DRAFT — not legal advice — requires review by a licensed attorney before use.

Prepared 2026-10-18 from the Case Commander codebase (branch ui-overhaul). Bracketed items are placeholders. Notes marked [COUNSEL] are questions for the attorney and must be removed before publication. Do not publish this until counsel approves it and the hosting provider is chosen.

Case Commander Privacy Policy

Effective date: [EFFECTIVE DATE] Last updated: [LAST UPDATED DATE]

This Privacy Policy explains how [COMPANY LEGAL NAME], a [ENTITY TYPE] organized under the laws of [STATE OF FORMATION] ("Case Commander," "we," "us"), collects, uses, and shares information when you use the Case Commander website and app (the "Service").

Case Commander is an AI study tool for law students. We built it to teach you, not to do your coursework for you. Our approach to data follows from that: we collect what we need to teach you and to keep the Service running, and we do not sell your information.

1. Summary

• What we collect: your account details (name, email, password stored as a one-way hash), the study materials you upload, your study sessions and results, and basic technical logs.
• Why: to run your study sessions, generate your topic maps and scores, keep the Service secure, and improve it.
• AI providers: to generate responses, we send your text and uploaded materials to our AI provider, Anthropic. If optional premium voice is turned on, we also use OpenAI. If you use the default voice mode in Chrome, Google processes your audio under Chrome's own policy.
• No ads and no third-party tracking: we set one first-party session cookie. We do not use advertising or third-party analytics cookies.
• No sale: we do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising.
• Your choices: you can delete topics and uploaded sources inside the app, download a copy of all your data, and delete your account (Settings → Your data). You can also ask us at [CONTACT EMAIL].

2. Information we collect

2.1 Information you give us

2.2 Information we generate about your studying

From your activity, the Service generates:

• AI-generated content, such as topic maps, explanations, questions, and evaluations of your answers.
• Scores and mastery data, including your "Commanding Score" and per-topic mastery estimates. These are learning signals built for study. They are not grades, and we do not share them with your school. (See Section 7.)

2.3 Information collected automatically

• Session cookie. When you sign in, we set one first-party, httpOnly session cookie that keeps you signed in. We use no advertising cookies, no third-party analytics cookies, and no cross-site tracking.
• Browser local storage. The app saves some interface preferences, such as voice settings, in your browser's local storage. That data stays on your device, and we do not receive it unless it is part of a request you make.
• Error logs. If something breaks, we may record the error message, technical stack trace, and the page path where it happened. [COUNSEL: confirm whether IP address or user ID is attached to error logs once hosting is chosen; the hosting provider may log IP addresses by default.]
• AI usage logs. For each AI request we record operational metrics: tokens used, cost, and response time (latency). These logs do not contain the content of your conversations.
• Server logs. Our hosting provider may automatically record standard request information such as IP address, browser type, and timestamps. [HOSTING PROVIDER — not yet chosen; update this section once selected.]

2.4 Voice features

• Default voice mode uses your browser's built-in speech recognition and speech synthesis. In Google Chrome, speech recognition audio is sent to Google and processed under Google's and Chrome's privacy policies, not ours. Other browsers may handle this differently, and some process audio on your device. We receive only the resulting text transcript, which is then treated as study activity (Section 2.1).
• Premium / live voice (OpenAI) offers speech-to-text, text-to-speech, and real-time voice conversation through OpenAI. This feature is currently not enabled. If we enable it, your voice audio and related text will be sent to OpenAI to provide the feature. We will update this policy and [ask for your consent / notify you] before the feature goes live. [COUNSEL: advise whether voice audio implicates biometric privacy laws (e.g., Illinois BIPA, Texas CUBI, Washington) — our position is that we do not create voiceprints or identify speakers, but confirm with counsel and with OpenAI's processing terms.]

2.5 Investor demo / guest access

We may give guest access to people evaluating the Service (for example, investors) through access codes. Study sessions in guest accounts are stored like any other study activity and are linked to the access code's label, which identifies who received the code.

2.6 Information we do not intentionally collect

We do not ask for and do not want sensitive information such as government ID numbers, financial account numbers, health information, or information about other people's legal matters. Please do not upload confidential client information, real case files from clinics or jobs, or other people's personal information. The Service is for studying course material.

3. How we use information

We use information to:

1. Provide the Service. We create and secure your account, store your materials, run AI study sessions, generate topic maps, ask and evaluate checkpoint questions, and calculate your Commanding Score and mastery data.
2. Keep the Service safe. We detect and prevent abuse, fraud, and security incidents, and we enforce our Terms of Service, including our academic-integrity safeguards that decline to complete graded coursework.
3. Fix and improve the Service. We use error logs, AI usage metrics, and feedback to find bugs, control costs, and make the teaching better. [COUNSEL: if we will use student transcripts or uploaded content to improve prompts, evaluate scoring, or train or fine-tune models, say so explicitly here and decide whether that requires opt-in consent. Current understanding: we do not train AI models on user content.]
4. Communicate with you. We send service messages (for example, about your account or changes to these terms) and, for waitlist members, beta invitations. [If marketing emails are sent, add opt-out language and CAN-SPAM compliance.]
5. Research and pilots. If we run a learning study or pilot, we will describe it and ask for your consent separately before using your data for that purpose. [COUNSEL: see legal checklist regarding research consent / IRB.]
6. Comply with law. We respond to lawful requests and protect our rights.

We do not use your information to show you advertising, and we do not sell it.

4. AI processing and our service providers

To generate teaching responses and evaluations, the Service sends your messages, the relevant parts of your uploaded materials, and related study context to third-party AI providers. These providers process the data for us under their commercial terms.

AI output can be inaccurate. See our Terms of Service.

5. How we share information

We share personal information only:

• With service providers listed in Section 4, who process it for us.
• With your direction, for example if you choose to share something.
• For legal reasons, when we believe in good faith that the law requires it, or to protect the rights, safety, or property of users, the public, or Case Commander.
• In a business transaction, such as a merger, acquisition, financing, or sale of assets. Your information may be transferred as part of that transaction, subject to this Policy.
• In aggregated or de-identified form that cannot reasonably identify you. [COUNSEL: confirm the de-identification standard, especially if aggregate learning metrics will be shared with investors or schools.]

We do not share your study data, scores, or uploaded materials with your law school, professors, or employers.

6. Retention

We keep information only as long as we need it for the purposes above:

Our AI providers keep data under their own retention terms. See Section 4. [COUNSEL / FOUNDER: set these periods and build matching deletion jobs before launch.]

7. Students, schools, and FERPA

Case Commander is a consumer study tool. Students sign up and use it directly. We do not currently contract with law schools, and schools do not give us student education records.

[COUNSEL: Our understanding is that the Family Educational Rights and Privacy Act (FERPA) generally governs educational institutions and their records, and that a direct-to-student consumer app that does not receive records from a school, and is not acting as a "school official" under a school contract, is generally not subject to FERPA in the same way. If we ever contract with a school (for example, a school-paid license, an integration with a school LMS, or reporting to faculty), FERPA's school-official exception, state student-privacy laws (such as California SOPIPA and similar statutes), and school data-protection agreements may apply. Please confirm and advise.]

Your Commanding Score and mastery data are learning tools. They are not official grades or assessments, and we do not report them to any school.

8. Age requirement

The Service is intended for adults who are [18] years of age or older, typically law students. We do not knowingly collect personal information from anyone under [18]. If you believe a minor has given us information, contact [CONTACT EMAIL] and we will delete it.

[COUNSEL: confirm the minimum age. Since the Service is limited to users 18 and older and is not directed to children, COPPA (which applies to children under 13) should not apply. Confirm, and confirm whether Anthropic's Usage Policy requirements for "products serving minors" would apply if the minimum age were lowered.]

9. Security

We use reasonable administrative, technical, and physical safeguards, including:

• passwords stored only as bcrypt hashes;
• an httpOnly session cookie, which page scripts cannot read;
• access to production data limited to authorized personnel;
• encryption in transit (HTTPS) [CONFIRM once hosting is configured] and at rest [CONFIRM with hosting provider].

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach affects your personal information, we will notify you as required by law.

We do not claim any security or privacy certification (such as SOC 2 or ISO 27001).

10. Your rights and choices

Everyone can:

• Delete materials: delete individual topics and uploaded sources from within the app.
• Export your data: Settings → Your data → Download ZIP gives you your topics, the original PDFs you uploaded, their text, your study sessions, answers, feedback and progress, as JSON files with a README.
• Delete your account: Settings → Your data → Delete account (your password and typing DELETE confirm it). This removes your account and everything tied to it from the live database, and your uploaded files from storage, immediately. Records of AI usage (counts, models, costs; never your content) are kept without a link to you. Copies in backups are deleted as backups expire ([X DAYS]).
• Access or correct your account, or any request you can't do in the app: email [CONTACT EMAIL]. We will verify your identity before acting on your request.
• Leave the waitlist: email [CONTACT EMAIL].
• Control voice: you do not have to use voice features. You can type instead.

State privacy laws. Depending on where you live, you may have additional rights under state laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), or the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states. These rights may include the right to know, access, correct, delete, and port your data, and the right to opt out of sale, sharing, targeted advertising, and certain profiling. We do not sell or share personal information for targeted advertising. To exercise any right, contact [CONTACT EMAIL]. We will not discriminate against you for exercising your rights.

[COUNSEL: Most of these laws apply only above thresholds. For example, the CCPA applies to for-profit businesses doing business in California that meet at least one of: (a) annual gross revenue above an inflation-adjusted threshold (originally $25M, currently higher; confirm the current figure); (b) buying, selling, or sharing personal information of 100,000+ consumers or households; or (c) deriving 50%+ of revenue from selling or sharing personal information. Other states have their own consumer-count thresholds, and Texas applies to businesses that are not "small businesses" under the SBA definition. A pre-revenue beta likely falls below most thresholds, but please confirm which laws apply now and at what growth point we must comply. Consider whether to extend these rights voluntarily to all users. Also consider whether Commanding Score or mastery data counts as "profiling" under these laws.]

11. International users

Case Commander is operated from the United States, and your information will be stored and processed in the United States [and in locations where our hosting and AI providers operate]. If you use the Service from outside the U.S., you understand that your information will be transferred to the U.S., where data protection laws may differ from those in your country.

[COUNSEL: Decide whether to block or restrict sign-ups from the EU/EEA, UK, and other regions with GDPR-style laws during beta. If not, we will need a lawful basis analysis, transfer mechanisms, DPAs with processors, and possibly an EU/UK representative. Also check Anthropic's and OpenAI's supported-regions policies.]

12. Changes to this policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or in the app before the changes take effect, and we will update the "Last updated" date. For changes that materially expand how we use information you already provided (for example, enabling OpenAI voice or using content for model training), we will [ask for your consent].

13. Contact us

[COMPANY LEGAL NAME] [MAILING ADDRESS] Email: [CONTACT EMAIL] Privacy requests: [PRIVACY EMAIL, or same as above]

Drafting notes for counsel (remove before publication)

1. Hosting not chosen. A Render blueprint has been prepared, but nothing is deployed. Update Sections 2.3, 4, 9, and 11 once hosting is final.
2. Account deletion and export are self-service (Settings → Your data). Deletion does not reach database backups; set and state a backup retention period. Demo guest accounts can't be self-deleted (they are reset by the operator).
3. Model training / content reuse. Confirm the founder's intent on using transcripts to tune prompts or the scoring engine (a scoring v2 shadow engine exists). Decide whether that requires opt-in consent.
4. Research pilot. A "time-to-command" pilot is planned. Any research use of data needs a separate consent document and possibly IRB review if conducted with a university.
5. Investor guest sessions. Confirm guests see a short privacy notice at the access-code screen.
6. Biometric / voice laws. These matter once OpenAI realtime voice is enabled.
7. Uploaded content may include third-party personal information (for example, names of parties in cases). Court opinions are public records, but class notes may mention classmates.
8. AI disclosure. Anthropic's Usage Policy requires consumer-facing chatbots to disclose that users are interacting with AI. The product does this by design, but confirm the disclosure appears in the interface.