CustodyComms Privacy Policy

Your privacy is extremely important to us. This Privacy Policy explains what information CustodyComms collects, how we use and share that information, and your rights regarding your information. Our goal is to be transparent about our privacy practices in plain language. By using the CustodyComms application or any related services (collectively, the “Service”), you acknowledge the practices described in this Privacy Policy. Where we rely on your consent for a particular feature or processing activity, we will request that consent separately as described below. If you do not agree with the practices described in this Privacy Policy, please do not use the Service.

Who We Are: When we say “CustodyComms,” “we,” “us,” or “our,” we mean CustodyComms, Inc., the company providing this Service. We are based in the United States. We offer a specialized communication and evidence-management application for co-parenting and legal contexts, designed with privacy in mind: your case data is stored on your own device, and a case you share is encrypted on your device before it is uploaded. The applications do not themselves encrypt the data stored on your device.

Scope: This Privacy Policy applies to information we collect through the CustodyComms desktop application (Windows and macOS), the CustodyComms mobile application (iOS), our website, and any other related online services we provide. It also applies to any contact you have with us for support or inquiries. It does not cover any third-party services you might use in connection with CustodyComms (like an email provider or cloud backup service on your device) — those have their own privacy policies.

By using CustodyComms, you also agree to our Terms of Service, which is a separate document governing your use of the Service. We encourage you to read that as well, especially to understand our unique architecture (since it affects privacy).

1. Our Privacy Commitment: Local-First Architecture

CustodyComms is built on a local-first architecture across both desktop and mobile platforms. This means:

In the desktop and mobile applications, your case data, imported communications, and evidence exports are stored locally on your device — not on CustodyComms servers

In those applications we do not upload, access, or store your case data on our servers in unencrypted form, except as described below

You maintain full ownership and control of your content at all times

Important Nuance: While your case data remains local, certain features require limited cloud processing to function. Specifically:

Encrypted Sharing — When you share a case with another user, an encrypted copy is uploaded to Google Cloud Storage. The encryption happens on your device before the upload. CustodyComms holds no key that opens a case shared from version 2.0 or later. A report you send to your phone from our website is different: we can open it for as long as it exists (Section 10). We can see the share's name, note, who it is for, and its size and dates, but not what is inside. When you invite someone whose CustodyComms is not yet set up to receive the case, and whenever you invite a recipient by email from version 1.1 or later of the iPhone app, their invitation email carries a key made for that invitation, which passes through our servers and our email provider on its way to them; Section 8.1 says what that key could open, and until when. We do not read the contents of cases shared from the applications. Associated metadata (share status, recipient identifiers, wrapped encryption keys) is stored in Firebase Firestore. If you never share a case, no copy of it goes to cloud storage at all. Cases shared from a version of CustodyComms earlier than 2.0 may also carry a further copy of the key, stored with the share and wrapped under a key our own systems can derive, so for those cases we hold the technical means to open them. Cases shared from version 2.0 or later do not carry that copy.

Multi-Factor Authentication — MFA configuration data (encrypted TOTP secrets, hashed backup codes) is stored in Firebase Firestore to enable cross-device authentication. Our server-side authentication functions decrypt the TOTP secret under a company-controlled key each time a code is verified. Access is restricted; we do not claim the secret is beyond the technical reach of the company that operates the server.

AI Analysis — If you turn on cloud AI in the desktop app, the messages in the incidents you send are sent to OpenAI as written, with the participants' names, through a Cloudflare Worker we operate. They are not redacted first. With cloud AI on, Matter Builder can also send short message excerpts (Section 7.2). The Worker authenticates the request, applies rate limits, and forwards the content to OpenAI. We do not persist the selected content in our databases, do not use it for advertising, and do not make it available for routine human review. Technical request metadata (timing, identifiers, error codes) may be processed for security, reliability, abuse prevention, and legal compliance. The retention and processing posture at OpenAI is described in §7.

Help Chat — If you use the in-app Help Chat, or the assistant on our website’s Learn pages, your questions are sent to an AI service for processing. We do not store your questions. When the assistant on our website declines a question, we record that it declined and why, not the question (§7.3). OpenAI may keep questions for up to 30 days (§7.3).

The try-the-product demo (/try) — This one is not local-first. It is the only feature where a complete conversation is uploaded to us and processed in readable form. It runs on our website rather than in the applications, requires no account, and works by having you upload a complete exported conversation to us so we can produce a sample analysis of it. The file’s extracted text is sent to OpenAI (or the file itself, when it is a scanned or screenshot PDF whose text cannot be read directly), and we hold that text and the resulting report for up to 24 hours, unless you send the report to your phone, in which case we keep it until you delete it. If you do not want a conversation file processed on our servers, do not use the demo; the applications do not work this way. §2.7 describes the demo, §10 gives the retention, and §12.5 gives the regions where the demo is offered.

Analytics — Limited, pseudonymous usage and event data is collected to maintain and improve the Service (see Section 6 for the analytics identifier inventory and Section 6.9 for the cross-surface identifier linkage).

The remainder of this policy describes each of these data flows in detail so you can make informed decisions about which features to use.

2. Information We Collect

We collect very limited personal information — far less than most communication apps — due to our local-first design. We structure this section by category of data.

2.1 Account and Authentication Data (You Provide)

Email address — Used for account creation, authentication, and notifications. Stored in Firebase Authentication (Google). Retained until account deletion.

Password — Used for authentication. Stored as a salted hash managed by Firebase Authentication (Google) — CustodyComms does not store your password. Retained until account deletion.

Display name (first and last) — Used for account identification. Stored on your local device and in Firebase Firestore. Retained until account deletion.

Role (e.g., attorney, parent, paralegal) — Used for feature customization. Stored on your local device and, when you sign up on our website, in Firebase Firestore. Retained until account deletion.

State/jurisdiction — Used for legal context and tax compliance. Stored on your local device. Retained until you delete the app's data.

Country of residence (and, in Canada, province) — Used to decide whether sharing is available to you, because sharing is offered only in the countries listed in Section 11.5, and, when you sign up on our website, whether we can open an account for you. You give it at sign-up (on our website or in the desktop app), or the first time you share a matter or are added to one. Stored in Firebase Firestore; the desktop app also keeps its own record of each answer on your computer. We keep only your most recent answer and the one you gave at sign-up; when you correct it, the earlier answer is deleted. When you sign up on our website, we also record the country your connection (IP address) indicates, beside the country you declare. Retained until account deletion.

Your email serves as your primary login identifier. You sign in with either a password or a supported sign-in provider (Google or Apple). Authentication is handled through Firebase Authentication, a secure service provided by Google — your email and, if you use a password, your encrypted password credentials are stored with Firebase. We do not require your physical address or phone number to create an account.

If you sign in with Google or Apple, that company tells us your email address and an account identifier. Google may also share your name and profile picture. We use them only to sign you in, and keep them with your account until you delete it. We never receive your Google or Apple password. If you choose Apple's Hide My Email, we receive a private address that forwards to you, and your account uses that address.

2.2 Security and Multi-Factor Authentication Data (Generated During Use)

If you enable Multi-Factor Authentication (MFA), the following data is collected and stored:

TOTP secret — Used for time-based one-time password generation. Stored in Firebase Firestore with Cloud Function-only access, encrypted with AES-256-GCM using a per-user HKDF-SHA256 derived key. Retained until you set up MFA again or delete your account.

Backup codes (10 per enrollment) — Used for MFA recovery if your authenticator is lost. Stored in Firebase Firestore as Argon2id one-way hashes; plaintext is shown only once during enrollment. Retained until regenerated, used, MFA is disabled, or your account is deleted.

MFA verification rate limits — Used for brute-force prevention. Stored in Firebase Firestore as a counter only. Attempts are counted over a 15-minute window, and the counter is kept until you next verify successfully.

Device trust credential — Used for trusted device recognition (bypasses step-up verification on recognized devices). Stored locally in Electron safeStorage or iOS Keychain, and as a SHA-256 hash in Firebase Firestore; the desktop app keeps the hash in its local database instead. Retained for 30 days or until revoked; on desktop, an expired or revoked credential stops working and stays until the app's data is deleted.

Session tokens — Used for authentication state. Stored locally in SQLite as SHA-256 hashes, and the tokens themselves are stored encrypted with your operating system's key. Retained until logout, device transfer, or expiry.

Security events — Used for audit trail (login attempts, MFA changes, session events). Stored locally in SQLite, protected by your OS user account. Retained for the life of your account and thereafter as necessary for the establishment, exercise, or defense of legal claims (including applicable limitations periods and any litigation hold), under our documented retention rationale.

Firebase ID tokens — Used for cloud service authentication. Stored encrypted with your operating system's key on your device until you sign out.

MFA Architecture: Your TOTP secret is generated by a Firebase Cloud Function, encrypted with AES-256-GCM using a key derived via HKDF-SHA256 with a per-user salt, and stored in Firebase Firestore. The encryption master key is held in Firebase Secret Manager and is never present on user devices. It is read by the Cloud Functions that verify codes, and the person who administers the Firebase project can reach it.

Backup Code Recovery: Backup codes are the sole recovery mechanism if you lose access to your authenticator app. If you lose both your authenticator and all backup codes, your account is permanently locked. This is an intentional security measure — there is no email-based recovery. CustodyComms does not reset MFA for anyone, administratively or through support. See our Terms of Service, Section 2 for full details.

2.3 Device and Licensing Data (Collected Automatically)

Device fingerprint — Used for single-device enforcement and session theft detection. Stored in Firebase Firestore. Current and past device identifiers are kept until account deletion.

Device name — Used for device identification in the settings UI. Stored in Firebase Firestore. Current and past device names are kept until account deletion.

Platform (desktop or iOS) — Used for platform-specific feature delivery. Stored on your local device and in Firebase Firestore. Retained until account deletion.

App version — Used for update delivery, compatibility, and support. Kept on your device; up to 14 months in analytics.

When the desktop app checks for updates, it downloads them from GitHub, which hosts our update files. GitHub sees your IP address and the app's version, as with any download.

Operating system and version — Used for compatibility and crash diagnostics. Kept on your device; up to 14 months in analytics.

Device transfer history — Used for transfer limit enforcement (3 per year). Stored in Firebase Firestore. Retained while your account exists.

Single-Device Enforcement: Signing in to the desktop app on another computer signs the first computer out. The iPhone app is not limited this way. This is a licensing and account-security control.

2.4 Payment Data (You Provide)

Credit card / payment method — Used for subscription billing. Stored by Stripe only — never stored locally or on our servers. Retained per Stripe’s retention policy.

Cardholder name, billing zip — Used for payment processing. Stored by Stripe only. Retained per Stripe’s retention policy.

Last 4 digits, card type — Used for receipt display and support. Received from Stripe via API. Retained until account deletion.

Subscription tier and status — Used for feature access and billing. Stored locally in SQLite, by Stripe, and in our billing database. Retained for 7 years (tax/accounting requirement).

Transaction dates and amounts — Used for billing records. Stored by Stripe. Retained for 7 years (tax/accounting requirement).

CustodyComms does not store your full credit card number, expiration date, or CVV. All payment details are sent directly to Stripe, a PCI DSS Level 1 compliant payment processor.

2.5 Optional Feature Data (You Choose to Enable)

The following data is collected only when you actively use optional features:

Cloud-Based AI Analysis (Desktop Only, Opt-In)

Selected message content — Used for AI-assisted incident analysis. When you turn on cloud AI, the messages in the incidents you send are sent as written, with the participants' names, from your device through a Cloudflare Worker we operate to the OpenAI API. They are not redacted first. We do not persist this content in our databases. We send API requests with the store: false parameter where the OpenAI endpoint supports it; this parameter controls application-state storage at OpenAI for supported endpoints. store: false is not the same as OpenAI Zero Data Retention. CustodyComms does not have a Zero Data Retention or Modified Abuse Monitoring contract with OpenAI. Under OpenAI's standard published API data controls, OpenAI may retain abuse-monitoring logs — which may contain customer content — for up to 30 days. OpenAI does not use API data to train its models under the standard API terms. We will update this disclosure before representing that any Zero Data Retention or Modified Abuse Monitoring control applies.

AI consent status and timestamp — Used for consent tracking. Stored locally in SQLite. Retained until changed.

Cloud AI is off until you turn it on. When you ask for AI analysis, the app sends the incidents you ask about: one incident, or every flagged incident in a matter. Each incident's messages are sent as written, with the participants' names, and are not redacted first. With cloud AI on, Matter Builder can also send message excerpts of up to 280 characters each; pattern matching removes the email addresses, phone numbers, ID and card numbers and numeric dates it recognizes from those excerpts, and can miss some, while names and the rest of the text remain. The content is sent from your device to a Cloudflare Worker we operate, which authenticates the request and forwards the content to OpenAI. We do not persist the content in our databases, do not use it for advertising, and do not make it available for routine human review. OpenAI processes the content according to its standard published API data controls; OpenAI does not use API data to train its models under those terms. The retention posture at OpenAI is described in §7.2. You can turn cloud AI on or off at any time.

CustodyComms also offers local AI analysis via Ollama (desktop only), which processes data entirely on your device. When using Ollama, no message content leaves your computer.

AI-powered chat on the website. In addition to the desktop-only incident-analysis feature described above, the CustodyComms website offers AI-powered chat at /learn, /help, and /try (available without an account) and at /account/help and /account/learn (available to signed-in users). All website chat surfaces send your questions through a Cloudflare Worker we operate to OpenAI's API, under the same store: false posture and the same retention statement described in §7.2. Your Firebase user ID, when you are signed in, is used by our Worker for rate-limit accounting, and can appear in our error logs — it is not included in the prompt body sent to OpenAI.

Help Chat (Opt-In)

Your help questions — Used for AI-assisted product support. Sent from your device to a Cloudflare Worker we operate, which forwards the question to OpenAI's API. We do not store help questions; the next paragraph says what we record when the assistant declines one. The OpenAI-side retention posture is the same as for AI Analysis (see §7.2): store: false where supported, no Zero Data Retention contract, and OpenAI's standard abuse-monitoring retention of up to 30 days may apply.

The Help Chat feature answers product-usage questions from the CustodyComms help manual. It does not have access to your case data. Questions are processed by OpenAI's GPT-4o-mini model. Your question passes from your device through a Cloudflare Worker we operate, which forwards it to OpenAI. We do not store Help Chat conversations. When the assistant on our website declines a question, we record in our support system (HubSpot) that it declined, the reason and the country your connection indicates, and, if you are not signed in, we keep a hash of your IP address in our own queue for up to about 90 days so that the same refusal is not recorded twice. We do not record the question. Until this version of the policy took effect we also saved up to the first 280 characters of a declined question there, after a filter removed the contact details it recognized; other names and details remained. We no longer save them. The excerpts saved before then are still in our support system, are not attached to an account, and have no deletion date. We make no representation about Cloudflare's own edge-log retention beyond what Cloudflare publishes in its Data Processing Addendum. The retention posture at OpenAI is as described in §7.2: store: false where supported, no Zero Data Retention contract, and OpenAI may retain abuse-monitoring logs for up to 30 days under its standard API data controls.

Encrypted Sharing (Opt-In)

Encrypted .ccm files — Used for sharing case data with authorized recipients. Encrypted on your device, then stored in Google Cloud Storage. We do not hold a key that opens them when they are shared from the applications; for cases shared from a version earlier than 2.0, see Section 8.1. Retained until the creator deletes the share or their account.

Share metadata — Used for access control and recipient management. Stored in Firebase Firestore. Retained until the share is deleted.

Recipient identifiers — Used for recipient lookup. Recipient records are found by an HMAC-SHA256 hash of the email address. The share and its recipient records also hold each recipient's email address in readable form, so that invitations can be delivered and matched. Stored in Firebase Firestore. Retained until the share is deleted.

Wrapped encryption keys — Used for per-recipient decryption authorization. Stored in Firebase Firestore on a per-version basis. Retained until the share is deleted.

Access check timestamps — Used for access verification when a shared case is opened. Stored in Firebase Firestore. Retained until the share is deleted.

When you share a case, it is encrypted on your device using AES-256-GCM with X25519 key exchange before upload. Your own devices and each recipient's devices each receive their own wrapped copy of the data encryption key (DEK). For a case shared from the applications, no copy is wrapped under a key CustodyComms holds, except for cases shared from a version earlier than 2.0 (Section 8.1). See Section 8 for full details.

Clio Integration (Opt-In)

Clio OAuth tokens — Used for practice management authentication. Stored locally in SQLite with Fernet encryption. Retained until disconnected.

Documents uploaded to Clio — Used for exporting evidence to Clio. Stored on Clio’s servers as a user-directed transfer. Retained per Clio’s policies.

You can disconnect Clio at any time in Settings, which deletes all stored tokens.

iPhone Notifications (Opt-In)

If you allow notifications on iPhone, we store a notification token for your device with Firebase Cloud Messaging so we can tell you when a matter is shared or updated; the notification data carries the matter's name and the sharer's email address, not message content. Deleted with your account.

Analytics (See Section 6 for Full Details)

Essential usage data — Used for service health and bug detection. Stored in Google Analytics 4. Retained for up to 14 months.

Detailed usage data (opt-in) — Used for feature improvement. Stored in Google Analytics 4. Retained for up to 14 months.

2.6 Communications with Us

If you contact us for support or feedback (via email, support form, or in-app), we collect whatever information you provide in that communication — your contact details, a description of your issue, and any attachments. We store support communications in our support system so we can reference them to help you and improve the Service. Email sent to our addresses is received in mailboxes hosted by Google. If you have a paid plan and the demo on our website refuses a file you upload, we email our support inbox about it, at most once a day for your account, so that we can help you: the email gives your account email address, your plan, why the file was refused, the file’s type and size, the time and a request number. It does not include the file, its name or anything written in it. A copy is kept in our support mailbox and in the system that sends our email, and we do not currently delete these copies automatically. We will never proactively ask you for the content of your messages or case data.

If you give us an email address on our website to receive a download link, we keep it with the kind of computer you asked for, the country your connection indicates, a hashed IP address, and your browser and referring page, until you ask us to delete it.

If the demo on our website cannot read a file you upload, it may offer to email you once if that kind of file starts working. If you accept, we keep the address you type, encrypted, with a fingerprint of it so that we can find it if you ask us to delete it; if you are signed in, we keep a link to your account instead. With it we keep the app you told us the file came from, the reference number of the refused upload and our own record of why it was refused. The request does not include the file, its name or anything written in it. We use this only to send that one email, through SendGrid; for a signed-in request we send it to your account’s address at that time, and only if that address is verified. We delete the request when we send the email, when you ask us to, when you delete your account, or 13 months after you asked, whichever comes first. As with every email we send, a record that we sent it is kept with our other email records, which we do not currently delete automatically.

2.7 Case Content and Sensitive Information

We design our system to minimize data collection. This section says what stays on your device, and what reaches our servers when you use a feature that sends it to us:

Content of your communications — In the desktop and mobile applications, the text of messages, images, documents, and other case data stays on your device. If you turn on cloud AI there, the messages in the incidents you send go as written, with the participants' names, through a Cloudflare Worker we operate to OpenAI and are not persisted in our databases (see §7.2 for the full retention statement). If you share a case from the applications, an encrypted copy is stored in cloud storage; we do not hold a key that opens it, except for cases shared from a version earlier than 2.0 (see Section 8.1).

The try-the-product demo on our website works differently on purpose. There you upload a complete exported conversation file to us. We extract the text from that file, send the extracted text to OpenAI to produce a sample analysis, and hold the extracted text and the resulting report for up to 24 hours so you can reopen the report in that window, unless you send the report to your phone, in which case we keep it until you delete it. If the file is a scanned or screenshot PDF whose text cannot be read directly, we send the file itself to OpenAI so the text can be read from its pages. The uploaded file itself is not kept. §10 states what is retained and for how long, and §12.5 states where the demo is offered.

Other parties’ information — In the desktop and mobile applications, names, contact details, and information about your co-parent, children, or other parties are in your local app data only, unless you share a case or turn on cloud AI, which sends an incident's messages as written, with the names in them (Section 7.2). In the website demo described above this is not the case: an exported conversation ordinarily contains information about other people, including children, and whatever the uploaded file contains is processed and retained on the same basis as the rest of it.

Why we process the communications you bring. You bring communications into CustodyComms to prepare for an actual or anticipated legal matter and to share them with your attorney. They can include information about other people, including health information about the other parent or your children. We process them only to provide the features you ask for in support of that preparation. We limit who can reach them as this policy describes, and we do not use their contents for any unrelated purpose.

Sensitive personal data categories — We do not ask you for race, ethnicity, religious beliefs, sexual orientation, health information, biometric identifiers, genetic data, social security numbers, or financial account passwords. The communications you bring can still contain any of these. Health information in particular is common in them, about you, the other parent and your children, and where a feature sends communications to us (the website demo, cloud AI, a report you send to your phone) it comes with them, as this section describes.

Precise location data — We do not collect GPS or precise geolocation. We use the country your IP address indicates, at sign-up and each time you use cloud AI or Help Chat, to check the feature is offered where you are. On the demo we also use it to choose whether a file’s dates are read day first or month first, when the file itself does not show which. At website sign-up we also record that country beside the one you declare (Section 2.1).

Advertising identifiers — We do not collect Apple’s IDFA or other mobile advertising identifiers. On the website we record advertising click identifiers (such as gclid and fbclid) as described in §15.4. We have disabled ad personalization signals in all analytics services.

Age Requirement: CustodyComms is intended for users who are 18 years of age or older. We do not invite anyone under 18 to create an account or to send us information. This is about who uses CustodyComms, not whose information appears in it: the records an adult brings ordinarily contain information about children. If we learn that we have collected information from a user under 18, we will delete that account and associated data promptly.

3. How We Use Your Information

We use the information we collect for the purposes described below. For users in jurisdictions requiring a legal basis for processing (such as the GDPR), we have identified the applicable legal basis for each activity.

Account creation and management — Legal basis: Contract performance (GDPR Art. 6(1)(b)). Data used: Account data (email, name, role, country and, in Canada, province).

Multi-factor authentication — Legal basis: Contract performance + Legitimate interest (security). Data used: MFA data, device trust credentials.

Device licensing and single-device enforcement — Legal basis: Contract performance. Data used: Device fingerprint, device name, platform.

Subscription billing — Legal basis: Contract performance. Data used: Payment data, subscription status.

Email notifications (verification, reset, step-up codes, billing) — Legal basis: Contract performance. Data used: Email address.

One email when a kind of file starts working on the website demo, only if you ask for it — Legal basis: Consent. Data used: The email address you give, or your account’s address.

Essential analytics (feature health, crash reporting) — Legal basis: Legitimate interest (Art. 6(1)(f)). Data used: pseudonymous, non-content usage and diagnostic data.

Detailed analytics (usage patterns) — Legal basis: Consent (Art. 6(1)(a)). Data used: pseudonymous, non-content usage analytics.

AI-assisted analysis (OpenAI, desktop only) — Legal basis: Consent. Data used: The messages in the incidents you send, as written with the participants' names, and Matter Builder message excerpts.

Help Chat (OpenAI via secure relay) — Legal basis: Consent. Data used: User questions (not stored by us).

Encrypted sharing — Legal basis: Consent + Contract performance. Data used: Case data (encrypted), sharing metadata.

Security logging and fraud prevention — Legal basis: Legitimate interest. Data used: IP address, user agent, device fingerprint, security events.

Legal compliance — Legal basis: Legal obligation (Art. 6(1)(c)). Data used: the records Section 4.2 says we can produce.

You may withdraw consent for any consent-based processing at any time by disabling the relevant feature in your app settings or, for Help Chat, with the turn-off button in Help Chat.

We do NOT:

Sell your personal information to anyone, for any reason

Use your case data for advertising, profiling, or targeted marketing

Share your data with data brokers

Use your content to train AI models

Scan, monitor, or analyze the content of your imported communications for advertising, profiling, or routine human review. If you choose optional AI features described in §2.5 and §7, selected content you submit is processed for the limited purpose of providing that feature.

Make automated decisions that produce legal effects about you (GDPR Art. 22)

We use HMAC-SHA256 email hashing for sharing recipient lookup — meaning we use a one-way cryptographic hash of email addresses for recipient identification.

4. How We Share Your Information

We do not sell your personal information to third parties. We share information with service providers necessary to operate the Service, with the advertising networks described in §15.4 for the limited purpose of measuring whether an advertisement led to a signup, and in the limited circumstances described below.

4.1 Service Providers (Sub-Processors)

We work with the following third-party service providers. Each receives only the minimum data necessary for its function. Each is engaged under that provider’s standard customer terms, including its data-processing terms where the provider makes them part of those terms.

1. Google LLC (Firebase Authentication) - Purpose: User authentication, password management, sign-in with Google or Apple - Data processed: Email, hashed password (if you use one), user ID, and, if you sign in with Google or Apple, the account identifier that company gives us (from Google, also your name and profile picture) - Certifications: SOC 1/2/3, ISO 27001 - Transfer mechanism: EU-US Data Privacy Framework - Data location: US

2. Google LLC (Cloud Firestore) - Purpose: User profiles, MFA configuration, device licensing, sharing metadata, recipient management - Data processed: Account data, encrypted MFA secrets, device records, share permissions, wrapped encryption keys, recipients' email addresses, the matter's name and any share note (readable) - Certifications: SOC 1/2/3, ISO 27001 - Transfer mechanism: EU-US Data Privacy Framework - Data location: US

3. Google LLC (Cloud Functions for Firebase) - Purpose: Server-side processing (see Cloud Functions Inventory below) - Data processed: Auth tokens, email, device IDs, MFA data, sharing operations - Certifications: SOC 1/2/3, ISO 27001 - Transfer mechanism: EU-US Data Privacy Framework - Data location: US (us-central1)

4. Google LLC (Cloud Storage) - Purpose: Encrypted .ccm file storage - Data processed: Encrypted files with a small unencrypted header (Section 8.2) (encrypted on the sender's device; CustodyComms holds no key that opens them, except for cases shared from a version earlier than 2.0 (Section 8.1, which also describes invitation keys) and except a report you send to your phone from our website, which we can open for as long as it exists (Section 10); invitation keys are described in Section 8.1) - Certifications: SOC 1/2/3, ISO 27001 - Transfer mechanism: EU-US Data Privacy Framework - Data location: US

5. Google LLC (Google Analytics 4) - Purpose: Product analytics via Measurement Protocol - Data processed: Pseudonymous usage data, random client ID, Firebase user ID, and a one-way, unsalted fingerprint of the account email (desktop app); Firebase Crashlytics (iPhone crash reports: device model, OS version, stack traces) - Certifications: SOC 1/2/3, ISO 27001 - Transfer mechanism: EU-US Data Privacy Framework - Data location: US

6. Cloudflare, Inc. — Purpose: edge compute, transactional database, object storage, real-time stateful coordination, vector retrieval for help and learn chat, AI model inference for embedding, browser-rendered image generation, and bot- and abuse-mitigation. The Cloudflare Workers infrastructure also performs the OpenAI relay described in §7. - Data processed: request metadata, IP address, user agent, our own session cookie, request bodies for /v1/* endpoints (including OpenAI-bound bodies being forwarded to OpenAI), audit-log records that contain only hashed identifiers and event metadata (no raw user content), billing webhook events, Cloudflare Turnstile tokens, and browser-rendered output buffers. - Sub-services used: Workers (edge compute); Workers KV (cache and configuration, JWKS cache, requests for a download link, and reports sent to a phone from our website); D1 (billing, CRM outbox, consent log, encrypted email outbox); R2 (demo audit log, installer artifacts); Durable Objects (traffic counter, email-verification PIN coordination, device step-up coordination, account-abuse throttle); Vectorize (public help-corpus retrieval index); Workers AI (embedding inference); Browser Rendering (image generation for the demo); Turnstile (bot mitigation on contact, demo, signup, whitepaper, and the unlock route). - Certifications: SOC 2 Type II, ISO 27001, ISO 27018, PCI DSS Service Provider Level 1, FedRAMP Moderate (select services), EU-US Data Privacy Framework participant, UK Extension and Swiss-US frameworks. - Transfer mechanism: Cloudflare's Customer Data Processing Addendum incorporating EU Standard Contractual Clauses and the UK International Data Transfer Agreement. - Data location: Global edge network; primary processing in the United States.

7. Stripe, Inc. - Purpose: Payment processing, subscription management, billing portal - Data processed: Email, payment method, billing address, subscription data - Certifications: PCI DSS Level 1, SOC 1/2 - Transfer mechanism: EU-US Data Privacy Framework - Data location: US

8. Twilio, Inc. (SendGrid) - Purpose: Transactional email delivery - Data processed: Email address, notification content - Certifications: SOC 2 Type II, ISO 27001 - Transfer mechanism: EU-US Data Privacy Framework - Data location: US

9. OpenAI, LLC - Purpose: AI-assisted incident analysis (opt-in), Matter Builder (opt-in), Help Chat and the website chat assistants, and the try-the-product demo on our website - Data processed: the messages in the incidents you send, as written with the participants' names; Matter Builder message excerpts; help and chat questions; for the website demo, the text extracted from the file you upload, or the file itself when it is a scanned or screenshot PDF whose text cannot be read directly - Certifications: SOC 2 Type II - Transfer mechanism: Standard Contractual Clauses in OpenAI’s Data Processing Addendum, for personal data subject to EEA, Swiss or UK law - Data location: US

10. Themis Solutions Inc. (Clio) - Purpose: Legal practice management integration (opt-in) - Data processed: Documents uploaded by user - Certifications: SOC 2 Type II, ISO 27001 - Transfer mechanism: N/A (user-directed transfer) - Data location: Canada/US

11. HubSpot, Inc. (HubSpot CRM) — Purpose: contact and lead management, sales pipeline, and marketing-subscription operations. Single portal 246166715. - Data processed: email, first name, last name, phone (when provided by the user), company, job title, lifecycle stage, owner assignment, legal-basis tag, our internal Firebase user ID, lead identifier, lead source, audience segment, a milestones field that records subscription and download events, and support tickets, including the record that Help Chat declined a question and the earlier excerpts described in Section 7.3. - Certifications: SOC 2 Type II, ISO 27001, EU-US Data Privacy Framework participant, UK Extension and Swiss-US frameworks. - Transfer mechanism: HubSpot's Data Processing Addendum incorporating EU Standard Contractual Clauses and the UK International Data Transfer Agreement. CustodyComms is the controller of the contact records; HubSpot acts as a processor. CustodyComms uses HubSpot only to process CustodyComms-supplied contact and lead data on CustodyComms' instructions; we do not use HubSpot's data-enrichment or insights features to add information about you from third-party sources, and we will update this disclosure before any such change takes effect. - Data location: United States.

12. Mixpanel, Inc. (Mixpanel) — Purpose: event-level product analytics across the marketing website, signup funnel, and account area. - Data processed: a first-party device identifier we set (the cc_did cookie); your Firebase user ID after you sign in; event names and properties (button clicks, page paths, feature interactions, timestamps); request IP forwarded server-side; standard event metadata. We do not send your email address to Mixpanel, and we do not send the content of any custody or family-law message to Mixpanel. - Certifications: SOC 2 Type II, ISO 27001, EU-US Data Privacy Framework participant, UK Extension and Swiss-US frameworks. - Transfer mechanism: Mixpanel's Data Processing Addendum incorporating EU Standard Contractual Clauses and the UK International Data Transfer Agreement. - Data location: United States.

13. Functional Software, Inc. d/b/a Sentry — Purpose: error and exception monitoring, release-health tracking. - Data processed: error stack traces, request URL path, request identifier, environment tag, and a release tag corresponding to the Cloudflare deployment. Before sending, our scrubbers remove the email addresses, sign-in tokens, cookies, Authorization headers and account-ID fields they recognize from error reports. Log lines and page addresses can still contain your account ID (Section 10). - Certifications: SOC 2 Type II, ISO 27001, EU-US Data Privacy Framework participant. - Transfer mechanism: Sentry's Data Processing Addendum incorporating EU Standard Contractual Clauses and the UK International Data Transfer Agreement. - Data location: United States. Default event retention 90 days.

14. Slack Technologies, LLC (Slack) - Purpose: Internal billing and security alerts to our own staff - Data processed: Stripe customer and subscription identifiers, invoice identifiers and invoice amounts, and the kind of billing event (for example a failed payment or a cancelled subscription); for a blocked access attempt, a hashed IP address; no message content - Transfer mechanism: Slack's standard data-processing terms - Data location: US

15. Google LLC (Firebase Cloud Messaging) - Purpose: iPhone notifications (opt-in) - Data processed: A notification token for your device and, in each notification, the matter's name and the sharer's email address; no message content. Google hands each notification to Apple's push notification service, which delivers it to the iPhone

16. GitHub, Inc. (GitHub) - Purpose: Hosting the desktop app's update files - Data processed: Your IP address and the app's version, when the desktop app checks for or downloads an update

Firebase App Check. Separately from the Firebase services listed above, we use Firebase App Check to verify that requests to our Firebase backend originate from our legitimate apps and not from forged callers. App Check is operated by Google as part of the Firebase platform, under the same Data Processing Addendum and transfer mechanism as the Firebase entries above. Data processed: the App Check token (no user PII); device-attestation metadata supplied by Apple App Attest (iOS) or reCAPTCHA Enterprise (web), depending on the platform.

Cloud Functions Inventory: Firebase Cloud Functions perform server-side processing that cannot safely occur on user devices (because it requires administrative credentials or cross-user coordination). These functions handle:

User account management (email verification, password reset, account deletion)

MFA operations (TOTP enrollment, verification, backup code management, rate limiting)

Device licensing (binding, transfer, administrative reset)

Self-service user operations (step-up authentication claims, profile updates)

Email delivery (routing transactional emails through our secure relay — no email secrets exist on user devices)

Sharing administration (creating shares, adding recipients, managing access, resolving pending invitations)

Cloud Storage operations (generating time-limited signed URLs for upload and download of encrypted files)

Recipient device lookup. When someone enters your email address to share a case with you, our service tells their app whether that address has a CustodyComms account, and gives it your devices' public encryption keys.

In-app announcements (prompt delivery and targeting)

New user onboarding (resolving pending share invitations on account creation)

Each Cloud Function receives only the data necessary for its specific task.

Email Architecture: Transactional emails (verification codes, password resets, step-up authentication codes, billing receipts) are routed through a secure chain: your app calls a Firebase Cloud Function, which validates the request and forwards it to a Cloudflare Worker, which delivers the email via SendGrid. No email service API keys or secrets exist on the desktop or iOS application.

4.2 Other Disclosures

We may disclose your information when we believe in good faith that such disclosure is necessary to:

Comply with the law or legal process — If we receive a valid subpoena, court order, or other legal demand, we will respond as the law requires. Being technically able to open a record does not by itself mean we may disclose it; where a law restricts disclosure of stored content, we disclose it only on a legal basis that law accepts. A private civil subpoena does not, by itself, authorize disclosure of communications content protected by the Stored Communications Act. For a case that stays on your device, we cannot produce message content, because we do not hold it. For a case you have shared, we hold the encrypted package and no key that opens it; a case shared from a version earlier than 2.0 is the exception described in Section 8.1, which also describes invitation keys. Another exception is a report you have sent to your phone from our website, which we can open for as long as it exists (see §10); legal process seeking that report may therefore reach its contents. If allowed by law, we will attempt to notify you of such requests so you can object or seek legal intervention. We will not do so where we determine, in our sole discretion, that notice would be likely to result in destruction of evidence, witness tampering, harm to the safety of any person, or violation of applicable law. See our Terms of Service, Section 16 for how we respond to legal process.

Enforce our Terms of Service — Only where permitted by applicable law, we may disclose information if needed to investigate or address violations of our Terms.

Protect rights, property, and safety — Only where permitted by applicable law, we may release information to protect the rights, property, or safety of CustodyComms, our users, or the public in emergency situations.

Cost Recovery: CustodyComms may seek reimbursement of reasonable costs of responding to legal process from an appropriate requesting party where permitted by law or ordered by a court. We do not charge a user's saved payment method for legal process, and we do not condition compliance with a binding order on prepayment.

What We Can and Cannot Produce: For a case that stays on your device, CustodyComms does not hold the plaintext content of your communications or case data, and cannot produce it. For a case you have shared, we hold the encrypted package in cloud storage and no key that opens it; a case shared from a version earlier than 2.0 is the exception described in Section 8.1, which also describes invitation keys. Another exception is a report you have sent to your phone from our website, which we can open for as long as it exists (see §10); legal process seeking that report may therefore reach its contents. Any other production in response to legal process will be limited to account metadata, subscription records, sharing relationship data, security and usage records, support messages, including the earlier Help Chat excerpts described in Section 7.3, any encrypted share package stored for you, and anything you uploaded to our website that we still hold.

4.3 Business Transfers

If CustodyComms is involved in a merger, acquisition, or sale of assets, your information may be transferred to the successor entity. Your personal information will remain subject to the promises made in this Privacy Policy. We will notify you of any such transfer.

4.4 Aggregated or De-Identified Data

We may share information that has been aggregated or de-identified in such a way that it cannot reasonably identify you — for example, “CustodyComms has X users in California” or “On average, users import Y messages per month.” This is not considered personal information.

5. Data Security

We take security seriously and implement multiple layers of protection appropriate to the sensitivity of the data we handle.

5.1 Encryption

Transport encryption: All communications between your device and cloud services are encrypted with HTTPS/TLS 1.2+.

MFA secrets at rest: TOTP secrets in Firestore are encrypted with AES-256-GCM using HKDF-SHA256 per-user key derivation. The decryption key is read by Cloud Functions, and the person who administers the Firebase project can reach it.

Shared files at rest: .ccm files in Cloud Storage are encrypted with AES-256-GCM using X25519 ECDH key exchange, applied on the sender's device before upload. Each device that may open a file receives its own wrapped copy of the key, and CustodyComms holds no key that decrypts them, except for cases shared from a version earlier than 2.0 (Section 8.1, which also describes invitation keys) and except a report you send to your phone from our website, which we can open for as long as it exists (Section 10).

OAuth tokens at rest: Clio integration tokens in local SQLite are encrypted with Fernet (AES-128-CBC + HMAC-SHA256).

Sensitive local credentials: Device trust credentials and encryption key material are stored in the OS keychain (Electron safeStorage on desktop, Keychain on iOS).

Backup codes: MFA recovery codes are stored in Firestore as Argon2id one-way hashes. The plaintext cannot be recovered.

Session and device trust tokens: Session tokens and device trust credentials are stored as SHA-256 one-way hashes; on your device, the tokens themselves are also stored, encrypted with your operating system’s key.

Sharing recipient lookup: Recipient records are found by an HMAC-SHA256 hash of the email address. Each recipient's email address is also stored in readable form (Section 8.2).

Manifest signing: Shared file integrity is verified with Ed25519 digital signatures.

5.2 Key Management

MFA encryption master key: stored in Firebase Secret Manager and never present on user devices. It is read by the Cloud Functions that verify codes, and the person who administers the Firebase project can reach it; we do not claim it is beyond staff reach

Per-recipient wrapped DEKs: generated using X25519 ECDH with HKDF-SHA256 key derivation, one per device

Local encryption keys: stored in the operating system’s secure keychain (Electron safeStorage on desktop, Keychain on iOS)

5.3 Authentication and Access Controls

Passwords managed by Firebase Authentication (industry-standard salted hashing — CustodyComms does not store your password)

Optional Multi-Factor Authentication (TOTP-based) with device trust for convenience

Step-up authentication required for sensitive operations (sharing, device management)

One desktop computer at a time per account

Session token rotation

Rate limiting: 5 login attempts per minute, 3 signup attempts per minute, 5 MFA verification attempts per 15 minutes

Firebase App Check on the Cloud Functions the iPhone app calls; desktop calls are protected by sign-in.

5.4 Local Data Security

Your case data is stored locally on your device and protected by your operating system’s user account controls. We strongly recommend:

Windows: Enable BitLocker (available on Windows Pro, Enterprise, and Education editions)

macOS: Enable FileVault (available in System Settings > Privacy & Security)

iOS: Ensure a strong passcode or biometric authentication (Face ID/Touch ID) is enabled — iOS devices encrypt data by default when a passcode is set

CustodyComms records a SHA-256 and a SHA-512 hash of each imported file, re-checks the SHA-256 before export, and keeps a hash-linked chain-of-custody log on your device, to help detect changes to imported records. These integrity protections are part of the evidence chain, not access controls.

5.5 Security Logging

All security-relevant events (login attempts, MFA changes, device transfers, session events) are logged to an append-only local audit trail. The trail lives in a writable local database: integrity is recorded (hashes and ordering), not guaranteed against someone with privileged access to the device. These logs include timestamps, event types, severity levels, and technical metadata (IP address, user agent, device fingerprint). The app gives you no way to delete them selectively — this is intentional to preserve evidence integrity.

5.6 Incident Response

If a security incident occurs, we will identify and contain the issue, notify affected users and authorities as required by law, and take steps to prevent recurrence. What a breach could expose depends on what you used. For a case that stayed on your device, our servers hold account metadata (emails, hashed passwords, subscription status), not message content. For a case you shared from version 2.0 or later, our servers hold the encrypted package but no key that opens it (Section 8.1 describes an emailed invitation key). For a case shared from an earlier version, they also hold a key copy our systems can unwrap (Section 8.1), so a breach of those systems could expose that shared content. The same is true of a report you send to your phone from our website, which we can open for as long as it exists (Section 10). The website demo cache and any text you sent to a cloud feature are separate, and Sections 2.7, 7 and 10 describe them.

For security concerns or vulnerability reports: security@custodycomms.com

6. Analytics and Tracking

6.1 How Analytics Work

CustodyComms uses Google Analytics 4 (GA4) via the Measurement Protocol to collect limited usage data. In the desktop application we use the Measurement Protocol (direct HTTP) rather than the Firebase Analytics SDK, because the desktop application’s architecture does not support traditional browser-based analytics cookies. The iPhone app uses Google’s Firebase Analytics SDK, and only if you opt in. Crash and error diagnostics are separate: on iPhone they are sent through Firebase Crashlytics for every user (Section 6.2).

6.2 Essential Analytics (All Users)

To operate and maintain the Service, we collect basic technical analytics that do not include your case data or message content:

App version and platform (Windows, macOS, iOS)

Session duration and basic feature usage events (e.g., “an import was completed,” “an export was generated”)

Which screens you open and which import formats you use

Error and crash information: on iPhone, via Firebase Crashlytics (device model, OS version, stack traces); on desktop, as error events in Google Analytics with a shortened, scrubbed error description. Both are designed to leave out message content and case data.

Subscription tier (free/paid)

Pseudonymous Identifiers: Essential analytics include a randomly generated client identifier (stored in your browser’s localStorage, persistent across sessions), your Firebase user ID, and, when you are signed in to the desktop app, a short one-way fingerprint of your account email: the first 16 characters of a SHA-256 hash of the address. We send the fingerprint so we can find the events that belong to one account when we look into a problem with that account. The fingerprint is not salted, so anyone who already knows your email address can compute the same fingerprint and match it to these events. None of these identifiers contains your name or your email address, but each of them can be linked to your account. Under GDPR, we process these identifiers under our legitimate interest in maintaining and improving the Service (Art. 6(1)(f)).

What Essential Analytics Are Designed to Leave Out: case names, participant names, message content, file names, file contents, communication details, or any information about your legal matters.

6.3 Detailed Analytics (Opt-In Only)

With your explicit consent, we may collect additional pseudonymous usage patterns to understand how users interact with specific features — for example, how long specific workflows take. Detailed analytics still never include message content or case details. Like essential analytics, they are tied to your pseudonymous identifiers (§6.2).

How to Opt In or Out: You can enable or disable detailed analytics at any time in Settings. Your preference is stored in the app on this computer. During account creation, you are presented with a clear choice; detailed analytics are not enabled without your affirmative action.

6.4 Offline Event Queue

If your device is offline, analytics events are queued in localStorage and sent when connectivity is restored. The queue is capped and does not contain message content or case data.

6.5 Right to Object

Under GDPR Article 21, you have the right to object to processing based on legitimate interests (including essential analytics). To exercise this right, contact privacy@custodycomms.com. The desktop app has no setting that stops essential analytics. Its Detailed Analytics switch (Settings › Privacy & Analytics) stops detailed analytics only; basic usage and error events are always sent while you use the app.

6.6 Advertising measurement on the website

We use two advertising measurement pixels, one from Meta and one from Reddit, on the pricing, signup and download pages of the website. They load only after you accept the consent banner, which covers analytics and advertising measurement together. They are not used on the demo, on articles or on learning pages, and they are not used in the desktop or iOS applications. §15.4 describes their limits, and §15.5 how to withdraw consent.

6.7 Mixpanel.

Mixpanel receives event-level analytics data from the website, the signup funnel, and the account area. For each event, we send: the event name and a small set of properties (typically a button label, a page path, or a feature identifier and timestamp); the Firebase user ID once you are signed in; a first-party device identifier we set (the cc_did cookie, described in §15.3) before sign-in; standard event metadata (event ID, app version, environment); and the request IP, forwarded server-side. We do not send your email address to Mixpanel. We do not hash your email address and send the hash to Mixpanel. We do not send the content of any custody or family-law message to Mixpanel. Signed-out visitors are identified to Mixpanel only by the cc_did device identifier. When you sign in, your pre-signup activity on this browser is linked to your Firebase user ID inside Mixpanel so we can measure end-to-end signup conversion. Mixpanel cannot, on its own, resolve this identifier to your name or email address. CustodyComms can associate the identifier with your account internally because we issued the Firebase user ID. Mixpanel sends are gated by the same consent banner that gates Google Analytics 4. Declining the banner suppresses both. Where consent is required by law, including for visitors located in the European Economic Area, the United Kingdom, and Switzerland, Mixpanel events and the cc_did identifier are used only after analytics consent is granted (see §15.3 for the cc_did cookie disclosure). Retention at Mixpanel is described in §10.

6.8 Server-side Measurement Protocol for Google Analytics 4.

In addition to the client-side gtag beacon, our Cloudflare Worker forwards a small set of conversion events directly to Google Analytics 4 using the Measurement Protocol. These server-issued events include signup completion, demo completion, contact-form submission, and checkout completion. The payload is the same shape as the client-side beacon: event name, event parameters, client identifier, user identifier (the Firebase user ID, after sign-in), and the request IP forwarded for IP override. We do not include personal-data fields beyond what the client beacon sends; in particular, the Measurement Protocol's user_data field is reserved by our codebase but not populated. The server-side send is gated by the same consent state as the client beacon; declined events are dropped at the Worker before transmit.

6.9 Cross-surface identifier linkage.

Across both Google Analytics 4 and Mixpanel, your Firebase user ID is used as the analytics user identifier after you sign in. Before sign-in, the same browser is identified by the cc_did cookie described in §15.3. At sign-in, your pre-signup activity associated with cc_did is linked to your Firebase user ID inside each analytics provider so we can measure end-to-end conversion. This identifier linkage carries only event names, event properties, and the identifiers themselves. It does not flow the content of any custody or family-law message.

We do not use advertising pixels in the desktop or iOS applications; the website's consent-gated pixels are described in §6.6 and §15.4

We do not collect Apple’s IDFA or other mobile advertising identifiers

We have disabled ad personalization signals in all analytics services

We do not build cross-site or cross-app behavioral profiles ourselves; the pixels in §15.4 are operated by Meta and Reddit under their own policies once you accept them

7. Artificial Intelligence Features

CustodyComms includes optional AI-powered features to help you analyze flagged incidents in your communications. It is important to understand how these features work and what data is involved.

7.1 Incident Detection (No AI, No Cloud)

Incident detection — the process of flagging potentially concerning groups of messages — uses pattern matching and keyword detection built into the CustodyComms application. It does not use AI and does not send your messages to external services. All incident detection processing occurs entirely on your device.

7.2 AI Analysis Options

If you choose to use AI-assisted analysis to understand a flagged incident, you have two options. Cloud AI (OpenAI) is off until you turn it on. Local AI (Ollama) is the default option and runs on your computer. AI analysis features are not currently available on the mobile (iOS) application.

Ollama (Local AI): Ollama runs AI models entirely on your device. Your message content never leaves your computer. All processing happens locally, providing maximum privacy. CustodyComms does not receive, transmit, or have access to any data processed by local AI.

OpenAI (Cloud AI): When you turn on cloud AI, the messages in the incidents you send are sent as written, with the participants' names, from your device to a Cloudflare Worker we operate. They are not redacted before they are sent. Matter Builder is a second cloud path: with cloud AI on, it can send message excerpts of up to 280 characters each, from which pattern matching removes the email addresses, phone numbers, ID and card numbers and numeric dates it recognizes, and can miss some, while names and the rest of the text remain. The Worker authenticates the request, applies rate limits, and forwards the content to OpenAI's API for processing. We do not persist the content in our databases, do not use it for advertising, and do not make it available for routine human review. Technical request metadata (timing, identifiers, error codes) may be processed for security, reliability, abuse prevention, and legal compliance. We send API requests with the store: false parameter where the OpenAI endpoint supports it; this controls application-state storage at OpenAI for supported endpoints. store: false is not the same as OpenAI Zero Data Retention. CustodyComms does not have a Zero Data Retention or Modified Abuse Monitoring contract with OpenAI. Under OpenAI's standard published API data controls, OpenAI may retain abuse-monitoring logs (which may contain customer content) for up to 30 days. OpenAI does not use API data to train its models under the standard API terms. We will update this disclosure before representing that any Zero Data Retention or Modified Abuse Monitoring control applies. You can turn cloud AI on or off at any time.

7.3 Help Chat

The Help Chat feature answers product-usage questions (“How do I import messages?” “How do I export a PDF?”) using AI. Questions are sent from your device through a Cloudflare Worker we operate to OpenAI's GPT-4o-mini model. The AI responds only from the CustodyComms help manual — it does not have access to your case data, messages, or any personal information beyond the question you type. We do not store Help Chat conversations. When the assistant on our website declines a question, we record in our support system (HubSpot) that it declined, the reason and the country your connection indicates, and, if you are not signed in, we keep a hash of your IP address in our own queue for up to about 90 days so that the same refusal is not recorded twice. We do not record the question. Until this version of the policy took effect we also saved up to the first 280 characters of a declined question there, after a filter removed the contact details it recognized; other names and details remained. We no longer save them. The excerpts saved before then are still in our support system, are not attached to an account, and have no deletion date. We make no representation about Cloudflare's own edge-log retention beyond what Cloudflare publishes in its Data Processing Addendum. The OpenAI-side retention posture is as described in §7.2 (store: false where supported; no Zero Data Retention contract; OpenAI may retain abuse-monitoring logs for up to 30 days under its standard API data controls).

7.4 No Automated Decision-Making

AI analysis, incident flags, keyword results, and the grouping, scoring and tagging of messages are not legal advice, psychological assessments, or expert opinions. They are the output of automated pattern recognition provided as organizational decision-support tools: they help you find and organize your own records. CustodyComms does not take any decision that produces legal or similarly significant effects about you or about anyone else solely by automated means. A person (you) controls any consequential use of these outputs, and every AI output is presented for your review before you act on it. Where United Kingdom law applies, the relevant test is whether there is meaningful human involvement in a decision (UK GDPR Articles 22A to 22D, inserted by the Data (Use and Access) Act 2025, in force 5 February 2026); where European Union law applies, the corresponding provision is GDPR Article 22. Under either, the outputs described here are decision-support, not solely automated decisions.

8. Encrypted Sharing

When you use the sharing feature, your case data is encrypted on your device and stays encrypted in transit and at rest. CustodyComms holds no key that opens a case shared from version 2.0 or later. Three things are different, and this section describes each: a case that an emailed invitation key can still open, a case shared from a version earlier than 2.0, and a report you send to your phone from our website, which we can open for as long as it exists (Section 10).

8.1 How Sharing Encryption Works

Key Exchange: X25519 Elliptic Curve Diffie-Hellman (ECDH) with HKDF-SHA256 key derivation

Content Encryption: AES-256-GCM (authenticated encryption)

Manifest Signing: Ed25519 digital signatures for integrity verification

Per-Recipient Key Wrapping: Each recipient receives a uniquely wrapped copy of the data encryption key (DEK).

Invitation Keys: When you invite someone whose CustodyComms is not yet set up to receive the case, and whenever you invite a recipient by email from version 1.1 or later of the iPhone app, their invitation email carries a key made for that invitation. It passes through our own servers and then our email provider on its way to them, and it stays in the email they receive. Our servers do not record it; we keep a fingerprint of it, and a copy of the case key that it unlocks. Until we remove that copy, the invitation key, the recipient's email address, that copy and the encrypted file we store together could open the version of the case that was current when the invitation was sent, and for that time we do not say we are unable to open it. We remove the copy when you revoke that person's access or delete the share. It does not expire on its own. It does not open later updates.

Cases Shared From Earlier Versions: Cases shared from a version of CustodyComms earlier than 2.0 may also carry a further copy of the key, stored with the share and wrapped under a key our own systems can derive, so for those cases we hold the technical means to open them. That copy is wrapped using HKDF-SHA256 with the share identifier and the recipient's email address. Cases shared from version 2.0 or later do not carry that copy. Updating to version 2.0 does not change a case you have already shared.

Your case data is encrypted on your device before upload. A recipient opens it with their own wrapped copy of the key. We hold no key that opens a case shared from the applications if it was shared from version 2.0 or later, and we do not read the contents of any case shared from the applications.

8.2 What Is Stored in the Cloud

Encrypted Content (Google Cloud Storage): The encrypted .ccm file. The file's contents are encrypted and cannot be read without a key. A small unencrypted header travels with it, carrying the matter's name, your user ID, when it was made, and how many messages it holds and the dates they span. Your devices and your recipients' devices hold a key. For a case shared from the applications we do not, except for cases shared from a version earlier than 2.0 (Section 8.1).

Metadata (Firebase Firestore — NOT encrypted): To manage sharing access, the following metadata is stored in Firestore:

Share identifier (UUID)

Creator email address and user ID

Recipient identifiers (HMAC-SHA256 hashed email addresses, used to find recipient records)

Recipients' email addresses, in readable form, so that invitations can be delivered and matched

The matter's name (first 50 characters)

Any note you type when sharing or updating it (up to 200 characters)

Recipient access status (pending, active, revoked) and permission levels

Wrapped encryption keys (per-recipient, per-version, per-device), and, for cases shared from a version earlier than 2.0, the further copy described in Section 8.1

Version count and timestamps

Access check timestamps

Recipient records are found by an HMAC-SHA256 hash of the email address. The share and its recipient records also hold each recipient's email address in readable form, so that invitations can be delivered and matched.

8.3 Phone-Home Access Checks

When you open a shared matter, the app checks with our servers, as your signed-in account, that you still have access. The desktop app opens it if it cannot connect; the iPhone app allows up to 7 days without a check.

8.4 Version Timeline

Shared matters support versioned updates. Each version has its own encrypted file and wrapped keys. New recipients only receive access to the latest version (no retroactive access to historical versions).

8.5 Share Deletion

Revoking one person's access, or everyone's, means they are given no key to any later update and our apps stop showing them the matter; it does not take back what they have already received. Deleting the share removes it for everyone. When a creator deletes a share, the following are removed: encrypted files from Cloud Storage (all versions), recipient records from Firestore, wrapped encryption keys, and inbox entries for all recipients. When you revoke someone's access, the CustodyComms iPhone app deletes its copy of a case shared from the applications the next time that person opens it while online. Deleting a share does not remove a copy already on a recipient's iPhone or computer. A copy on a recipient's computer stays after a revoke too, though the desktop app will not open it while it can check access. Anything a recipient has exported or printed can't be taken back.

9. Multi-Factor Authentication Data

This section provides additional detail about MFA data handling beyond what is described in Section 2.2.

9.1 Where MFA Data Is Stored

TOTP secret — Cloud: Encrypted in Firestore (AES-256-GCM). Local: Not stored in plaintext. Access: the Cloud Functions that verify codes decrypt it; the Firebase project administrator can reach the key.

Backup codes — Cloud: Argon2id hashed in Firestore. Local: the number of codes remaining only. Access: Verified only; never displayed after enrollment.

MFA enabled status — Cloud: Stored in Firestore. Local: Cached in SQLite. Access: User and Cloud Functions.

Rate limit counters — Cloud: Stored in Firestore (counted over a 15-minute window; kept until you next verify successfully). Local: Not stored. Access: Cloud Functions only.

Device trust credential — Cloud: SHA-256 hash in Firestore (the desktop app keeps the hash in its local database instead). Local: Full credential in safeStorage/Keychain. Access: User’s device only.

9.2 MFA Recovery and Permanent Lockout

If you lose access to your authenticator app, you can sign in using one of your backup codes. Using a backup code allows you to disable MFA and reconfigure it with a new authenticator. Disabling MFA removes your backup codes and signs out the device you are using and removes its trusted-device record.

If you lose both your authenticator app and all backup codes, your account is permanently locked. This is an intentional security measure given the sensitivity of custody data. There is no email-based recovery and there are no security questions. CustodyComms does not offer an administrative or support reset of MFA, and we do not restore access to an account whose owner has lost both the authenticator app and every backup code. Store your backup codes in a secure location separate from your device.

10. Data Retention

We retain personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

Account and Authentication

Account data (email, name, role) — Retained until account deletion. Deleted via cascading delete across Firebase Auth and Firestore.

Country of residence — your most recent answer and your sign-up answer are retained until account deletion; an answer in between is deleted when you correct it. Deleted from Firestore in the account-deletion cascade.

Firebase Auth tokens — Stored encrypted with your operating system's key on your device until you sign out.

Session tokens — Retained until logout, device transfer, or expiry. Deleted from database.

Security and MFA

MFA configuration — Retained until you set up MFA again or delete your account.

MFA rate limit counters — Kept until you next verify successfully, when the counter is reset.

Backup codes — Retained until regenerated, used, MFA is disabled, or account deleted. Consumed atomically on use or deleted in cascade.

Device trust credentials — Retained for 30 days. Deleted automatically on expiry or on revocation from local storage and Firestore, except on desktop, where an expired or revoked credential stops working and stays until the app's data is deleted.

Device licensing records — Current and past device identifiers are kept until account deletion. Deleted from Firestore.

Security events (local) — Retained for the life of your account and thereafter as necessary for the establishment, exercise, or defense of legal claims (including applicable limitations periods and any litigation hold), under our documented retention rationale. The app gives you no way to delete them selectively.

Chain-of-custody audit logs — Retained for the life of your account and thereafter as necessary for the establishment, exercise, or defense of legal claims (including applicable limitations periods and any litigation hold), under our documented retention rationale. The chain-of-custody ledger cannot be deleted selectively; deleting a matter removes its per-document custody records.

Billing

Payment and billing history — Retained for 7 years per tax and accounting requirements. Managed by Stripe.

Case Data and Sharing

Case data (local) — Retained as long as you choose. Deleting a matter removes it from the app, except finished court PDFs and sworn documents you choose to keep. The app's own safety copies of its database can hold a deleted matter for up to 30 days, longer if an update did not finish. Uninstalling the app does not remove your case data; to remove it, delete the CustodyComms data folder.

Shared .ccm files (Cloud Storage) — Retained until the creator deletes the share or their account. Deleted via Cloud Storage blob deletion.

Sharing metadata (Firestore) — Retained until the share is deleted. Deleted via Firestore cascade deletion.

Analytics and AI

Essential analytics — User-level and event-level data are kept for no longer than 14 months (the longest retention a standard Google Analytics property allows), then deleted by Google. Aggregated statistics in Google’s standard reports are not affected.

Detailed analytics (opt-in) — User-level and event-level data are kept for no longer than 14 months (the longest retention a standard Google Analytics property allows), then deleted by Google. Aggregated statistics in Google’s standard reports are not affected.

Mixpanel events — Retained for Mixpanel’s standard event-retention period, published as 2 years (5 years for a project created before September 1, 2025), then deleted by Mixpanel.

Sentry error events — Retained for 90 days by default. Before sending, our scrubbers remove the email addresses, sign-in tokens and cookies they recognize. Error reports and warning logs from our website and servers can still contain your account ID and the addresses of pages you opened.

HubSpot CRM records — Retained for the lifetime of the CRM record. On account deletion via the account self-service deletion route, a request to delete the HubSpot contact for the email address you are signed in with is queued as part of the deletion cascade described below; when an account is deleted any other way, the contact is kept if an account that still exists holds, or may hold, its email address, or if we cannot confirm that the contact belongs to the deleted account.

Help Chat conversations — Not stored by us. When the website assistant declines a question, the content of the record that it did (Section 7.3) is erased from our own queue about 7 days after it is sent, or after the send finally fails, and the rest of the queue entry after about 90 days. We have set no deletion date for the ticket in our support system, or for the excerpts saved before this version of the policy took effect.

AI analysis data (desktop application) — Not retained by CustodyComms. Transient processing only; not stored in our databases. The OpenAI-side posture is described in §7.2.

Website demo (/try) — extracted text and sample report — Retained for up to 24 hours, then deleted automatically, unless you send the report to your phone, in which case we keep it until you delete it. The uploaded file itself is not stored. The text extracted from it, and the report produced from it, are held in a temporary cache so the report can be reopened during that window.

Website demo (/try) — reports you send to your phone — Retained until you delete the share from your account page, or until you delete your account. When you choose to send a sample report to your phone, we keep the report and place encrypted copies where the CustodyComms applications can open the report: for you, on your devices, including devices you add later while the share is active, and for anyone you invite to it. “Save to my account” and “Share with my attorney” send the report the same way. Because our website prepares these copies, we hold a key that can open it for as long as it exists. Cases shared from the applications are encrypted on your device before upload; we do not hold a key that opens one shared from version 2.0 or later, but we do for one shared from an earlier version (Section 8.1). Deleting the share removes every copy we hold, including the copies prepared for people you invited. It does not remove a copy a recipient has already opened on their own device.

Website demo (/try) — “pick up where you left off” pointers — Retained for up to 24 hours, and deleted immediately when you choose “Clear it and start over”. These record only which cached report belongs to your browser or your account. They contain no message text, no names, and no filename. When you sign in to keep a report you ran before signing in, we also store a record that the report belongs to your account, set to expire after 24 hours, and a record of which account claimed it, set to expire after about 30 minutes. They contain no message text, no names and no filename. “Clear it and start over” does not remove them: they expire on their own.

Website demo (/try) — request audit records — Retained for 13 months. These contain counts, timings, country, the network your connection came from, error codes, the app you told us a refused file came from if you answered that question, for a scanned file the kind of document its pages were read as (for example text messages or an email) and which AI model read it, a hash of your account ID when you are signed in, which lets us link the record to your account, and, where you supplied an email address, a keyed hash of it. They never contain message text and never contain an email address in readable form.

Website demo (/try) — requests for one email when a kind of file starts working — Retained until we send the email, you ask us to delete the request, you delete your account, or 13 months after you asked, whichever comes first. A request from an account whose address is not verified is never sent, and is deleted after 13 months.

Website demo (/try) — format structure records — Retained for 13 months. These describe the SHAPE of an uploaded file so that we can support more export formats, and never its contents: the file type and size, counts and line statistics, masked line shapes with every letter and digit replaced, page layout measurements for a PDF, and for a structured export the names of the tags, fields, columns or headers it uses. Such a name is recorded only where the file itself proves it is part of the format rather than part of the conversation: a style class the file's own stylesheet declares, a field name that repeats on every record, a column name on a fixed list of known field names, or a standard mail header. Anything else is recorded only as a masked shape. The values held under those names are never recorded. They never contain message text, names, filenames, or the uploaded file itself. If the demo turns a file away in your browser before it is uploaded, your browser still sends us the file’s type and size. For a PDF that is too large to upload, your browser may also count its pages, the pages that have text, the characters of text and roughly how many pictures it holds, and send us those counts with how long the counting took. The counts are numbers only: the file’s text and its name are not sent. We keep these with the records above.

Website demo (/try) — usage counters — Retained between 25 hours and 60 days, depending on which limit they enforce, and used to apply free-tier limits and to prevent abuse. They hold counts only.

Analytics consent preference — Retained until changed. Updated in database and localStorage on user action.

Other

Error/crash logs — Diagnostic logs are kept in a log file on your device across restarts, and may include your email address.

Clio OAuth tokens — Retained until disconnected. Deleted from your device when you disconnect.

Account Deletion Cascade: When you delete your account, we delete: your Firebase Authentication record, all Firestore documents (user profile, MFA configuration, device licenses, inbox entries, prompt events), all Cloud Storage files for shares you created. We also cancel your Stripe subscription. The exceptions, which we keep, are audit records, a record of the deletion, billing records, the record of your consents, and delivery records of emails we sent you. Deleting your account does not delete analytics events already sent to Google Analytics and Mixpanel, and, where you consented to analytics, the deletion itself is recorded there as a final event under your account ID. They stay until those providers’ retention periods end. Locally stored data on your device remains; to remove it, delete the CustodyComms data folder.

Security and Audit Logs: Security events and chain-of-custody audit logs are retained for the life of your account and thereafter as necessary for the establishment, exercise, or defense of legal claims (including applicable limitations periods and any litigation hold), and the app gives you no way to delete them selectively, except that deleting a matter removes its per-document custody records. This is intentional — these logs exist to preserve evidence integrity and provide an audit trail, which is critical for the legal use cases CustodyComms supports.

Recovery copies: When we delete data from our Cloudflare databases, it can remain in their point-in-time recovery copies for up to 30 days before it is gone.

11. Your Privacy Rights

11.1 All Users

Regardless of your location, you may:

Access your personal data held by our cloud services

Correct inaccurate personal data

Delete: request deletion of your account and associated cloud data by contacting privacy@custodycomms.com; we verify and action these requests. You can also delete your account yourself from your account page on our website; the desktop app’s Delete account button opens that page. The iPhone app deletes your account from inside the app.

Export: while you can sign in, export your locally stored case data using the app’s evidence-export features (exhibits, timelines, binders and .ccm packages). On the Free Tier and Evidence Edition Lite an evidence export PDF is a marked preview that ends at page 99 (Terms of Service, Section 3). A structured export of your full account record is not yet offered; to ask for a copy of the account information we hold, email privacy@custodycomms.com.

Disconnect third-party integrations (Clio)

Disable optional features (AI analysis, detailed analytics, encrypted sharing)

Your deletion right is subject to the exceptions allowed by the law that governs your request. Not every exception below applies under every law. We may retain certain information after a deletion request to the extent reasonably necessary to: complete the transaction for which the information was collected, provide a good or service requested by you, or reasonably anticipated within the ongoing business relationship; detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity; comply with a legal obligation, including tax, accounting, audit, or record-keeping requirements; preserve the integrity of security event logs and chain-of-custody audit records described in Section 10; exercise or defend legal claims; or otherwise use information internally in a lawful manner that is compatible with the context in which it was collected. Section 10 lists the specific data categories we retain on these grounds and the retention periods we apply.

11.2 European Economic Area and United Kingdom (GDPR)

If you are in the EEA or UK, you additionally have the right to:

Restrict processing of your personal data in certain circumstances

Object to processing based on legitimate interests (including essential analytics)

Data portability — receive your data in a structured, machine-readable format

Withdraw consent for optional processing at any time without affecting prior processing

Lodge a complaint with your local data protection authority

CustodyComms, Inc. is the data controller for your personal data. Our legal bases for processing are described in Section 3 above.

11.3 California (CCPA/CPRA)

If you are a California resident, you have the right to:

Know what personal information we collect, the sources, the business purposes, and the categories of third parties we share it with

Access specific pieces of personal information we hold

Delete your personal information (with exceptions for legal obligations)

Correct inaccurate personal information

Opt-out of sale or sharing — We do not sell personal information. We use advertising measurement pixels as described in §15.4, which may constitute “sharing” for cross-context behavioral advertising as defined by the CPRA. We enable Meta's Limited Data Use flag, which instructs Meta to process California residents' data in a restricted mode, and we let Meta determine the visitor's location rather than inferring it ourselves. The pixels also load only where analytics consent has been granted, so declining or withdrawing consent stops them entirely. You may also exercise this right at any time using the Cookie settings link in the footer, or by contacting privacy@custodycomms.com.

Limit use of sensitive personal information — We do not use sensitive personal information for purposes beyond what is necessary to provide the Service

Non-discrimination — We will not treat you differently for exercising your privacy rights

You may designate an authorized agent to submit requests on your behalf. We may require proof of authorization and verify your identity.

11.4 Other U.S. State Privacy Laws

CustodyComms respects the privacy rights granted by state privacy laws across the United States, including but not limited to the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Utah Consumer Privacy Act (UCPA), Texas Data Privacy and Security Act (TDPSA), Oregon Consumer Privacy Act (OCPA), Montana Consumer Data Privacy Act, Iowa Consumer Data Protection Act, Indiana Consumer Data Protection Act, Kentucky Consumer Data Protection Act, Rhode Island Data Transparency and Privacy Protection Act, Tennessee Information Protection Act, and other state privacy laws as enacted.

If you reside in any of these states, you generally have the right to access, correct, delete, and obtain a copy of your personal data, as well as to opt out of targeted advertising, sale of personal data (which we do not do), and profiling in furtherance of decisions that produce legal or similarly significant effects (we make no such decisions). We use advertising measurement pixels as described in §15.4; declining or withdrawing analytics consent prevents them from loading. If we deny a request, you may appeal by contacting us.

Washington — If Washington’s My Health My Data Act applies to health information about you that reaches us, including when another person brought it to CustodyComms, our Consumer Health Data Privacy Policy at custodycomms.com/legal/consumer-health-data says what we collect, why, who receives it and how to make a request. You do not need an account to make one.

11.5 Canada, Australia and New Zealand

CustodyComms is offered only in the United States and its territories (Puerto Rico, Guam, the U.S. Virgin Islands, American Samoa and the Northern Mariana Islands), in Canada except Quebec, in Australia and in New Zealand.

If you live in Canada, Australia or New Zealand, this section applies to you along with the rest of this policy.

Australia. Where the Privacy Act 1988 (Cth) applies to us, the Australian Privacy Principles in that Act apply to how we handle the personal information of people in Australia.

New Zealand. The Privacy Act 2020 and its Information Privacy Principles apply to how we handle the personal information of people in New Zealand.

Where your information goes. Your account information is stored and processed in the United States, by us and by the service providers listed in Section 4.1. Information held in the United States can be subject to United States law, including requests from courts and authorities there.

If you use Help Chat or the demo on our website, or turn on cloud AI for incident analysis or Matter Builder, the text you send passes through our own server to OpenAI in the United States. We rely on our contract with OpenAI to protect it. OpenAI does not use it to train its models. We ask OpenAI not to store it; OpenAI may still keep it for up to 30 days to detect abuse, or longer if the law requires. We remain responsible for your information while OpenAI handles it for us.

Your rights. You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Your case files are kept on your computer, and you can export them from the app. To get a copy of the account information we hold, email privacy@custodycomms.com. You can close your account on our website. We will reply within 30 days if you live in Canada or Australia, and within 20 working days if you live in New Zealand. If we need longer, we will tell you within that time why, and when you can expect our reply.

Places we no longer serve. If you used CustodyComms from a place where it is no longer offered, including Quebec, you keep the rights described above. Email privacy@custodycomms.com and we will answer within 30 days.

Who is responsible. Our Privacy Officer is accountable for how CustodyComms handles personal information. Contact: Privacy Officer, CustodyComms, privacy@custodycomms.com.

Complaints. If you are not satisfied with our reply, you can complain to the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner, or New Zealand's Office of the Privacy Commissioner.

11.6 Exercising Your Rights

To exercise any of these rights, contact us at:

Email: privacy@custodycomms.com

Response time: Within 30 days, or within 20 working days if you live in New Zealand (or sooner where the law requires).

We may verify your identity before processing requests — for example, by asking you to confirm from the email address associated with your account. You do not need an account to make a request, and we will not ask you to create one: if you do not have one, write to the address above and we will ask only for what we reasonably need to confirm who you are and to look for anything we hold about you. We will not charge a fee for reasonable requests.

12. International Data Transfers

CustodyComms is based in the United States, and our cloud infrastructure is primarily located in the US. If you use our Service from outside the US, your account and authentication data will be transferred to, stored, and processed in the United States.

12.1 Transfer Mechanisms

Where EU or UK data protection law applies to a transfer, the following apply. For Canada, Australia and New Zealand see Section 11.5.

EU-US Data Privacy Framework (DPF): Several of our sub-processors (Google/Firebase, Stripe, Twilio/SendGrid, Cloudflare) are certified under the EU-US Data Privacy Framework. OpenAI is not DPF-certified; OpenAI’s Data Processing Addendum, part of its services agreement, incorporates the Standard Contractual Clauses for personal data subject to EEA, Swiss or UK law.

Standard Contractual Clauses (SCCs): As a supplementary measure, several of these providers’ data-processing terms incorporate the European Commission’s 2021 Standard Contractual Clauses.

UK International Data Transfer Agreement (IDTA): For UK users, where applicable.

12.2 Cloudflare Edge Processing

Cloudflare Workers execute at the nearest edge location to the user. This means transient data (such as email relay requests or AI proxy requests) may be processed at an edge location outside your jurisdiction during transit. Cloudflare processes this data under its applicable Data Processing Addendum and service-specific retention practices; we do not persist desktop cloud AI prompt or Help Chat content in our own application databases, but Cloudflare may process technical logs or metadata as described in its applicable terms.

12.3 Data Residency

Firebase Authentication data is processed in the United States: Google runs that service only from US data centers and offers no choice of region. Our Cloud Functions run in the us-central1 (Iowa, USA) region and our Firestore database is located in the United States. Cloud Storage uses US multi-region. We do not currently offer EU-specific data residency.

12.4 Our Commitment

Regardless of where your data is processed, we handle it under the principles outlined in this Privacy Policy. We do not sell personal information, and we take no decision about anyone solely by automated means that has legal or similarly significant effects (Section 7.4).

12.5 Regional access restrictions

The try-the-product demo at /try is offered only in the countries listed in Section 11.5. It is not offered anywhere else, including the European Union, the European Economic Area, the United Kingdom and Switzerland, and it is not offered to traffic Cloudflare cannot place, including Tor. We decide this from the country, and in Canada the province, that your connection indicates; a visitor in Canada whose province cannot be determined is not refused. Visitors whose connection indicates a place outside those countries are told so before they are asked for a file, and no analysis is performed for them.

The same restriction applies to the AI assistants on the Learn and Help pages, because a question put to either is sent to the same provider for the same kind of processing. The Learn and Help articles themselves remain readable everywhere.

Creating an account on our website or in the desktop app, cloud AI, Help Chat and sharing are offered only in the countries listed in Section 11.5. The desktop download, the account area and the rest of this website are not blocked by location.

13. Children’s Privacy

CustodyComms is intended for users who are 18 years of age or older. We do not invite anyone under 18 to create an account or to send us information. This is about who uses CustodyComms, not whose information appears in it: the records an adult brings ordinarily contain information about children. If you are under 18, you may not create an account or use CustodyComms. If we learn that we have collected information from a user under 18, we will delete that account and associated data promptly.

Content About Minors: We acknowledge that case data in a custody application inherently involves information about children — names, schedules, communications about their wellbeing. In the desktop and mobile applications this data is stored locally on your device and is not transmitted to CustodyComms servers in unencrypted form, unless you turn on cloud AI, as described below. The try-the-product demo on our website is the exception: a conversation export uploaded there ordinarily contains information about children, that text (or the file itself, when it is a scanned or screenshot PDF whose text cannot be read directly) is transmitted to our servers and to OpenAI to produce the sample analysis, and we hold it for up to 24 hours as described in §10, unless you send the report to your phone, in which case we keep it until you delete it (also §10). The demo asks you to confirm you understand this before the conversation you upload or paste is sent to us. A case shared via the encrypted sharing feature is encrypted on your device before upload; we do not hold a key that opens a shared case, except for cases shared from a version earlier than 2.0 and except a report you send to your phone from our website, which we can open for as long as it exists (Section 10), and we do not read the contents of cases shared from the applications (see Section 8). If you turn on cloud AI for an incident whose messages mention children, those messages are sent as written, with the children's names and every other name in them, through a Cloudflare Worker we operate to OpenAI for processing under OpenAI's standard published API data controls (see §7.2 for the full retention statement; in summary: store: false where supported, no Zero Data Retention contract, and OpenAI may retain abuse-monitoring logs for up to 30 days).

The Service includes redaction features for protecting children’s names and identifying information in evidence exports.

14. Attorney-Client Privilege and Confidentiality

Given CustodyComms’ use in legal contexts, we want to explicitly address how using our Service interacts with attorney-client privilege:

Minimization of Third-Party Access: CustodyComms is designed to minimize third-party access to your imported case content. Imported case content remains local to your device unless you choose a feature that requires cloud processing — for example, encrypted sharing, cloud AI, Help Chat, a support submission, or a user-directed integration. For features that do require cloud processing, the relevant data flow is described in Sections 2.5, 4, 7, and 8. Whether the use of any technology service affects attorney-client privilege, work-product protection, confidentiality obligations, or evidentiary strategy depends on the facts of your matter and the law that applies to it. You and your attorney are responsible for deciding whether to use optional cloud features with privileged or confidential content. CustodyComms does not provide legal advice on privilege questions.

Preservation of Privilege: CustodyComms is designed to support confidentiality by minimizing CustodyComms' access to imported case content and, where encrypted sharing is used, by encrypting shared case data on your device before it is uploaded. We do not read the contents of cases shared from the applications. We hold no key that opens a case shared from version 2.0 or later (Section 8.1 describes an emailed invitation key), except a report you send to your phone from our website, which we can open for as long as it exists (Section 10); a case shared from an earlier version is one we are technically able to open (Section 8.1). However, attorney-client privilege, work-product protection, and related confidentiality protections are legal determinations that depend on the facts of your matter, the law that applies to it, and how you and your attorney use the Service. CustodyComms does not determine whether privilege applies and does not guarantee that use of the Service will preserve or waive any privilege or protection.

Encrypted Sharing: When cases are shared between users (e.g., client to attorney), the data is encrypted on the sender's device before upload. CustodyComms does not hold a key that opens a shared case, except for cases shared from a version earlier than 2.0 (Section 8.1, which also describes invitation keys) and except a report you send to your phone from our website, which we can open for as long as it exists (Section 10). If your professional obligations require that no provider be able to access client material, do not use the sharing feature for that material.

Legal Demands: If CustodyComms received a subpoena for communications that stayed on your device, we would be unable to produce them, because we do not hold them. A case you have shared is different only in part: we hold the encrypted package but no key that opens it; a case shared from a version earlier than 2.0 is the exception described in Section 8.1, which also describes invitation keys, and so is a report you send to your phone from our website, which we can open for as long as it exists (Section 10). See Section 4.2 for details on our response to legal process.

Your Responsibility: You and your attorney remain responsible for maintaining the confidentiality of your device, credentials, and any exported materials. CustodyComms cannot protect against unauthorized physical access to your device.

For more detail on privilege considerations, see our Terms of Service, Section 7.

15. Cookies, Tracking, and Local Storage

15.1 Desktop Application

The CustodyComms desktop application does not use cookies. It uses localStorage (browser-equivalent storage within the Electron framework) for:

Analytics client ID (random pseudonymous identifier, persistent across sessions)

Analytics consent preference

Analytics event queue (offline caching, capped)

UI preferences (theme, layout settings)

The certifier details you save for evidence exports

The user ID of the last account signed in on this computer

15.2 iOS Application

The CustodyComms iOS application does not use cookies. It uses:

iOS Keychain for sensitive credentials (device trust, encryption keys)

UserDefaults for non-sensitive preferences

15.3 Website

Our website (custodycomms.com) may use:

Essential cookies — Required for website functionality: they keep you signed in. They include cc_own, a random identifier the demo sets for up to 35 minutes when you run it without being signed in, so that the report can be saved to your account if you then sign in on the same browser.

Analytics cookies — To understand website usage (with consent where required by law)

cc_did — first-party cookie set by our Cloudflare Worker via a Set-Cookie response header, not by JavaScript. HttpOnly, SameSite=Lax, Secure. Expiry up to 400 days. Purpose: pseudonymous analytics attribution that lets us understand how the same browser moves through the website, signup funnel, and account area. The demo also uses it to recognise a report you ran on this browser, so that you can pick up where you left off (Section 10). Where consent is required by law, including for visitors in the European Economic Area, the United Kingdom, and Switzerland, we set and use this cookie only after analytics consent is granted. If analytics consent is declined or withdrawn, we do not use cc_did for Mixpanel or Google Analytics attribution and do not forward analytics events associated with that identifier. cc_did is not used to collect custody-message content, family-law message content, or advertising identifiers.

15.4 Advertising measurement, and what we do not use

We use two advertising measurement pixels, one from Reddit and one from Meta, to measure whether an advertisement led someone to our pricing, signup or download pages, or to create an account. We describe them specifically rather than in general terms, and they are subject to the limits below.

They load only after you grant analytics consent. Unlike most implementations, we do not load the script and then signal your preference to the advertising network — if consent is not granted, the script is never placed on the page at all.

They are started only on these commercial pages: pricing, signup, and download. They are never started on the demo, where a person brings a file about their family, and we send neither network anything from it. If one was started on an earlier page, the demo is loaded afresh without it. They are never started on our articles, guides, or learning resources, because the address of an article can itself disclose what a reader is dealing with, and that is not something we hand to an advertising network.

We do not send your email address or telephone number to either network. Meta's automatic advanced matching, which collects contact details from forms present on the page, is explicitly disabled in our implementation.

We also record advertising click identifiers (such as Google's gclid and Meta's fbclid) from the web address you arrive on, so that a signup can be attributed to the advertisement that produced it. These identifiers are treated as advertising data, are subject to the same consent gate, and expire.

We do not collect Apple's IDFA or other mobile advertising identifiers.

We do not use custody-message content, family-law message content, or case content for advertising, profiling, or marketing.

We do not honor the Do Not Track (DNT) browser signal; where legally required, we honor applicable opt-out preference signals.

15.5 Consent Mode v2.

We use Google Consent Mode v2 to communicate your consent state to our analytics providers. For visitors located in the European Economic Area, the United Kingdom, or Switzerland, all four Consent Mode signals — ad_storage, analytics_storage, ad_user_data, and ad_personalization — start denied by default. The same banner choice that flips analytics_storage to granted gates Google Analytics 4 client-side, the server-side Measurement Protocol send described in §6.8, and Mixpanel. Our advertising measurement pixels are gated on the same banner choice and are not loaded unless analytics consent is granted. We do not set ad_user_data or ad_personalization to granted, and we do not use these pixels to build advertising profiles or to target you elsewhere on the internet. Geographic detection uses the country code supplied by Cloudflare on the request edge. For this consent decision the country value is read at request time and is not written to a cookie or an analytics property. We do keep the country Cloudflare reports in some other records, including the demo's request audit records (Section 10), requests for a download link (Section 2.6) and, at website sign-up, beside the country you declare (Section 2.1). You can withdraw consent at any time using the Cookie settings link in the footer.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons.

Material Changes: For material changes (such as collecting new categories of data, adding sub-processors, or changing how we use existing data), we will provide notice through a blocking in-app modal that requires your re-acceptance before you can continue using the Service. We will also send an email notification.

Non-Material Changes: For non-material changes (such as clarifying wording or updating formatting), we will update the “Effective Date” at the top of this page and may provide notice through the app or website.

Version Tracking: Each user’s accepted Privacy Policy version is recorded in our database. When we publish a material update, existing users will be prompted to review and accept the updated policy on their next login.

Your continued use of CustodyComms after updated terms become effective constitutes your acceptance of the changes, except where we ask you to accept them. If you do not agree with a change, you should discontinue use and may request deletion of your data.

17. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information:

Privacy inquiries: privacy@custodycomms.com

Security issues: security@custodycomms.com

General support: support@custodycomms.com

EU/UK privacy inquiries: privacy@custodycomms.com (subject line: “EU/UK Privacy Inquiry”)

Mailing address:

CustodyComms, Inc.
Attn: Privacy Officer
131 Continental Dr., Suite 305
Newark, DE 19713
USA

We will respond to inquiries as promptly as possible, typically within 30 days. If you are contacting to exercise a specific right, please provide enough information for us to verify your identity and locate your data (such as the email you registered with and what action you are requesting).

For EEA/UK users, if you are unsatisfied with our response, you may lodge a complaint with your local data protection authority. We prefer that you contact us first so we can resolve it directly.