Privacy Policy — Legal Locate

Legal Locate ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use the Legal Locate mobile application and related services (the "Service").

1. Information We Collect

We collect the following categories of information:

Account information: Your name, email address, and account credentials when you register, plus an optional phone number and the city where you are located, which you can add on your profile. If you signed up in an earlier version of the app, it also asked for the state you live in.
Case information: Details about your legal matter that you submit through the app, including the nature of your case, jurisdiction, the city where the matter took place, your answers to the intake questions for that type of matter, and any narrative you provide. Depending on the matter, those answers can include health information (an injury and the treatment you received), financial information (income, assets, debts, or an amount in dispute), and information privacy laws treat as sensitive, such as the basis of a discrimination claim (for example race, religion, or disability), immigration status, or criminal history. We ask only what an attorney needs in order to decide whether to apply. These answers are shown only to attorneys as described in Section 3 and are never used for analytics or advertising.
Attorney information: For attorneys, your BAR identification number, firm name, firm address, firm email and phone number, years of experience, licensed jurisdictions, and professional biography.
Attorney practice records: For attorneys, a record of each offer you send (the fee estimate, your message, and the disclaimer shown with it); for each matter a client hires you on, a provenance record of that engagement (the practice area, state, fee terms, and the dates the case was posted, you applied, you offered, the client selected you, and the hire was confirmed); and any offer templates and checklists you write. These records hold your own words and the facts of your own activity, and never a client's name or contact details.
Directory page: For attorneys who choose to publish one, the headline and biography you write for your page in our public attorney directory, shown with your name, firm, and city.
Web dashboard sign-in: When an attorney signs in to the web dashboard at legallocate.app, we check your email and password, email you a six-digit sign-in code, and set a signed session cookie so you stay signed in. Signing out or changing your password ends that session.
Launch list: If Legal Locate is not yet available in your state, you can give us your email address and that state (and whether you are a client or an attorney) so we can tell you when it launches. We first email you a confirmation link and send the launch notice only to addresses that confirm.
Attorney outreach email: We send a launch announcement to attorneys licensed in a state where we are launching, using business addresses published on firm websites or obtained from commercial business-contact services. Each message is marked as an advertisement, carries our postal address and an unsubscribe link, and an unsubscribe is honored before our next send. We keep the opt-out list indefinitely so we never email that address again.
Instagram comments and messages: If you comment on a post from our Instagram account, reply to one of its comments, tag the account in a post, or send it a direct message, we receive what you wrote, your Instagram username, and the time, through Meta's tools for business accounts. We keep them in our marketing system so that a member of our team can read them and answer you from the account; nothing answers on its own, and a direct message can be answered only within 24 hours of your last message, under Instagram's rules. We never send a first message to anyone who has not written to us, and we never follow anyone automatically.
Public Instagram profiles: For an account that has commented on, tagged or messaged ours, we may read the public profile Meta's Business Discovery tool returns for a business or creator account (username, biography, website, and follower and media counts) to judge whether it is a law firm, an account with reach, or neither. We keep only that judgement, one line of why, the follower count and the username; the biography and website are read and discarded. A personal account returns no profile at all.
Ad contact forms: If you fill in a form on one of our Instagram or Facebook ads and ask to hear from us, we receive from Meta the name, e-mail address and phone number you entered and your answers to the form's own questions, including your city and state. Every other field Meta can pre-fill (such as your address, date of birth or job) is dropped on arrival. These details are encrypted in our database and are used only to get back to you, by e-mail or phone, about Legal Locate. Meta's own privacy policy governs what Meta keeps about the form you submitted and the ad you saw; Meta never tells us who saw or clicked an ad.
Communications: Messages and offers exchanged through the platform between clients and attorneys.
Usage data: App activity, device type, operating system, and crash, app-hang, and performance diagnostics (such as app start time, frame rate, and a sample of slow operations) provided by Apple's TestFlight and App Store services and by our error-reporting provider (Sentry), used to improve the Service. Error reports are technical in nature and are configured not to include personally identifying information.
Push notification token: If you allow notifications, the app registers a device push token with us so we can alert you to case activity. The token identifies your device for push delivery only and is never used for analytics or attribution.
Analytics data: The iOS app sends product-analytics events to PostHog Inc. (hosted on PostHog's US cloud), covering app lifecycle (app installed, opened, and backgrounded), the screens you visit (by screen name only, never what is on them), and key funnel steps (case-wizard start, steps, and submission, the state-availability notice and launch-list signup, the sign-in prompt, account signup and verification, attorney applications, offer acceptance, and hire confirmation). Events sent before you sign in are recorded under the device identifier alone and are linked to your account when you create one or sign in. These events include a randomly generated device identifier (never the advertising identifier — no IDFA or IDFV), your account's user ID and role, the U.S. state involved, case IDs, and device metadata collected by the PostHog SDK (device model, OS version, app version, locale, and timezone). They never include names, email addresses, case narratives, demographic information, the legal practice area you selected, or any free text.
Website analytics: Our website at legallocate.app sends a small set of usage events to PostHog Inc. (hosted on PostHog's US cloud): the pages you view and leave, and clicks on our App Store links. The website sets no cookies and stores nothing on your device for this purpose; each visit carries a random identifier that is held only in your browser's memory and discarded when you leave, so visits are never linked to one another or to an account. PostHog's servers receive your IP address with each event, as with any web request, and may record an approximate location from it; we do not use that location. If your browser sends a Global Privacy Control or Do Not Track signal, no analytics run at all. These events never include your name, email address, or anything you type into a form. The iOS app has no equivalent signal; its analytics are described in the Analytics data section above.
Attribution data: The iOS app also includes the AppsFlyer SDK (AppsFlyer Ltd., hosted in the United States) to measure which of our own app-install advertising campaigns result in installs. It runs in AppsFlyer's strict configuration: it never accesses the advertising identifier (IDFA), never shows a tracking-permission prompt, and is never given your account identity. It receives the same funnel events described above (with the same exclusions, including the legal practice area), a device-level install identifier and the identifier for vendor (IDFV), technical device and network information, and your IP address, which AppsFlyer maps to an approximate (city-level) location. Attribution data stays at the device level and is never joined to your name, email address, or account.

2. How We Use Your Information

To make client case postings available to licensed attorneys in the appropriate jurisdiction, who decide for themselves whether to apply.
To verify attorney BAR credentials and licensing status.
To facilitate communication and offers between clients and attorneys.
To send notifications about case activity, offers, and selections.
To answer people who comment on, tag or message our Instagram account, and to get back to people who ask to hear from us through a form on one of our ads.
To improve, maintain, and secure the Service.
To comply with applicable laws and regulations.

3. How We Share Your Information

We do not sell your personal information or share it for cross-context behavioral advertising. We may share information in the following circumstances:

With attorneys in your jurisdiction: When you submit a case, your intake answers (including any health, financial, or sensitive answers described above), your narrative, the city where the matter took place, and, if you added it to your profile, the city where you are located are shown to verified attorneys licensed in that state, before any attorney-client relationship exists. Your contact details are never included in what browsing attorneys see.
With your selected attorney: When you accept an attorney's offer, that attorney receives your name and contact details along with your case information, so they can evaluate your case and reach out to schedule your consultation.
With clients: When an attorney submits an offer or accepts a case, their professional profile information is shared with the client.
Publicly, on your directory page: If you are an attorney and you publish a directory page, its contents (your name, firm, city, headline, and biography, with an "Advertisement" label and the fact that your bar license is verified) are public on our website and listed in our sitemap until you unpublish the page or we take it down.
Service providers: We use trusted third-party providers (including cloud hosting, Apple's App Store/TestFlight diagnostics, Sentry for error and crash reporting, PostHog Inc. for product analytics in the app and the website usage analytics described above, hosted on PostHog's US cloud, AppsFlyer Ltd. for app-install attribution, Mailgun (Sinch) to deliver the sign-in codes and account email we send you, and Expo's push notification service, operated by Exponent Inc. and hosted in the United States, to deliver push notifications) that process data on our behalf under their data-processing terms, which require them to protect your information at least as this policy does and to use it only to provide their service to us. Analytics data is used only for product analytics such as funnel and drop-off analysis, and attribution data only to measure the performance of our own app-install campaigns — the app itself shows no advertising — and neither is sold or shared for cross-app tracking. Our attribution SDK runs in a configuration that removes the advertising identifier entirely, and attributes installs only through Apple's own privacy-preserving attribution (Apple Ads and SKAdNetwork), so it performs no tracking as Apple defines it. Push notifications are handed to Expo's service with your device push token and the notification's title and text, which Expo passes to Apple for delivery; that text is generic (for example, “An attorney has applied for your case”) and never includes your name, the legal practice area you selected, your case details, or an attorney's name.
Meta (Instagram and Facebook): What you do on Instagram or Facebook, including a comment, a message or a form on one of our ads, is also held by Meta Platforms, Inc. under its own terms and privacy policy, which apply alongside this one. We receive it only through Meta's tools for business accounts, and we send nothing back to Meta about you except the reply you see.
AI drafting: When someone comments on or messages our Instagram account, the text of that message, with contact details removed and without the username, may be sent to Anthropic, PBC to draft a suggested reply, and the public profile described above may be sent to it to judge what kind of account engaged with us. Anthropic processes this on our behalf under its commercial data-processing terms. A person reads and approves every reply before it is sent, and no reply is ever sent automatically. We never send anything from an ad's contact form to any AI service.
Legal requirements: We may disclose information if required by law, court order, or to protect the rights and safety of our users.

4. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. When you confirm that you have located an attorney, every other application and offer on that case is permanently deleted from our systems; the case itself, your intake details, and your located attorney's application and offer are kept so that both you and your attorney retain a record of the engagement. You can delete your account and all associated data at any time directly in the app (Profile → Delete Account); deletion takes effect immediately. When you delete your account, we also delete your product-analytics identity and its events from PostHog, along with the push tokens registered for your devices. AppsFlyer attribution data holds no account identity to delete — it stays at the device level and is deleted by AppsFlyer under its own retention schedule. We keep a minimal record of the deletion request itself (the deleted account's email address and role, and the time and technical origin of the request) for security and audit purposes, and certain other information may be retained as required by law. For attorneys, each offer record is kept for five years from the date the offer was sent and then deleted automatically; matter provenance records are kept for as long as your attorney account is active, including after the client deletes the underlying case, so that you keep a record of each engagement. All of these are deleted with your account, along with your templates, checklists, and directory page. Launch-list entries are not tied to an account; to remove yours, email admin@legallocate.app. Our servers keep standard request logs (IP address, time, and the endpoint called, with personal fields masked) for up to one year for security and debugging. Attorney outreach addresses are kept while we are launching in that state; email admin@legallocate.app to have yours removed sooner. Instagram comments, tags and messages sent to our account, with the username that sent them, are kept in our marketing system until you ask us to delete them (Section 7); the replies we sent are kept with them as a record of what we said. Contact-form details are deleted from our systems 30 days after the form reached us, whether or not we got back to you; Meta keeps its own copy under its policy. If you unsubscribe from our e-mails, we keep your e-mail address on a do-not-email list indefinitely so we never e-mail it again. An attorney account whose email address is never verified is deleted 14 days after sign-up, or 14 days after the last sign-up code we sent, whichever is later.

5. Data Security

We use industry-standard security measures including HTTPS encryption for data in transit and secure credential storage on your device. Passwords are stored as one-way hashes, sign-in uses short-lived tokens that we can revoke, our databases are encrypted at rest by our hosting provider, and request logs mask personal fields. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you as applicable law requires.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal information we hold about you.
Request correction of inaccurate information.
Request deletion of your personal information — available directly in the app via Profile → Delete Account.
Object to or restrict certain processing of your data.

To exercise any of these rights, please contact us at admin@legallocate.app.

7. Deleting Data We Received From Instagram or Facebook

You do not need a Legal Locate account for this. To have us delete what we hold from a comment, a tag, a direct message or a form on one of our ads, email admin@legallocate.app with the subject "Delete my Instagram data" and tell us your Instagram username and, for a form, the e-mail address or phone number you entered, so we can find your records. We delete the comments, messages, profile judgement and form details we hold for you within 30 days and reply to confirm. This does not delete your comment, message or form from Instagram or Facebook, which Meta holds under its own policy; you can delete those in Instagram or Facebook. If you also want us to forget that you unsubscribed from our e-mails, say so; otherwise we keep that so we never e-mail you again.

8. Children's Privacy

The Service is not directed to individuals under the age of 18, and account creation requires confirming you are 18 or older. We do not knowingly collect personal information from minors, and never from anyone under 13; if we learn we have, we delete it. If you believe we have inadvertently collected such information, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy at legallocate.app/privacy, which the app links to, updating the "Last updated" date above, and, for significant changes, emailing the address on your account. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Legal Locate
admin@legallocate.app
legallocate.app