Casewall Privacy Policy

Effective: October 11, 2026
Version: privacy-0.2
Who we are: Casewall is operated by XenneX LLC, a Louisiana limited liability company ("XenneX", "we", "us"). Questions: casewall-legal@xennex.app.

Casewall is a case board for organizing evidence: exhibits, events, places, and people, on a timeline, map, and link chart. This policy covers casewall.org, the Casewall apps, and the Casewall API.

1. What we collect

Your account

• Email address, password (stored only as a hash), and display name.
• If you turn them on: two-factor authentication and passkeys.
• If you sign in with Google or Discord, we receive your email and basic profile from that provider. We don't get access to anything else in that account.
• When you set or change a password, we may check it against the Have I Been Pwned breached-password list. Only a short fragment of a hash of the password is sent, never the password itself.

Sign-in and security

• Sessions, with the IP address and browser/device (user agent) used.
• A security log of sign-ins and account changes, also with IP and user agent. You can see it in Settings. We keep it to protect your account.
• Your security log includes failed sign-in attempts on your account, with the IP address and device used, and a device identifier derived from them (a one-way hash of the browser type and network).
• We use IP addresses briefly, in memory, to rate-limit reports, invites and the demo.

What you put in cases

• Files you upload (photos, video, documents, data files), along with the notes, events, places, people, and links you create.
• For photos, we read a small set of embedded details: capture time, GPS location, device make and model, and orientation. These fill in the timeline and map. The original file is stored exactly as you uploaded it, including any metadata inside it. Previews and thumbnails have all metadata removed.
• A SHA-256 fingerprint of each file, used to prove the file hasn't changed and to spot duplicates in your workspace.

Activity on cases

• An audit log of who did what, when, and how (web, API, AI, or system). It can't be edited after the fact. That's how Casewall "keeps receipts."
• Submissions (proposed changes) you send to a case, and reviews of them.
• Invitations and requests to join cases.

Reports

• Anyone can report content on a public case page without an account. A report includes its category and details, plus an email address if you choose to give one.

On your device

• We use only the cookies needed to keep you signed in. We don't use advertising or analytics cookies.
• Your browser stores your theme choice, pinned items, and in-progress uploads (so an interrupted upload can resume).

What we don't do

• No ad tracking, no analytics or session-recording tools, and we don't sell or rent personal information.
• No facial recognition, and no people-search.

2. How we use it

• To run Casewall: store and show your cases, sync your devices, and send account and case emails (verification, password reset, invitations, submission and report notices).
• To keep it secure: detect abuse, rate-limit, investigate reports, and protect accounts.
• To enforce our Terms and Acceptable Use Policy, including handling takedown and safety reports.
• AI features: AI features run when you, or a case member allowed to use AI, start them. Case owners control who can run AI in the case's permissions. The relevant case content is sent to our AI providers (section 4) to produce a result. AI output is labeled and stays out of your case's fact record until a person accepts it. Neither AI provider uses your content to train models. If we add AI models on hardware we run ourselves, we'll say so here before turning it on.
• To meet legal obligations (see section 5).

3. Who can see your case data

• Private cases (the default): only you and the people you invite, at the role you give them.
• Public case pages: if a case owner publishes a case, anyone can view a read-only copy, signed in or not. Before publishing, the owner must confirm the case follows our rules, and we store that confirmation. On public pages:
  • People who haven't been publicly named by law enforcement or mainstream media appear as "Unidentified Subject A, B, …", and minors as "Minor 1, 2, …". Their names and identifying details are withheld.
  • Notes are visible to case members only.
  • Photos and exhibits appear as posted. We don't blur faces.
  • Public pages ask search engines not to index them.
• Our team accesses case content only when we need to: to answer a report, fix a problem you've asked us about, keep the service secure, or comply with the law.

4. Service providers

We use a small number of providers to run Casewall, under contracts that limit how they use your data:

• App hosting and database: Amazon Web Services (US regions). During the beta, the service also runs on servers XenneX operates.
• File storage: Cloudflare R2. Files are encrypted with a key per case before they're stored.
• AI processing: Amazon Web Services (Amazon Bedrock; Amazon Nova and Anthropic Claude models, US regions) and Groq (audio transcription, with zero data retention). Neither uses your content to train models. Content goes to them only when an AI feature runs.
• Email delivery: Resend, for account and notification emails.
• Sign-in: Google and Discord, only if you choose them.
• Breached-password check: Have I Been Pwned.
• Secrets management: Doppler (holds our service keys, not your content).
• Payments: Stripe, once paid plans are available.

Before public launch we'll add a CSAM hash-matching provider and backups, and list them here.

5. Safety, takedowns, and legal requests

• CSAM and NCII: a file reported as child sexual abuse material (CSAM) or as non-consensual intimate imagery (NCII) is hidden as soon as the report is filed, and only XenneX staff decide those reports. Today, the hidden file is also blocked from being added again within the same workspace. Before public launch, we will block identical copies across all of Casewall, scan uploads against known CSAM, and have reporting to NCMEC and legally required preservation in place.
• Intimate images shared without consent: see the Acceptable Use Policy, section 8.2, for how to ask us to remove one. We remove valid requests within 48 hours.
• Reports: we keep reports and our decisions so we can handle appeals and repeat abuse. Notification emails about reports are deleted after 90 days.
• Law enforcement: we disclose user data only in response to valid legal process, except in an emergency involving risk of death or serious injury. Where the law allows, we'll tell affected users before disclosing.

6. How long we keep it

• Account data: while your account is open.
• Case content: while the case exists. Deleted items can be restored by the case owner, and their change history is kept for the integrity of the record.
• Audit and security logs: for the life of the case or account.
• Change history: today, a case's change history keeps the earlier values of content that was edited or removed, and case members with access to the history can see them. Before public launch, when content is removed for a privacy or doxxing report, we'll also remove it from the change history; the history will keep a record that a change happened, not the removed content.
• Deletion: self-serve account and case deletion aren't built yet, and we'll have them in place before public launch. Until then, email casewall-legal@xennex.app and we'll disable your account, remove what we can, and tell you what remains. Even after deletion:
  • contributions you made to other people's cases stay in those cases;
  • we keep records we're legally required to keep.

7. Your choices and rights

• Edit your profile, and turn 2FA, passkeys, and linked sign-ins on or off, in Settings.
• Ask us for a copy of your data, to correct it, or to delete it: casewall-legal@xennex.app. We'll verify it's you first.
• Depending on where you live (for example California, or the EU/UK), you may have more rights, including to know, delete, correct, and opt out of the sale or sharing of your data. We don't sell or share personal information for advertising. [Counsel: confirm which state laws apply at launch scale, and whether GDPR applies.]
• People named in a case who aren't Casewall users can report a public page (privacy, likeness, defamation, or family request) using the Report button on that page, or email casewall-legal@xennex.app.

8. Children

Casewall is for adults. You must be 18 or older to create an account. If we learn a child under 13 has given us personal information, we'll delete it.

9. Security

Passwords are hashed. Files are encrypted at rest with a key per case and fingerprinted on upload. The audit log is append-only and hash-chained. Two-factor authentication and passkeys are available. No system is perfectly secure, so use a strong, unique password and turn on 2FA.

10. Changes

If we make material changes, we'll post the new version here and notify account holders by email or in the app. Material changes take effect 30 days after that notice. Each version is numbered and dated.

11. Contact

XenneX LLC · casewall-legal@xennex.app