Skip to content
Project Revelare
Not CJIS compliant. Do not use for CJIS-regulated data. Project Revelare is early / partial. Some tools are marked demo or coming soon. Do not treat IOC or case output as production-grade or court-ready. Documents you analyse never leave your browser; only identifiers are saved. How we handle data.

Privacy Policy

Last updated: September 29, 2026

1. Summary

Documents you analyse are processed in your browser and are never uploaded or stored. We keep identifiers only (file name, size, type, SHA-256 hash and extracted indicators). See data handling for a short overview.

2. Information we collect

  • Account details you give us: email, first and last name, and optionally your organisation.
  • Case data you create: case titles and descriptions (encrypted at rest), source identifiers and extracted indicators.
  • Forum posts and bug reports you submit.
  • Security data: sign-in events, a truncated hash of your IP address, browser user-agent for active sessions.

3. How we use it

  • To run the service: authentication, cases, search, link analysis and reports.
  • To send transactional email (verification and password reset). We don't send marketing email.
  • To detect and prevent abuse, such as failed-login lockout and rate limits.

4. Sharing

We don't sell personal information. Service providers process data for us: Cloudflare (hosting, database, bot protection), Resend (email delivery), Stripe (payments) and Google AdSense (one ad on some public pages). We disclose information when legally required.

5. Security

TLS everywhere with HSTS, application-level AES-256-GCM encryption for personal fields, salted PBKDF2 password hashing, httpOnly session cookies with inactivity timeout, and audit logging. No system is perfectly secure.

6. Cookies

We use one essential session cookie. Google AdSense may set its own cookies on public pages that show an ad.

7. Retention

Unverified accounts: 14 days. Sessions and one-time links: purged when expired. Audit logs: about 13 months. Archived cases: 12 months. Deleted cases and accounts are removed from the live database immediately.

8. Your rights

You can access, correct, export (CSV) or delete your case data at any time, and ask us to delete your account.

9. Children

The service isn't intended for children under 13.

10. Not CJIS compliant

Project Revelare is not CJIS compliant. Do not store Criminal Justice Information here.

11. Changes

We'll update this page when practices change and revise the date above.