Privacy Policy

Your answers to the interview, the documents produced from them, and an append-only record of changes to those answers. Concretely that includes identity details such as passport and residence card numbers and dates of birth; contact details; financial figures such as income and savings; and narrative answers about how you met, your family circumstances, and anything you have explained about your record.

The narrative answers deserve particular care. An answer may disclose a previous marriage, an estrangement, a criminal penalty, or a medical reason for living apart. It is ordinary personal data by law and extraordinarily personal in practice, and it is treated with the care special-category data would attract.

Run on your own machine, case data is written to that machine and is not transmitted anywhere. On the hosted service it is written to the servers described in the next section, and to nowhere else. Either way it is encrypted at rest, with the key held outside the data directory so that a copy of the data alone -- a stray backup, a borrowed laptop -- is ciphertext.

Sign-in is by an email address and a password. Passwords are stored hashed with scrypt and are never recoverable, by us or by anyone.

An emailed link does two jobs and no others: it confirms your address when you register, and it authorises setting a new password when you have forgotten one. Such a link is single-use, valid for fifteen minutes, invalidated when used, and bound to the browser that asked for it, so a forwarded link is of no use to anybody else. A reset link does not sign you in: it authorises one act, and using it ends every existing session on the account.

Sessions are held server-side, so signing out ends them rather than merely deleting a cookie. A session opening a case expires after two hours of disuse; the account session after thirty days; and every session after ninety days whatever has happened.

The interface makes three kinds of third-party request. A web font is fetched on every page. If you open the office map, the map library and the map tiles are fetched then, and not before. Nothing about your case is sent with any of them.

Run on your own machine, case data stays on that machine and this section does not apply to you.

On the hosted service, case data is stored on servers operated by Hostinger in Boston, Massachusetts, in the United States. It is encrypted at rest there, as it is anywhere else, and the key is held outside the data directory.

The consequence has to be said plainly rather than left to be discovered: data held in the United States is subject to United States legal process. A lawful order addressed to the operator or to the hosting provider can compel disclosure, and no promise we could make would override one. What we can say, and do say, is in the section below: we do not volunteer anything to anybody, and we comply only where we are compelled to.

If your personal information is transferred out of Japan to be held there, that transfer happens because you asked us to hold your case, and you are told where it goes before you do. If you would rather it were not held in the United States, run the application locally: it is the same application and it needs no account.

Four purposes, and there is not a fifth.

One, providing the drafting service you asked for. Two, keeping your own records for as long as you chose to keep them. Three, keeping a tamper-evident log of who did what and when, so that authorship can be evidenced if it is ever disputed -- that log holds metadata, never the contents of a document. Four, responding to a request from a public authority where the law requires it.

The fourth needs its limit stated, because it is the one that could be read widely. It permits compliance with a lawful demand. It does not permit volunteering anything to anybody, and we do not.

You. A case you have claimed is reachable only when you are signed in; its address alone is not enough, which is the whole reason accounts exist here.

Cases created before accounts were required could be opened by their address alone. Nothing creates a case in that state any more, and if you hold one it can be claimed from the account page. Until it is, its address is the only thing protecting it.

Authorised personnel may access records held by this service where that is necessary to support you, to investigate a problem, to check the quality of what is produced, or to meet a legal obligation. Such access is logged. Encryption at rest protects your data from anyone who obtains a copy of the storage; it is not a claim that nobody inside the company can ever read a record. The audit record of your account shows every sign-in, export and deletion.

Your answers are not used to train anything. Not a model, not a product, not an aggregate. The narrative answers in particular are never used for analytics of any kind.

Nothing is sold. Nothing is volunteered to any authority: filing is something you do yourself, and we do not report, notify or hand anything to anybody on our own initiative. Where a lawful order compels disclosure we comply with that order and no further -- we will not pretend to a power to refuse one we do not have. No third party receives your case content without a separate, specific consent for that engagement.

Accepting these terms and storing your case data are unavoidable parts of using an account: without the first there is no agreement, and without the second there is no service.

Everything else is separate and off by default. Marketing email is not required for anything and is not bundled. Anonymised product analytics is not required for anything and is not bundled. Offering a case to a registered professional is separate, off unless you turn it on, revocable at any time, and is itself the consent for that engagement and no other. You may change any of these at any time from the account page, and refusing them changes nothing about the service you receive.

You can export a case as JSON at any time, unprompted, and you can delete a case or the whole account at any time. Deletion here is immediate and irreversible: the data is two directories on one machine, so there is nothing to schedule and nothing held back.

A case untouched for twenty-four months is notified and then deleted. Backups of this application deliberately exclude case data entirely, so a deleted case does not survive in one.

Japanese law (個人情報保護法) governs where cases are held for people in Japan, and the GDPR also applies to a couple in the EU or the UK. Under both you may ask what is held, correct it, and have it erased -- which the account page does directly, without asking anybody.