Privacy Policy
Last updated September 8, 2026.
MyCaseViewer, LLC operates www.mycaseviewer.com and the MyCaseViewer application (the "Service"). This policy explains what personal information we handle, why, and what you can do about it. It works alongside our Terms of Service, which govern the Service itself.
Who this policy is for
Two different kinds of people encounter MyCaseViewer, and the distinction runs through everything below.
- Account holders — investigators, firms, and businesses who subscribe, upload case material, and send it out. This policy covers you directly.
- Recipients — the clients and third parties who open a case link. If you opened a link and want to know why we have your email address, or why your access is logged, read section 12. The short answer: the investigator or firm who sent you the link decides all of that, not us. We hold it for them.
The short version
- We do not sell your information, and we do not share it for advertising.
- We do not use your case files to train AI models.
- There are no advertising or analytics trackers on this site. No Google Analytics, no ad pixels, no third-party session recorders. Every cookie we set is one the Service needs to function.
- Your case files are stored only in the United States.
- Case files are deleted automatically on a schedule you control. Deletion is the product, not a favor.
- We log who opened each case and when, because proving delivery is the point of the Service. Section 4 explains exactly what that log holds.
1. Information you give us when you open an account
When you register and use your account, we collect and store:
| What | Why we have it |
|---|---|
| Name, email address, and whether that email is verified | To identify you, sign you in, and send service email |
| Password | Stored only as a hash; we never see the password itself |
| Company name, time zone, profile image | Optional profile details you choose to add |
| Account handle | The shareable ID your sub-users type to sign in |
| Date you accepted the Terms | Proof of the agreement between us |
| Plan, subscription status, trial dates, storage and bandwidth used, overage settings and spend cap | To run your subscription and enforce plan limits |
| Branding you upload — banner, video logo, crest, brand text, link, colors, license line | To render your branding on your cases |
2. Payment information
Subscription payments are processed by Stripe. Card details are entered on Stripe's own hosted pages and never reach our servers. We store your Stripe customer and subscription identifiers, your plan, your billing period, invoice and overage records, and whether payments succeeded — not your card number.
Affiliate payouts run through PayPal. If you join the affiliate program we store your payout method and payout handle, plus the company, website, and audience details you give us on your application.
3. Case material
Case material is the content of your work: files, documents, video, audio, images, external links, case titles, recipient names, welcome and custom messages, and file names. It frequently contains personal information about people who are not our customers — subjects of investigation, witnesses, clients.
We handle case material only as a service provider, on your instructions. We do not decide what goes into it, we do not analyze it, and we do not use it for any purpose of our own. Section 6 lists the narrow circumstances in which our staff can see it at all.
We also store operational details about each file: original filename, MIME type, size, storage key, conversion status, view and download counts, and retention dates.
4. The access log
Every case view and download is recorded. This is a core feature — it is how an investigator proves a client received the material — not incidental telemetry.
For each access event we record the time, the IP address, the browser and device description derived from the user-agent string, an IP-derived country, which file was accessed, the action (viewed, streamed, or downloaded), the bytes served, and, where per-recipient links are used, which recipient it was.
We also record, per recipient: their email address, optional name, first and last view times, view count, and whether their access was revoked. And per case: the first-view timestamp, view count, last-viewed time, and whether the "your client opened it" receipt has been sent.
An IP-derived country is a rough inference from network routing. It is not proof of where a person was standing, and we say so on every certificate we produce.
5. Technical and security information
- Session records — a session token, its expiry, and the IP address and user-agent of the browser that signed in.
- Rate-limiting counters — keyed on IP address, held briefly, to stop password guessing and abuse. No analytics are collected from them.
- Error reports — when something breaks, a diagnostic entry is written to our hosting provider's runtime logs. These can incidentally include a URL or an identifier. We do not send error reports to a separate monitoring service.
- Ban filters — if an account is blocked, we keep the email address, domain, or IP that was blocked, and the reason.
- Email delivery log — the address we sent to, which template, the provider's message ID, and whether it was accepted. Not the content of the case.
- Legal hold events — when a hold is placed or released we record the reason, the time, and a snapshot of the name and email of the person who did it, in a hash-chained log. That snapshot deliberately survives deletion of the user account, because a custody record with a hole in it is worthless.
6. How we use information
We use what we collect to run the Service and deliver your cases; authenticate you and your sub-users; enforce plan limits and bill you; send transactional email (verification, password reset, retention warnings, open receipts, quota alerts, invoices); produce the analytics and certificates you use to prove delivery; detect and prevent abuse, fraud, and attacks; provide support; and meet our legal obligations.
Our staff do not read the contents of your cases except: (a) when you ask us to, for support; (b) when strictly necessary to diagnose a fault or investigate a security incident or a breach of our Terms; or (c) when compelled by valid legal process. Such access is limited to what the purpose requires, and it is logged.
7. What we never do
- We never sell personal information, and we never share it for cross-context behavioral advertising. Under the state privacy laws that define those terms, we do not sell or share your data.
- We never use your case material to train artificial-intelligence or machine-learning models, ours or anyone else's, and we do not permit our vendors to.
- We never place advertising or analytics trackers on the Service.
- We never publish or promote your case material. It is reachable only through the links you create.
8. Cookies
Every cookie we set is strictly functional. We use no advertising, analytics, or cross-site tracking cookies, so there is nothing here to opt out of.
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session cookie | Keeps you signed in to your account | Until sign-out or expiry |
| mcv_portal | Signs a sub-user in to the upload portal | Session |
| mcv_gate_… | Records that a viewer entered the correct case password, so they are not asked again on every file | 4 hours |
| mcv_rcpt_… | Identifies which recipient opened a per-recipient link | 12 hours |
| mcv_plan | Remembers the plan a visitor picked before registering | Short-lived |
| mcv_ref | Credits an affiliate for a referral | 90 days |
The three case cookies are scoped to the individual case and carry a signed value, not a password or personal details.
9. Who we share information with
We share only with the providers we need to run the Service, each under contract and only for that purpose:
| Provider | What it handles | Where |
|---|---|---|
| Storj | Encrypted case-file storage | United States, SOC 2 Type II–attested facilities |
| Supabase | Application database | United States |
| Vercel | Application hosting and scheduled jobs | United States, SOC 2 Type II–attested |
| CloudConvert | Conversion of legacy file formats only | United States (US East) |
| Stripe | Subscription payments and invoicing | United States |
| PayPal | Affiliate commission payouts | United States |
| Resend | Transactional email | United States |
| Upstash | Rate limiting | United States |
This table is the current list of providers, and it is updated here before a new one is added.
We also disclose information in a business transfer — if MyCaseViewer is acquired or merged, your information moves with the Service, subject to this policy — and when compelled by law. Section 10 of the Terms of Service sets out exactly how we respond to subpoenas and government demands, including our commitment to notify you first and to wait so you can move to quash. That process is part of this policy by reference.
10. Where your information is stored
Everything is stored in the United States. Case files sit in SOC 2 Type II–attested US data centers, encrypted and erasure-coded into fragments across independently operated nodes, so no single operator holds a usable copy of any file. Our database and application infrastructure run on SOC 2 Type II–attested US providers. Legacy-format conversion is pinned to a US region.
MyCaseViewer does not hold a SOC 2 attestation of its own. We will not claim a certification we do not have.
We do not offer storage or processing outside the United States. If you send a case link to someone abroad, you are making that transfer.
11. How long we keep things
| Data | Retained |
|---|---|
| Case files | Until the case's retention period ends, then permanently deleted after a 24-hour grace period. A case you delete yourself is purged after 7 days. |
| Access log, certificates, recipient records | For as long as your account exists. Deleting your account deletes them. |
| Legal hold events | For the life of the account, as an unbroken custody record |
| Account information | While your account is open, then deleted within 30 days of closure |
| Billing and tax records | As long as tax and accounting law requires |
| Email delivery log | For as long as your account exists. Deleting your account deletes it. |
| Rate-limiting counters | Minutes to hours |
A case under legal hold is exempt from all of this until the hold is lifted.
12. If you received a case link
Someone — an investigator, a firm, a business — sent you a link to material they prepared. Here is what that means for you.
They control it, not us. They chose to send it to you, they decide how long it stays available, whether you can download it, and whether your access is revoked. We store and deliver it on their instructions.
Your access is logged. When you open the case we record the time, your IP address, a description of your browser and device, and a country inferred from your IP. If you opened a link addressed to you personally, we record that it was you. The person who sent you the link can see all of this — that is the point of the Service, and it is how they prove they delivered the material.
We do not use any of it for anything else. No advertising, no profiling, no sale, no marketing to you.
If you want your information corrected or deleted, or want to know why you were sent something, contact the sender. They hold the relationship and the decisions. If you cannot identify them, write to us at privacy@mycaseviewer.com and we will pass your request on — but we will not disclose the contents of someone's case file to you, and we cannot verify your relationship to a matter we are not party to.
13. Your rights and choices
You can view and change your account details, branding, and retention settings in your dashboard at any time; delete a case, or an individual file, whenever you choose; revoke a recipient's access; set a bandwidth spend cap; cancel your subscription from the billing portal; and close your account, after which we delete your data as described in section 11.
Service email — verification, password resets, retention warnings, invoices — cannot be turned off while your account is open, because it is how the Service tells you things you need to know. We do not send marketing email.
Depending on where you live, state privacy law may give you the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, to limit the use of sensitive information, and not to be discriminated against for exercising those rights. We do not sell or share personal information, so there is no opt-out to exercise. To make a request, write to privacy@mycaseviewer.com. We will verify your identity through your account email and respond within the time the law allows — normally 45 days. You may use an authorized agent, and we may ask for proof of their authority.
If a request concerns information inside someone's case material, section 12 applies: we will refer it to the account holder, because they are the party that decides.
14. Security
We protect information with encryption in transit and at rest, unguessable case links, short-lived signed URLs for every file access, hashed account passwords and sub-user access codes, a password on every case, rate limiting, security headers including a content security policy, and a complete access log.
No service can promise absolute security, and we do not. If we confirm a breach affecting your information we will tell you without undue delay and in any event within 72 hours of confirming it, with what we know and what we recommend.
15. Children
The Service is for professional use by adults. It is not directed at children, we do not knowingly collect personal information from anyone under 18 as an account holder, and we will delete such an account if we learn of it. Case material may contain information about minors — that is the account holder's responsibility and their lawful basis, not something we control or inspect.
16. Do Not Track and Global Privacy Control
We do not track users across other websites, so there is nothing for a Do Not Track or Global Privacy Control signal to change. We honor them by not doing the thing in the first place.
17. Changes to this policy
We may update this policy. We will post the new version with a fresh "last updated" date, and for material changes we will email account holders at least 30 days beforehand. Continued use after a change takes effect is acceptance of it.
18. Contact
MyCaseViewer, LLC — 1500 N Grant St, Ste R, Denver, CO 80203 — privacy@mycaseviewer.com
For a data request, write to privacy@mycaseviewer.com with "Privacy request" in the subject line.