Privacy Policy

This Privacy Policy explains how TopDWI (“TopDWI,” “we,” or “us”) collects, uses, protects, and shares information when an authorized user (“you”) accesses evidence-check.com (the “Service”). TopDWI currently operates as a pilot available only to invited attorneys and their staff.

1. Information We Collect

Account information. Our authentication provider collects your name, email address, and account identifiers when you sign in. If you choose Sign in with Google, Google shares your name, email address, and profile image with us under the openid, email, and profile scopes. We do not request access to your Gmail, Google Drive, Calendar, or any other Google data.

Case Documents. You may upload Missouri Alcohol Influence Report packets and related records in PDF, PNG, or JPG form (“Case Documents”). Before a Case Document leaves your browser, the Service runs optical character recognition locally, blacks out detected names, and lets you review and add redactions. Only the redacted file reaches our servers. We process that file in memory and do not keep a copy of it after processing. We store a SHA-256 fingerprint of the file so the Service can resume an interrupted analysis.

Case Data. The Service stores the results of each analysis (“Case Data”), which include the fields extracted from the Case Document, rule outcomes, findings, citations, argument notes, critiques, intermediate processing results, and a party roster that maps real names to role designations. Case Data can include names, device serial numbers, and other details that appear in the record.

Audit and technical records. The Service records each outbound processing call, its cost, and whether a safeguard blocked it. These audit records hold a cryptographic hash and a short redacted preview of the outbound text, never the raw text. Our hosting and authentication providers also log IP addresses, browser type, and request timestamps to operate and secure the Service. Our application logs pass through a redaction layer and record filenames only as hashes.

2. How We Use Information

We use the information described in Section 1 to authenticate you, run the analyses you request, show you your Case Data, detect recurring officer and device issues across your own firm’s cases, verify cited authorities, control cost and abuse, secure and debug the Service, and communicate with you about your account. We do not sell personal information, and we do not use it for advertising.

3. Service Providers

We share information only with the providers that operate the Service on our behalf:

• Clerk, for authentication and account management;
• Google, if you choose Sign in with Google;
• Railway, for application hosting;
• Neon, for database hosting of Case Data and audit records;
• Anthropic, which receives the redacted Case Document for extraction and then receives only pseudonymized analysis requests, as Section 4 describes; and
• CourtListener, which receives citation strings so the Service can confirm that cited authorities exist.

Each provider processes information under its own terms and may retain it for a limited period for security and abuse monitoring. We may also disclose information when the law requires it.

4. How We Protect Case Information

• Every request after extraction passes through a single checkpoint that replaces party names with role designations (for example, “Officer 1” or “Defendant 1”) and replaces Social Security numbers, dates of birth, phone numbers, addresses, email addresses, vehicle identification numbers, and permit and serial numbers with redaction markers.
• If a title-preceded name that is not on the case roster (for example, “Officer Smith”) remains after that step, the Service blocks the request and does not send it. You add the person to the roster and retry.
• The Service checks each request against a fixed list of permitted data fields and blocks any request that contains an unexpected field.
• The Service encrypts the real names in each party roster at rest.
• The Service matches officers and devices across your firm’s cases using keyed hashes scoped to your firm. The officer’s name and the device serial number, as they appear in the Case Document, are also stored in readable form with the case’s saved report, protected by firm separation and disk-level encryption but not by field-level encryption.
• The Service separates each firm’s data, requires authentication for every case endpoint, and uses encrypted connections. Our database provider encrypts stored data at the disk level.

No safeguard is perfect. Automated redaction can miss names, especially handwritten names and names that appear in narrative text without a title, and the extraction step sends the redacted Case Document itself to Anthropic. You should review redactions before you submit a Case Document.

5. Google User Data

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google account data only to sign you in, and we do not transfer it to third parties except as Section 3 describes.

6. Retention and Deletion

Case Data remains in the Service until you or your firm delete it. The Service does not delete Case Data automatically. You can export a complete copy of any case, and you can permanently delete any case, which removes its Case Data, including intermediate processing results and the party roster. Deleting a case does not remove the related audit records described in Section 1, because those records document what the Service did. The Service caps some audit records at a fixed number per firm and discards older ones.

We keep account information while your account remains active. To request deletion of your account or a full purge of your firm’s data, including audit records, email [email protected]. We will act on the request within 30 days.

7. Professional Responsibility

Attorneys who upload Case Documents remain responsible for their own confidentiality obligations to their clients, including review of redactions before submission.

8. Changes

We will post any change to this Privacy Policy on this page and update the date above.

9. Contact

Send questions about this Privacy Policy to [email protected]. Report security issues through the channels in our security policy.