Law enforcement guidelines

What we hold, and what we can't

• End-to-end-encrypted accounts: journal entries, replies, locations and media are encrypted on the user's device with a key we never receive. We cannot decrypt them, and cannot be made to: the most we can produce is the encrypted data itself.
• Standard accounts: journal content is stored encrypted at rest but is technically accessible to us, and can be produced under a valid search warrant.
• For all accounts we may hold: the email address, sign-up date, sign-in times, entry dates and counts, tag and emotion names, file sizes, and short-lived server logs with partially masked IP addresses (kept 14 days). See the Privacy Policy.
• We do not keep location history, contacts, advertising profiles or device fingerprints. We have nothing of that kind to give.

What we require

We disclose user information only in response to valid legal process issued under United States law, and only the minimum it requires:

• Subpoena: basic account information (email address, sign-up date, sign-in times, IP addresses where still held).
• Court order (18 U.S.C. § 2703(d)), signed by a judge: other non-content records, such as entry dates, counts and file sizes.
• Search warrant, signed by a judge on probable cause: content. For encrypted accounts, this yields encrypted data only.

Requests from outside the United States must come through a Mutual Legal Assistance Treaty, letters rogatory, or another process recognised by US law.

Preservation requests (18 U.S.C. § 2703(f)) are honoured for 90 days, extendable once, pending legal process. Preservation discloses nothing.

Emergencies

If you believe there is an emergency involving imminent danger of death or serious physical injury, we may voluntarily disclose limited information without legal process (18 U.S.C. § 2702). Describe the emergency and why the information will help prevent it. We verify every emergency request directly with the requesting agency before acting on it.

We tell users

Our policy is to notify users of requests for their information before disclosing it, so they can seek legal advice, unless we are legally prohibited from doing so (for example by a non-disclosure order under 18 U.S.C. § 2705(b)), or in an emergency where notice would make things worse. Where notice was delayed, we give it once the restriction ends.

How to send a request

Email contact@solous.net from an official agency address, with the legal process attached and the account identified by email address. Include your name, agency, badge or ID number, a callback number that can be verified through official channels, and a return date that allows a reasonable time to respond.

We verify requests independently before responding, including by calling the agency on a publicly listed number. Requests we cannot verify are not answered.

Child safety

We report apparent child sexual exploitation material to the National Center for Missing & Exploited Children (NCMEC) as required by law, when we become aware of it.