Privacy policy
This policy covers two things: the public website at policepen.com, and the Policepen application (web app at the app domain and the Policepen iPhone app) used by law enforcement agencies and prosecutor offices.
1. The website (policepen.com)
What we collect
- If you use the contact form: your name, rank, agency, email, phone, the agency's sworn officer count, and your message. We use it only to reply to you and to discuss Policepen with your agency.
- Our host, Cloudflare, receives your IP address and browser details as part of serving the page.
- The site loads fonts from Google Fonts, so your browser sends your IP address and browser details to Google.
What we do not do
- No analytics, no advertising, no tracking pixels, and no cookies on the website.
- We do not sell or share your information for advertising.
Where it goes
Contact form entries are recorded in Cloudflare's logs for our site and are read by us. If you email [email protected], your message is stored by our email host, PurelyMail. Please do not send case information or criminal justice information by email or through the contact form.
2. The application
Whose data it is
An agency (or prosecutor office) that subscribes to Policepen owns the case records its people create, including reports, facts, recordings, transcripts, photos and documents. We process that information only on the agency's instructions under our agreement with it (the Master Subscription Agreement and Data Processing Addendum) and the FBI CJIS Security Policy. Questions or requests about case records, including public records requests and discovery, go to the agency, not to us.
Account information we hold about users
- Work email, agency and roles, provided by the agency. Name and badge number will be added when user profiles are built.
- Password (stored only as a one-way hash) and the encrypted multi-factor authentication seed.
- Sign-in history: time, IP address and device description of each session.
- For the iPhone app: a device record (platform, label, whether it is enrolled in the agency's device management). A push notification token will be stored once push notifications are built.
- An audit record of actions taken in the application (who, what, when, from where), which the CJIS Security Policy requires.
How we use it
To sign users in, keep accounts secure, enforce the agency's permissions, send account and work notifications, keep the required audit trail, support the agency, and bill the agency. Bills are based on the number of active users, not on what they do.
AI processing
Dictated audio is transcribed by Amazon Transcribe, and transcripts are processed by Anthropic Claude models through Amazon Bedrock in the United States to propose facts and draft text for the officer to check. Agency data is never used to train AI models. See our AI Use and Human Review Policy.
Dictated recordings
Dictated recordings are part of the agency's case record. They are kept with the report under the agency's retention schedule and may be produced in discovery.
Cookies in the application
One session cookie that is needed to keep you signed in. No analytics or advertising cookies.
Push notifications
Push notifications say only that you have an update. They never contain case content.
Who else receives data
Only the service providers listed in our Subprocessors list (mainly Amazon Web Services in the United States). All application data is stored in the United States. We do not sell personal information and do not use it for advertising.
How long we keep it
Case records follow the agency's retention schedule and any legal holds. Account records are kept while the agency is a customer and then returned or disposed of with the agency's records. Audit records are kept at least one year and longer where the agency's schedule requires.
Security
Encryption in transit and at rest, per-agency encryption keys, multi-factor authentication for every user, and the controls described in our Security Overview.
3. Your choices
- Website visitors may ask us to delete contact form information by emailing [email protected].
- Application users should contact their agency to correct or access their information; we will help the agency respond.
- The application and website are not meant for children under 13, and we do not knowingly collect their information.
4. Breaches
If a breach affects personal information, we notify the affected agency right away under our agreement and the CJIS Security Policy, and we support notices required by New Jersey law (N.J.S.A. 56:8-161 to 56:8-166).
5. Changes
We will post changes here with a new effective date and tell subscribing agencies before material changes take effect.