Privacy Policy

7.1 Your cases stay until you remove them, or the account goes

We don't put an expiry date on your records. A case stays for as long as the account it lives in stays.

An account ends only through going unused. A free account that hasn't been signed into or used for 12 months is closed, and its records are deleted. We email you 30 days and 7 days before, with a link to take everything out. Signing in keeps it open. An account with a paid case is never closed for going unused. If either email cannot be sent, nothing is closed. The full wording is in section 6 of the Terms, and it means the same thing there as it does here.

7.2 What we actually remove

When an account is deleted, the records go and the files you uploaded go with them, out of storage. It isn't a flag on a row that hides things from you while we keep them.

Before any of that, you can take everything out — free, at any time. The files come out as they reached us, with one exception: a JPEG photograph's location data is removed — on your device for a photo you add yourself, and by us as soon as an emailed one arrives, before it is fingerprinted and kept. A HEIC photo is kept exactly as it arrived, and the app marks it as not checked for location.

7.3 When you delete a case yourself

It goes when you press the button. There is no waiting period and no recycle bin. The copies that outlive the button are the backups §7.4 describes.

The files go out of storage first, then the records that point to them — that order, because doing it the other way would strand your files somewhere nothing could ever reach them again. Afterwards we look in the storage again and check that what should be gone is gone, rather than taking the first answer on trust.

Closing a case is a different thing entirely, and it removes nothing. A closed case is simply one you've finished with. There's no clock on it.

7.4 Backups, and how long a deleted thing stays in one

Every day a job we run on GitHub copies the records and the files and sends the copy to Cloudflare, in the United States. It is encrypted on the machine that makes it, before it is sent, and Cloudflare cannot read it. The key that opens it is not on the machine that makes the backup and not with the company that stores it.

After you delete something, it can remain in those encrypted backups for up to seven days. Each day the job runs, it deletes the backups older than seven days.

Separately, Supabase keeps its own backups of the database, on its own schedule. We cannot search those, and we cannot delete from them.

7.5 Who else handles your information

Running BuildMyEvidence means using a small number of other companies. These are all of them, and what each one holds:

Supabase

The database and the file storage. Your cases and the files you upload physically sit here.

Vercel

Serves the site and the app to your browser. Handles the request, not the contents of your case.

Cloudflare

Sits in front of the site, filtering traffic and blocking abuse, and holds the encrypted backups.

Stripe

Takes payments for case file downloads. Your card details go to Stripe and never reach BuildMyEvidence. Stripe never sees what the case is about.

GitHub

Runs the daily backup job. The job reads your records and files onto a GitHub machine and encrypts them there before they are sent to Cloudflare.

Resend

Sends the emails we have to send you — including the notices described in section 6 of the Terms. Resend receives your email address and the wording of the message. It never receives anything from inside a case, and we don't use it to send you anything you didn't ask for.

Sentry

Tells us when a page breaks. It receives the type of error, where it happened in our code and the page address. It never receives anything from inside a case, your email address or anything you typed, and it is set not to store your IP address.

Those are the only companies that hold or handle anything from your account. We don't sell your information, we don't use it for advertising, and nothing in your case is used to train anything. We count visits to our public pages, like the home page and guides, with Vercel Web Analytics. It uses no cookies and doesn't identify you. There is no third-party analytics or tracking inside the app: nothing in your account or your cases is ever sent to an analytics service. We count, anonymously, how many cases reach each step (started, first entry, price shown, paid) and which link they came from, as a short tag such as "reddit". Nothing you type is part of it, and the count holds no account or case details.

Nothing in your case is sent to any AI service. Not by us, and not in the background. If you choose to take your own record to an AI yourself, that is you doing it, in your own account with that company.

7.6 Recordings

If you record audio into a case, the recording is a file like any other file. It is stored, and it is not transcribed. No audio is sent anywhere to be turned into text.