s Inactive Account Manager lets a user nominate people who may receive selected data after a period of inactivity. Google also states that it does not simply provide passwords or login details for a deceased person’s account, even when it considers a family or representative request.

Facebook offers a choice between memorialising the main profile with a legacy contact or requesting deletion after death. Its legacy contact guidance makes clear that a legacy contact cannot log into the account or read private messages, although they may be able to manage parts of the memorialised profile.

Create your digital legacy directory in Evaheld now so your family can find the accounts, instructions and platform settings that matter without being given unrestricted access today.

Why a digital legacy directory is more than a password list

The Australian eSafety Commissioner separates a digital legacy into digital assets and digital presence. Its digital legacy guidance includes purchased or created digital items, websites, domain names, online payment accounts and the personal traces left across platforms.

A password may unlock an account, but it does not explain what the account contains, whether access is lawful, which files matter, who should receive them or what the account holder wanted. Context is what turns technical access into responsible administration.

A useful directory should tell a trusted person:

which devices and accounts exist;
which email address controls recovery;
where protected credentials and recovery codes are stored;
which platform legacy tools are active;
which photos, documents and creative files should be preserved;
which profiles should be memorialised, deleted or left untouched;
which digital assets may have financial or business value;
which material must remain private;
who may act and when.

Digital legacy directory information to organise first

Primary email and phone recovery

Email and mobile numbers are often the recovery layer for nearly every other service. Record the main email accounts, recovery email, mobile carrier, account owner and where lawful recovery instructions are held. Do not assume a phone number will remain active indefinitely after death or incapacity.

Password manager and multi-factor authentication

The Australian Cyber Security Centre recommends choosing a reputable password manager, protecting it with a strong master password and enabling multi-factor authentication. Your directory should identify the password manager, emergency-access method, hardware security keys, authenticator apps and backup-code location without copying all credentials into the directory itself.

Evaheld’s password manager guidance and emergency access guide can help separate account instructions from live passwords.

Cloud photos, videos and family archives

Identify each photo library and whether it contains originals, compressed copies, shared albums, scanned family records or private material. Decide who should receive family archives and whether selected albums should be downloaded before any account is closed. Google’s official data export guidance explains how account holders can create an archive of Photos and other Google data while they still control the account.

Record profile URLs, login email, account type, legacy-contact status and your preference. Facebook explains that a memorialised profile remains visible to the audience selected by the account holder, while no one can log into it. Other platforms may offer deletion, evidence-based closure or no dedicated legacy feature at all.

Devices, encrypted drives and backups

List phones, laptops, tablets, desktops, external drives, home servers and encrypted backups. Record physical location, owner, operating system, purpose, encryption status, charger or adapter needs and the secure recovery pathway. A device can be physically present and still be inaccessible without the correct passcode or recovery key.

Subscriptions, websites and online services

Include cloud storage, streaming, software, newsletters, domains, web hosting, app stores, online communities and memberships. Some services should be cancelled quickly. Others must remain active until files, websites, emails or business records have been transferred.

Digital assets with financial or business value

Record marketplace balances, reward points, creator income, online shops, royalties, digital products, domains, advertising accounts, gaming assets and cryptocurrency records. Do not assume every asset can legally or contractually be transferred. The directory should tell the trusted person what exists and which lawyer, accountant or adviser should be consulted.

Complete digital legacy directory to copy and use

Complete the sections that apply to you. Each grey box explains what to record. Replace the guidance with your own information. Do not place raw passwords, seed phrases, complete identity documents or unrestricted recovery codes in a copy that may be casually shared.

Section 1: Directory ownership and intended use

1.1 Who created this digital legacy directory, and when was it last reviewed?

Write over this guidance: Add your full name, preferred name, date prepared and review date. Identify which copy is current.

1.2 Who should know this directory exists?

Write over this guidance: Name your spouse, digital helper, executor, attorney, adult child or trusted person. Add contact details and explain why each person is included.

1.3 When may the directory be used?

Write over this guidance: State whether it may be used during travel, hospitalisation, incapacity, after death or only after formal authority has been confirmed.

Section 2: Trusted digital helper and authority

2.1 Who is your primary digital helper?

Write over this guidance: Add the person’s name, relationship, phone and email. Explain the practical tasks you want them to handle.

2.2 Who is the backup digital helper?

Write over this guidance: Name an alternate person and record when they should step in.

2.3 What legal or platform authority may be required?

Write over this guidance: Identify the Will clause, power of attorney, executor appointment, court process or platform legacy setting that may be relevant. Do not assume this directory creates authority by itself.

2.4 What is outside the helper’s authority?

Write over this guidance: List accounts, files, conversations or actions they must not access, disclose, transfer or delete without further approval.

Section 3: Primary devices and encrypted storage

3.1 Which phones, computers and tablets contain important information?

Write over this guidance: List device type, brand, model, owner, physical location and what important data it holds.

3.2 Which devices are encrypted?

Write over this guidance: Record the encryption method and where the authorised recovery process is stored. Do not place the complete recovery key in an unsecured copy.

3.3 Where are external drives, servers and backups kept?

Write over this guidance: Identify each drive, home server, network storage device or backup, its contents, location and encryption status.

3.4 What equipment is needed to access old media?

Write over this guidance: List chargers, adapters, old computers, memory-card readers, backup phones or specialist software required to open older files.

Section 4: Email accounts and recovery pathways

4.1 Which email account controls most account recovery?

Write over this guidance: Record the email address, provider, purpose, recovery email and recovery phone. State where protected access instructions are stored.

4.2 Which other personal or business email accounts exist?

Write over this guidance: List each account, its purpose, who needs it and what should happen to it.

4.3 Which accounts depend on an old or secondary email?

Write over this guidance: Identify accounts that still send verification or billing messages to old addresses.

4.4 How long should email remain active?

Write over this guidance: State what must be completed before closure, such as finding assets, downloading records, transferring business accounts or cancelling services.

Section 5: Password manager and multi-factor recovery

5.1 Which password manager do you use?

Write over this guidance: Name the service, owner account, emergency-access feature and where the master recovery process is held. Do not write the master password here.

5.2 Which authenticator apps or security keys protect accounts?

Write over this guidance: List authenticator apps, hardware keys, passkeys, trusted devices and backup devices.

5.3 Where are one-time recovery codes stored?

Write over this guidance: Point to the protected physical or digital location. State who may access the codes and under what conditions.

5.4 Which accounts will fail without the second factor?

Write over this guidance: Prioritise email, banking, cloud storage, social media, domains, business systems and cryptocurrency services.

Section 6: Platform legacy-contact settings

6.1 Have you added an Apple Legacy Contact?

Write over this guidance: Record the contact’s name, date added, access-key location and whether they confirmed receipt.

6.2 Have you configured Google Inactive Account Manager?

Write over this guidance: Record the inactivity period, nominated contacts, data categories selected and whether the account should later be deleted.

6.3 Have you chosen a Facebook legacy contact or deletion preference?

Write over this guidance: Record the chosen person or deletion instruction and the date the setting was reviewed.

6.4 Which other platforms have a legacy, memorialisation or deceased-user process?

Write over this guidance: List each service and the current setting or support process. Review provider rules periodically.

Section 7: Cloud photos, videos and family archives

7.1 Where are your main photo and video libraries stored?

Write over this guidance: List iCloud Photos, Google Photos, OneDrive, Dropbox, external drives, shared albums and any other archive.

7.2 Which albums or folders must be preserved?

Write over this guidance: Identify family history, childhood photos, milestone events, voice recordings, scanned letters, genealogy and other irreplaceable material.

7.3 Who should receive copies of family material?

Write over this guidance: Name recipients and describe whether they should receive the full archive, selected albums or only material connected to their family branch.

7.4 Which photos or videos must remain private?

Write over this guidance: Describe restricted folders or categories without exposing the material itself. State whether they should be deleted, sealed or withheld.

7.5 What should happen before a photo account is closed?

Write over this guidance: State the required download, backup, duplicate check, metadata preservation and handover steps.

8.1 Which social media profiles exist?

Write over this guidance: List platform, profile URL, account email, display name and whether the account is personal, business or community-facing.

8.2 Should each profile be memorialised, deleted, archived or left untouched?

Write over this guidance: Record your preference and any timing conditions for each account.

8.3 Should anyone publish a final post or service notice?

Write over this guidance: Identify the person, platform, approved wording location and whether comments should remain open.

8.4 What should happen to direct messages and private conversations?

Write over this guidance: State whether they must remain private, be deleted or be reviewed only for essential administration.

8.5 Are you the sole administrator of any page, group or community?

Write over this guidance: List pages, groups, channels and admin roles that need another administrator before your account changes.

Section 9: Cloud files, documents and creative work

9.1 Which cloud storage services contain important files?

Write over this guidance: List the service, account owner, main folders, sharing settings and secure recovery pathway.

9.2 Which documents must be preserved for family, tax, legal or business reasons?

Write over this guidance: Identify legal records, tax files, insurance, identity records, contracts, creative work, manuscripts and family-history documents.

9.3 Which files can be deleted?

Write over this guidance: Describe obsolete, duplicate or private material that should not be preserved.

9.4 Who owns collaborative or shared files?

Write over this guidance: Identify business partners, family members, clients or organisations that may own or need copies of shared material.

Section 10: Subscriptions and digital services

10.1 Which subscriptions should continue temporarily?

Write over this guidance: List services needed for email, storage, websites, security, business records or family archives.

10.2 Which subscriptions should be cancelled quickly?

Write over this guidance: List streaming, apps, memberships, software, newsletters and other recurring charges that can stop once data is preserved.

10.3 Which services contain files or benefits that must be transferred first?

Write over this guidance: Identify cloud storage, domains, loyalty accounts, creator platforms and services with saved content or credit.

Section 11: Digital assets, rewards and financial value

11.1 Which online accounts hold money, credit, points or rewards?

Write over this guidance: List marketplaces, payment accounts, airline points, hotel rewards, store credit, advertising balances and creator income.

11.2 Which domains, websites or online shops do you own?

Write over this guidance: Record registrar, hosting provider, renewal date, business value, successor and intended action.

11.3 Which digital products, licences, royalties or intellectual property earn income?

Write over this guidance: Identify the platform, payment pathway, ownership evidence and adviser who understands the asset.

11.4 Do you hold cryptocurrency or self-custody digital assets?

Write over this guidance: Record the type of asset and where the protected recovery procedure is held. Never place seed phrases or private keys in an unsecured directory.

Section 12: Business, creator and professional accounts

12.1 Which accounts are required to keep a business or professional service operating?

Write over this guidance: List websites, payment processors, customer systems, social pages, cloud tools, domain records, advertising and accounting platforms.

12.2 Who should receive operational control?

Write over this guidance: Name the business partner, employee, adviser or successor and describe what they may manage.

12.3 What must be completed before an account is closed?

Write over this guidance: Include payroll, customer communication, order fulfilment, refunds, tax records, backups and licence transfers.

Section 13: Account-by-account disposition instructions

13.1 Which accounts should be preserved or transferred?

Write over this guidance: List each account, intended recipient, reason and prerequisites.

13.2 Which profiles should be memorialised?

Write over this guidance: List the platform, chosen legacy contact and the public outcome you prefer.

13.3 Which accounts should be deleted?

Write over this guidance: List the account, deletion timing and files that must be downloaded first.

13.4 Which accounts should be left untouched?

Write over this guidance: Identify accounts where inactivity, privacy or contractual limits make non-intervention the preferred choice.

Section 14: Privacy, confidentiality and family boundaries

14.1 What may the trusted person review for administration?

Write over this guidance: Define the limited categories they may search, such as bills, insurance, account ownership, subscriptions and family archives.

14.2 What must remain private even from close family?

Write over this guidance: Describe private correspondence, health material, confidential client data, personal journals or restricted folders.

14.3 Who may receive family photographs and personal files?

Write over this guidance: Set recipient boundaries, family branches, age limits or conditions.

14.4 What should happen if privacy wishes conflict with legal obligations?

Write over this guidance: Direct the trusted person to obtain legal advice and preserve the material until authority is clear.

Section 15: First 72 hours and staged action plan

15.1 Which accounts and devices must be secured immediately?

Write over this guidance: Prioritise phones, email, payment accounts, business systems, domains and devices containing irreplaceable data.

15.2 Which services must remain active during administration?

Write over this guidance: List phone numbers, email, cloud storage, website hosting and subscriptions needed for recovery and evidence.

15.3 What should happen during the first month?

Write over this guidance: Include downloading archives, notifying platforms, transferring business access, cancelling charges and documenting every action.

15.4 What should only happen after legal authority is confirmed?

Write over this guidance: Identify account access, asset transfer, deletion, data disclosure and business-control actions that require formal authority.

16.1 How often should the directory be reviewed?

Write over this guidance: Set a six-month or annual review and add immediate review triggers such as a new phone, new password manager, changed recovery email or new business account.

16.2 Who can access the current version?

Write over this guidance: List each person, their role, access level, release timing and the date access was confirmed.

16.3 What changed in this version?

Write over this guidance: Record the date, section updated, account added or removed and person who confirmed the change.

Complete and share your digital legacy directory in your Evaheld Legacy Vault for free. Download a copy when you finish, keep the living version current and release the right information to the right people when the time is appropriate.

Digital legacy mistakes that can cost families access and privacy

Do not assume that knowing a password gives a person lawful authority. Do not leave a single unprotected document containing every password, PIN, seed phrase and recovery code. Do not delete accounts before downloading irreplaceable data. Do not rely on a phone number that may be cancelled, an email address nobody can recover or a legacy contact who does not know they were appointed.

Do not treat every account the same. A family photo library, private journal, business email, social profile, cryptocurrency wallet and streaming subscription require different instructions. Do not allow a well-meaning family member to memorialise or delete a profile before the consequences are understood.

Google’s inactive account policy states that personal Google Accounts may be deleted after at least two years of inactivity in defined circumstances. This is one reason a directory should record important accounts, preserve current exports and identify which services need ongoing attention.

Printed digital legacy directory versus a secure online record

A short printed index can help a trusted person find the secure directory, lawyer, password manager or emergency contact. It should not contain full credentials or unrestricted identity information. Paper becomes stale quickly and can be copied or discovered by the wrong person.

A secure online directory is easier to update, search and share in stages. It can sit beside related documents, trusted contacts and future-delivery instructions. Evaheld’s sensitive document organisation guide, legacy contact settings checklist and trusted access guide can help build the surrounding system.

Digital information changes constantly. New phones replace old devices, recovery codes rotate, accounts close, subscriptions move and photo libraries grow. Evaheld gives the directory a stable home while allowing the instructions to evolve.

You can keep the directory private while drafting, download it for your records, connect it with the Evaheld Essentials Vault, and share selected information with trusted people now or later. The family readiness checklist can help identify other documents and people that belong beside it.

Start your digital legacy directory today. Begin with your primary email, phone, password manager and cloud photo library, then add the accounts and instructions that matter most.

Digital legacy directory next steps for protecting your family

Start with the accounts that control everything else: your primary email, phone, password manager and cloud photo library. Record where secure recovery lives, which platform legacy tools are active and who should receive family material.

Then work account by account. State what should be preserved, transferred, memorialised, cancelled, restricted or deleted. A clear digital legacy directory turns a scattered online life into an organised plan that protects both family memories and personal privacy.

Share this article

What Happens to My Cloud Photos and Social Media When I Die? Complete Digital Legacy Directory

What happens to cloud photos and social media after death