CaseChorus (Beta) — Privacy Policy
Last updated: September 29, 2026
The short version
We collect very little about you, and we hold a great deal for you.
About you, we store your name, your work email, your firm, and a record of your activity in the product. We collect your IP address, technical information about the device and browser you use, and a record of how you move through the product. We have never sold personal information, and we do not do targeted advertising.
For you, we store the case materials you upload. Those files often contain detailed information about people who are not our users: your clients, plaintiffs, witnesses, treating physicians. We hold that material on your firm’s instructions and use it to run the product for you. We also use it to improve the product, and we explain exactly what that means below.
CaseChorus is an early beta. The product changes often and this policy will change with it. We post updates here and tell you about significant ones.
Two different kinds of information
This policy covers two things that are easy to conflate, so we keep them apart throughout.
Your information. Your name, work email, firm, role, and how you use the product. We decide what we collect here and why. This policy is our notice to you about it.
Your case materials. Everything you type into a case or upload to it. We do not decide what goes in. Your firm does. We process it on your firm’s instructions, for the purpose of running the product, and for nothing else. Under California law our role for this material is a service provider, not a business.
The practical consequence: if someone named in a file you uploaded wants to know what we hold about them, we cannot answer them directly. We have no relationship with them and no way to identify them in your files. That request goes to your firm, and we help your firm answer it. This is described in more detail below and governed by our Data Processing Addendum.
What we collect about you
| What | Examples | Where it comes from | California category |
|---|---|---|---|
| Account and early access request details | Name, work email, firm, your role in the firm, practice area, who invited you, communications in your early access request | You, or the colleague who invited you | Identifiers |
| Sign-in records | That you signed in, when, and whether the sign-in succeeded | Automatically, when you use the product | Identifiers |
| Device and browser | Device type (desktop, tablet, phone), operating system and version, browser and version, screen size, language, time zone | Automatically, as you use the product | Internet or network activity |
| Network information | Your IP address, and the general region it indicates | Automatically, as you use the product | Internet or network activity |
| Product activity | Which screens and features you used, when, whether the request succeeded, and how long it took | Automatically, as you use the product | Internet or network activity |
| Usage metering | How much AI processing each request consumed and what it cost us | Automatically | Commercial information |
| Audit trail | A record of significant actions such as creating a case, sharing it, uploading or deleting a file, or changing a colleague’s role | Automatically | Internet or network activity |
| What you write to us | Support messages, product feedback, requests for a new jury venue | You | Identifiers, and whatever else you choose to write |
That is the complete list.
Technical and usage information. We collect your IP address, the device type, operating system, and browser you are using, your screen size, language, and time zone, and a record of how you move through the product. We may collect this using cookies, pixels, tags, software development kits, and similar measurement technologies, whether ours or a provider’s. We use it to understand which parts of the product are used, to improve the product, to fix problems, and to keep the product secure.
We do not track your precise location, we do not build advertising or behavioral profiles, and we do not run session-recording or heat-mapping tools. We do not buy personal information from data brokers.
Sensitive information. We do not collect sensitive personal information about you, as California defines that term. We do not ask for your race, religion, health, union membership, precise location, or the contents of your private communications. During the beta the product is free, so we collect no payment or financial information from you at all.
Two things load in your browser from Google when you use our pages. Our sign-in and password-reset screens use Google reCAPTCHA to block automated attacks, and our pages load fonts from Google Fonts. In both cases your browser contacts Google directly, and Google receives your IP address and some technical information under Google’s own privacy policy. We never receive your IP address from those exchanges, and no case material is involved in either.
Your case materials
When you create a case you give it a caption, a jurisdiction, and a narrative of the facts. You upload documents: PDFs, Word files, text files, and images, up to 25 MB each. You type questions to the jury panel. We store all of it, along with the panel’s responses and the strategy reports the product generates.
We also extract the text from every document you upload so the product can work with it, and we keep that text alongside the original file.
We know what is in these files. In a personal injury or medical negligence matter they routinely contain medical records, treatment histories, dates of birth, home addresses, employment and wage records, photographs of injuries, and sometimes government identification numbers. They describe your clients, opposing parties, witnesses, and treating physicians, none of whom are our users.
We do not inspect, classify, filter, or restrict what you upload. Nothing in the product scans for personal information or removes it. Your firm decides what goes in.
Our commitments on this material. We use it to run the product for you and to improve how the product works, as described below. We never combine one firm’s material with another firm’s. We do not sell it, and we do not disclose it to anyone except the service providers listed below, who are bound to use it only to run the service for us.
Your firm’s responsibilities. Your firm is responsible for having the right to upload what it uploads, for any protective order or confidentiality obligation that applies to it, and for its own professional duties to its clients. If a person named in your files exercises a privacy right, your firm handles that request and we will give your firm whatever it needs from our systems to respond.
Synthetic jurors are not real people. The jurors in the product are generated from aggregate U.S. Census statistics. They are not profiles of real individuals, and no real person is scored, ranked, or evaluated by the product. Case facts are never used to build them.
How we use information
We use it to:
- run the product: store your cases and files, generate juror responses to your questions, and produce reports
- build synthetic juror pools from public Census statistics
- sign you in, manage your firm’s members and roles, and honor how you have shared a case with colleagues
- send you the account emails described below
- keep an audit trail, so your firm can see who did what
- measure how much AI processing the product is using and what it costs us
- answer your support messages and act on your feedback
- keep the product secure, investigate misuse, and comply with the law
We do not use it for advertising, for profiling you, or to make automated decisions about anyone.
AI processing
This is the part we think you should understand precisely.
When you ask the jury panel a question, we send the following to our AI provider, Anthropic: the case caption, jurisdiction, and practice area; the full facts narrative you wrote; the filename and complete extracted text of every document attached to the case; up to six images from the case, sent as images; the synthetic juror profiles; the recent transcript; and your question. Report generation works the same way.
We send this material as it is. We do not redact it, mask it, or remove names or identifiers first. If a medical record is attached to the case, its full text goes to the model. We say this plainly because it is the single most important fact in this policy for a lawyer weighing confidentiality.
Our AI provider does not train on your material. We use Anthropic’s commercial API. Under the commercial terms that govern our account, Anthropic is not permitted to train its models on the content we send, and it deletes that content from its systems within 30 days. We are not able to verify another company’s internal practices, and we pass along the commitment we have rather than a guarantee we cannot make.
We may use other AI providers for parts of the product that do not involve your case materials, such as generating the portraits and profiles of synthetic jurors. Those are built from public statistics and depict no real person. Any provider that handles case material is named in the list below.
Improving the product
We use your material to make CaseChorus work better, in two distinct ways.
Improving the service itself. Our people may review case materials, questions, and generated output to diagnose problems, test changes, measure output quality, and improve how the product works. This is hands-on: if a report comes out wrong, someone looks at the case that produced it. Access is limited to the people who need it, under confidentiality obligations, and it is used to improve CaseChorus for the firm whose material it is and for our other customers using the same product. We do not use it to build anything for anyone else, and we do not use one firm’s material to provide services to another firm.
De-identified and aggregated analysis. We may also create information that is not identifiable to you, your firm, or any individual, and use it more broadly: patterns across many cases, how panels respond to categories of argument, which parts of the product are working.
Where we do this, we commit to keeping that information de-identified. We will not attempt to re-identify it, we will not release it in a form that identifies anyone, and we require anyone who receives it from us to do the same.
We do not sell your material, we do not use it to train AI models, and we never combine one firm’s material with another firm’s in a way that would expose either.
We also use ordinary operational information about how the product runs, such as which features are used and how long requests take, to fix problems and prioritize what to build.
Who else touches your information
We name them. Each one is bound by contract to use what it receives only to provide its service to us.
| Company | What it does for us | What it receives |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage, sign-in, and our outgoing email | Everything the product stores |
| Anthropic | Generates juror responses and strategy reports | Case facts, full document text, and image exhibits, as described above |
| Google (reCAPTCHA) | Blocks automated attacks on our sign-in and password-reset pages | Technical signals from your browser, including your IP address. No case material |
| Google (Fonts) | Serves the fonts our pages use | Your IP address and browser type, when a page loads |
| Google Workspace | Our own company email | Internal notifications from the product, which can include a case name and a note you typed |
| U.S. Census Bureau | Public demographic statistics used to build synthetic juror pools | County and state codes only. No case material, no information about you |
| Google Drive, Dropbox | Optional import of your own files | Only if you choose to connect one. We receive the file you pick; nothing is sent back to them |
That is the current list, and we keep it current. We expect to add providers as the product grows, most likely analytics and error monitoring, and we may again use an image-generation provider to create juror portraits. We update this list before a new provider begins handling anything covered by this policy.
We will also disclose information if the law requires it, such as a subpoena or court order, and we will tell you first unless we are legally prohibited from doing so. We may also disclose information to protect our rights, investigate suspected misuse, or protect the safety of any person. Transfers in connection with a change in our business are covered at the end of this policy.
Each of these providers operates under its own published data processing terms, which apply to our account and restrict what they may do with what they receive. As the product matures we expect to put additional written agreements in place, and we will update this policy if what we share with anyone changes.
Where your information is stored
Everything we store sits in Amazon Web Services data centers in Ohio, in the United States. Our database, your uploaded files, our queues, our logs, and our sign-in system are all in that one region.
Your files and our database are encrypted while stored, using managed encryption keys that rotate automatically. Everything moving between your browser and us, and between us and our service providers, is encrypted in transit.
Our service providers are global companies. Some of them may process limited information outside the United States in the course of running their own services, and we do not control where they operate.
How long we keep things, and how deletion works
We keep your cases and files until you delete them or your firm leaves. There is no automatic expiry. If you want something gone, you have to delete it, or ask us to.
When you delete a case or a document in the product, we remove the record from our database and delete the stored file, including earlier stored versions of it.
When a firm asks us to delete everything, email us and we will do it. The account and database removal happens immediately; the stored files are purged over the following day or so, with a second sweep to catch anything written in between. Assume up to 48 hours.
After a full deletion, four things remain, and you should know about all four:
- Names and email addresses of the firm’s users. We keep these so the audit trail stays honest about who did what. No case content is attached to them.
- A short record that the firm’s account was deleted, including the firm name and the reason given.
- Backups. Our database backups roll on a 7-day cycle, so deleted data stays recoverable inside that window and then ages out. Our system logs and security logs are kept 30 days and 90 days, respectively.
- Technical and usage records. Technical and usage records described above are kept for 36 months and then deleted.
If you need those first two items removed as well, write to us and we will discuss what is possible.
We are building automated retention limits and self-service deletion for firms. Until those ship, deletion works as described above, by request and by hand. If your firm needs a specific retention schedule during the beta, ask us and we will work to it.
How we protect your information
Accounts are currently invitation-only. There is no public signup today, and we create every firm account ourselves; this may change as the product opens up. Each firm’s data is separated from every other firm’s at the database level, and that separation is enforced by the database itself, not only by the application.
Your files and our database are encrypted at rest. All traffic is encrypted in transit. Passwords are handled by Amazon Cognito and never reach our servers in readable form. Sessions expire after 30 minutes of inactivity. We keep an audit trail of significant actions inside your firm’s account, which your firm’s administrators can review.
No one at CaseChorus can read your case materials through the product. Our internal administrator role has no path to case content.
Our systems keep operational logs so we can find and fix problems. These are records of requests and errors, not copies of your files, but when something fails a log entry can occasionally include a fragment of generated text, a file name, or an email address. Logs are kept for 30 days and are accessible only to engineers who need them.
No method of storing or transmitting information is completely secure, and we do not claim otherwise. What we commit to is being specific about what we have built, honest about what we have not, and prompt in telling you if something goes wrong.
We are a beta product and we do not claim to be finished. We publish a current summary of our security practices, including what we have not yet built, at casechorus.com/security. We will answer any security questionnaire your firm sends us.
If a security incident affects your information, we will notify you and any affected individuals as the law requires, without unreasonable delay.
Cookies
We use one cookie. It is called casechorus.refresh, it keeps you signed in, it lasts 12 hours, and it cannot be read by any other website. We also store your sign-in tokens and a few interface preferences in your browser’s own storage, which clears when you close the tab or sign out.
That is all we use today. We currently set no analytics cookies, no advertising cookies, and no tracking cookies of any kind, on the product or on our website.
We may add measurement or analytics technology as the product develops. If we do, we will describe it here, and if any of it would count as selling or sharing your information under state privacy law, we will give you a clear way to opt out before it goes live.
Google reCAPTCHA sets its own cookies on our sign-in and password-reset pages, and Google Fonts sees your browser’s request when a page loads. Both are described above. If you connect Google Drive or Dropbox, those services set cookies during the connection.
We honor browser-based opt-out signals, including Global Privacy Control, where they apply to what we are doing at the time.
Your rights
Whatever state you live in, we will honor these. We are not going to make you prove residency first.
- Know what we hold about you and where it came from
- Get a copy of it, in a portable format
- Correct anything that is wrong
- Delete it
- Opt out of any sale or sharing of your personal information, or of profiling. We do not do any of these today
- Not be treated worse for exercising any of these rights. We will not charge you more, give you less, or cut off your access
California residents have all of these under the CCPA, and residents of Colorado, Connecticut, Virginia, Texas, and other states with privacy laws have their own versions. New York does not yet have a comprehensive privacy law, but New York residents get the same treatment from us.
How to exercise them. Email us at legal@casechorus.com. We confirm your request within 10 days and respond within 45 days. If we need longer we will tell you why, and take no more than another 45 days. There is no charge.
How we verify you. We reply to the email address on your account. If the request comes from somewhere else we may ask you to sign in, or ask for enough detail to be confident the request is yours. An authorized agent can act for you with written permission.
If we say no, we tell you why. Some states give you a right to appeal that decision. To appeal, reply to our response and write “appeal” in the subject. We will answer within 45 days. If you disagree with the outcome, you can complain to your state Attorney General.
Two things this section does not reach.
- First, information about you that lives inside a case file your firm uploaded, rather than in your account. We cannot separate you out of your firm’s case materials, and those are your firm’s to control.
- Second, if you are not one of our users and your information is in a file a law firm uploaded, we are not the right recipient for your request. Contact the law firm handling the matter. If you reach out to us anyway, we will tell you what we can and, where appropriate, pass the request to the firm.
We do not sell your information
We have never sold personal information, and we have never shared it for cross-context behavioral advertising. Those are the specific terms California uses, and we mean them in that sense. We do not do targeted advertising, and we do not use sensitive personal information to infer characteristics about anyone.
If this ever changes, we will say so here and give you a way to opt out before it takes effect.
We do not knowingly handle the personal information of anyone under 16 as our own users. Files a firm uploads may describe minors, and we treat that material the same way we treat everything else in a case file: on the firm’s instructions, for no purpose of our own.
Emails we send you
There are five, and none of them is marketing: an invitation when someone adds you to a firm, a temporary password when your account is created, a verification code when you set or change your email, a password reset link when you ask for one, and occasional messages about your account or this product.
We do not send newsletters or promotional email from the product, and we never email anyone named in a document you uploaded.
Children
CaseChorus is for legal professionals. You must be 18 to use it, and we do not knowingly create accounts for anyone younger.
Changes to this policy
CaseChorus is developing quickly, and this policy will change with it. When it does, we update the date at the top and post the new version here.
If a change is significant, particularly anything affecting how we handle your case materials, whether we sell or share information, or a new category of information we collect, we will tell you by email or in the product before it takes effect, and where the law requires your consent we will ask for it. Continuing to use CaseChorus after a change takes effect means the updated policy applies to you.
If our business changes hands
If CaseChorus is acquired, merges, reorganizes, or sells part of its business, information covered by this policy would transfer as part of that transaction, including during the diligence leading up to it, under confidentiality protections. The acquiring party would remain bound by this policy for information transferred until we give you notice of a different one. The same applies if we wind down or our assets are transferred in a bankruptcy or similar proceeding.
Contact us
Privacy questions, requests, or anything in this policy that is unclear: legal@casechorus.com
CaseChorus, Inc., a Delaware corporation. We operate entirely online, and email is the way to reach us about anything in this policy.
This policy works alongside our Beta Terms of Use and, for firms, our Data Processing Addendum.