On your computer, your messages stay there. In your browser, we tell you exactly what leaves.
CustodyComms runs in three places, and each one answers the question differently. The desktop app keeps everything on your computer. Message Review and the Message Checker run in your browser, so what you give them has to come to us, and the table below says what leaves, where it goes, and when it is deleted. The iPhone app reads what you send it.
Where your messages go
Three places, three answers. The same three words mark every part of the product across this site, so you always know which answer applies.
| Place | What runs there | What leaves |
|---|---|---|
| On your computer | What runs there The desktop app: import, the timeline, the Incident Finder, and the export to evidence. | What leaves Nothing, unless you export and share it, or choose Cloud AI for one incident. That incident’s messages then go to OpenAI as written, names included. |
| In your browser | What runs there Message Review: the Incident Finder on the export you upload, and Cloud AI writes the incidents up. The Message Checker: one message you paste, the same categories plus an AI second opinion. | What leaves Your upload comes to us and is deleted within 24 hours unless you send it to your phone; its text goes to OpenAI to be written up. The message you paste into the checker is read and not stored. |
| On your phone | What runs there The free iPhone app opens a report you sent yourself or one shared with you. Offline, and read-only. | What leaves An encrypted copy travels to the phone. We also hold a wrapped copy of its key so a recipient can open it on a new device, which means we have the technical means to open a shared report. The Privacy Policy says so, in section 8. |
Privacy isn’t a setting. It’s the architecture.
Local-first by default
Message content is imported, processed, and indexed on your device. Detection runs on your CPU. No server copy is stored. Cloud AI is opt-in per incident.
Explicit export, never automatic
Shares are actions you take. Each export lists exactly what it contains: messages, dates, hashes, the person who ran it.
Cryptographic chain of custody
SHA-256 hashes computed on import. Every review action (edits, redactions, exports) writes an entry to a tamper-evident log.
Documented authentication path
Exports include an FRE 902(14)-structured certification template. A qualified person signs; the chain of custody supports that signature.
Your account, your control
The free tier needs no card. Subscriptions run through Stripe. Delete your account from your profile at any time.
No tracking of message content
Site analytics record visits and actions such as sign-ups. They never include message content or conversation text.
Four stages. One computer.
Import
From iMessage, Android, Gmail, Outlook, WhatsApp, OFW, AppClose, Messenger, coParenter, or iMazing. SHA-256 computed on every file at the moment it’s read.
Organize
Conversations group by contact. Messages tagged with source app and original timestamp. Everything indexed locally for search.
Analyze
Incident detection runs on your CPU; nothing leaves your machine for it. AI writeups are Cloud AI, an opt-in per-incident upgrade on paid plans: that incident’s messages are sent as written, names included, through our Cloudflare Worker, which does not log or store them, to OpenAI with store: false.
Export
Explicit action. You pick the conversations, date range, and format. The app generates a PDF plus SHA-256 manifest and a certification template.
What CustodyComms defends, and what it doesn’t.
Being honest about limits is part of why attorneys trust the exports.
Defends against
- Claims that messages were modified after collection
- Disputes about original timestamps
- Questions about what was included or excluded
- Long-term server-side breach of your message content (no server copy is stored)
Does not defend against
- Fabrication before import: a fake text sent to your phone is still a fake text
- Device compromise: if your computer is compromised, the evidence on it is too
- Authentication: a qualified signer answers that question. We support the process, we don’t replace it
- Legal strategy: this is a tool for attorneys, not a substitute for them
When you opt in, here is exactly what happens.
Incident detection is local, and your messages never leave your machine for it. Cloud AI is an opt-in, per-incident upgrade on paid plans for the written summaries. When you choose it, the chain is four hops and we describe each one.
- Hop 01
On your device
Nothing is sent for a summary until you turn Cloud AI on for that incident. When you do, the messages in that incident are sent as written, with the names of the people in the conversation. They are not redacted: the written summary depends on who said what, and when.
- Hop 02
Through CustodyComms
Those messages and your sign-in token transit our Cloudflare Worker for rate-limiting and abuse prevention. The Worker does not log prompt contents and does not store the analysis. We do see the messages in flight.
- Hop 03
At OpenAI (gpt-4o-mini)
Called with store: false, which disables application-state storage at OpenAI. That is not Zero Data Retention, and we do not claim it is: under OpenAI’s standard API data controls, abuse-monitoring logs that may contain request content are retained for up to 30 days. Per OpenAI’s API terms, API traffic is not used for model training.
- Hop 04
Back on your device
The analysis result is written to your local database alongside a SHA-256 hash of the message text that was sent, so a reviewer can check what the model was given.
What we see, what we never see, what we never store
- What we can see
- The messages in the incident you sent, in flight at the Worker only. We also keep counts for your account, such as tokens used, so the daily limits work.
- What we never see
- Anything you do not choose to send. A Cloud AI summary works on the incident you pick, not on your whole archive.
- What we never store
- The prompt or the response. The Worker logs that a request happened, never what it said.
- Sub-processor
- OpenAI (gpt-4o-mini), called with store: false. No model training under the standard API terms. Abuse-monitoring logs retained by OpenAI for up to 30 days; we hold no Zero Data Retention agreement.
What we actually store.
- Your account
- Your name, email address, role, state and subscription status, plus the sign-in and device records that keep your account secure. Billing runs through Stripe, and we never see your card number.
- Your messages
- In the desktop app, by default: not uploaded, not seen, not logged. That changes only when you choose it. Turning on Cloud AI for an incident sends that incident’s messages, as written, through our server to OpenAI. Sharing a case uploads an encrypted copy. The free online demo is different: it works on a file you upload to us. We read it to build your report and do not keep the file. The report is deleted within 24 hours unless you send it to your phone, in which case we keep it until you delete it.
- Site analytics
- Google Analytics and Mixpanel record visits and actions such as sign-ups, linked to your account once you sign in. Advertising measurement from Meta and Reddit loads only if you accept the consent banner. None of it includes message text or anything from a conversation.
- Deletion
- Delete your account from your profile at any time, without emailing us. Deleting the account does not remove the files on your computer. Those stay until you remove them.
