Privacy Policy

What We Store

You can complete the Rights Check without creating a permanent account. When you continue without an account, your situation records stay in that browser. When you create an account, we store the information needed to operate it and restore its encrypted workspace, including:

• Your email address, sign-in provider, and account identifiers
• Encrypted situation, timeline, journal, document, and evidence records
• Encrypted evidence-file bytes when backup completes
• For agreed cloud-extraction batches, encrypted text results and limited processing-status metadata
• Sync, security, quota, and deletion metadata needed to operate and protect the service

We do not sell your information, provide it to your employer, or send your narrative or evidence contents to advertising analytics.

Local Storage

Data you enter is stored in this browser’s localStorage or IndexedDB. Automatic cloud file backup currently supports encrypted files up to 4,000,000 bytes; larger files remain on this device and should be included in a full backup export. Clearing browser data can permanently delete the local copy. Creating an account enables encrypted cloud sync; it is not a separate opt-in toggle. Downloaded exports are readable copies and should be stored somewhere only you control.

Encryption & Sync

Your working copy is encrypted in the browser, and synced records and evidence files are stored remotely as ciphertext. Each account has a unique data key stored on our servers only in wrapped form. Our service manages the wrapping key and can unlock account data for authenticated recovery and agreed processing; this is not end-to-end encryption that hides content from the service. For accounts, the browser holds the unlock key only for the current tab session and re-requests it from our servers when you return, so a signed-out browser keeps only unreadable ciphertext. Anonymous sessions have no server copy, so this browser keeps their key to reopen their notes; use Erase Data on a shared computer. Encryption at rest does not protect an already-open browser from someone who can use that device. For technical detail, see our Methodology page.

Evidence Text Extraction

For signed-in accounts, evidence files that need OCR or document parsing are processed on our application server only after the account holder agrees for that batch. After each encrypted original finishes uploading, a trusted application step unwraps the account key and decrypts one file at a time in memory. Only that plaintext document is passed into an isolated, no-network temporary extraction workspace. The extracted text returns to the trusted step and is encrypted for the same vault; that temporary workspace is stopped after processing. If stopping fails, the result is withheld; the workspace has a five-minute lifetime limit. This is not a claim of immediate erasure from provider infrastructure. The original and result remain encrypted when stored. If the account holder cancels, the originals stay saved but extraction does not start.

Server extraction is document processing, not AI analysis. We do not send those originals or extracted results to an AI provider as part of extraction. Once a batch is durably queued, processing can continue after the browser closes. Result ciphertext is removed after the browser confirms a successful import; limited job-status and consent metadata may remain until the workspace or account is deleted. Signed-in accounts do not fall back to browser-local extraction automatically; after a server extraction attempt fails permanently, the account holder can explicitly run supported extraction locally in that browser, and that local run never sends the file’s contents to our servers. DOCX and HTML backup files also offer an explicit browser-only text reader without a server extraction attempt; their encrypted originals remain in the account’s evidence storage. Anonymous sessions are separate: supported text extraction stays in that browser and runs only while its Evidence page is open.

Optional Account Features

Account creation is optional for the Rights Check. Returning users must use the same sign-in method to reach the same encrypted workspace. We do not automatically merge Google, Microsoft, and email-link identities merely because their email text matches.

AI-Powered Document Analysis (Opt-In)

AI-powered features run only when you choose an AI action such as analyzing a story or document. The request may send the following data to Anthropic for processing:

• Your narrative description
• Text extracted from your uploaded documents
• File names and dates associated with your evidence

The data is processed to return the requested organization, drafting, or analysis. Provider handling and retention are governed by our API arrangement and the provider’s applicable terms. You can use the Rights Check and local documentation tools without invoking an AI action.

Analytics

We use Google Analytics on public information and directory pages when you are signed out to understand traffic and navigation trends. It uses analytics cookies; advertising signals and automatic form and search tracking are disabled. The browser tag does not load for signed-in users, rights assessments, AI conversations, or private case workspaces. Page URLs omit query strings and fragments, and attorney search events report the search mode, not your search text. Vercel Speed Insights measures page-load performance on public pages only; it is not loaded on private workspace routes, and events for those URLs are dropped before they leave the browser. Server-side conversion events (sign-up, story analyzed, AI tool completed) carry a pseudonymous session id and a signed-in flag, never your account identifier. We also retain operational server records and aggregate service metrics to maintain reliability and understand usage. Search Console reports aggregate search reach. We do not send private narratives, evidence contents, journal text, or account identifiers to advertising analytics.

Legal Requests and Privilege

We may be required to disclose account data in response to a valid subpoena, court order, or other legal process. Because our service holds the account key, we can be compelled to produce synced content. Records you keep here are not automatically protected by attorney-client privilege and may be requested in litigation. Ask an attorney how to handle sensitive notes.

Third-Party Services

Workers’ Rights does not sell your data or share it for cross-context behavioral advertising. We use the following service providers to operate the platform:

• Anthropic — AI document analysis (opt-in only, as described above)
• Google Maps / Places — attorney directory search (your search location is sent to Google)
• Vercel — hosting, deployment, and agreed secure evidence-processing workflows
• Supabase — encrypted cloud sync and evidence-file backup for account holders
• Google / Resend — sign-in and email-link delivery

Links to external resources (such as EEOC.gov, state agency websites, or attorney directory sites) are governed by those sites’ own privacy policies.

Data Portability

You can export your data using the built-in export features. The export is a readable copy that you control and should store securely. Service-provider retention and the deletion limits described below still apply.

Device Erasure and Account Deletion

• Erase This Device signs you out and removes Workers’ Rights data from the current browser. It does not delete cloud copies or cached copies on another device.
• Delete My Account currently performs permanent account deletion; there is no 14-day recovery window. It removes access to live application records and encrypted files, and the wrapped account key before confirming success.
• Encrypted files with an active upload link remain inaccessible until that link expires, then enter an hourly cleanup queue. Upload links normally expire after two hours; cleanup includes a five-minute safety period and can take longer during a backlog or provider failure. We retain only the capacity and deletion metadata needed to complete that cleanup. We retain a minimal account-deletion tombstone so an old browser session cannot recreate deleted cloud data. Service providers may retain limited security or backup records for their required retention periods.

Remote deletion cannot erase a local copy already cached on another device or browser profile. Erase each device separately. On the current device, close other Workers’ Rights tabs so the browser can confirm IndexedDB deletion.

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated “Last updated” date.