Privacy Policy

1. Information We Collect

We collect information you provide directly to us when you create an account, subscribe to a plan, participate in investigations, upload evidence, or contact us. This includes:

• Account information — email address, display name, and profile details
• Payment information — processed securely by Stripe; we do not store credit card numbers
• Investigation content — evidence files, theories, comments, and case data you upload
• Usage data — pages visited, features used, and interactions with the Platform

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Platform
• Process subscriptions and creator payouts through Stripe
• Power the Toby AI assistant using third-party AI services
• Send account notifications and support messages
• Monitor for abuse, fraud, and terms violations
• Analyze usage trends to improve the Platform

3. Third-Party Services

We use the following third-party services to operate the Platform:

• Supabase — authentication and user account management
• Stripe — payment processing, subscription billing, and creator payouts. Stripe's privacy policy governs how payment data is handled.
• OpenAI — powers the Toby AI assistant. Case context and messages sent to Toby may be processed by OpenAI. We do not send personal account information to OpenAI.
• Supabase Storage — secure file storage for evidence uploads, encrypted at rest
• Vercel — hosting and content delivery

4. AI Usage and Data

The Toby AI assistant processes case-related messages to provide analysis and suggestions. When you use Toby, your messages and relevant case context are sent to our AI provider (OpenAI) for processing. We do not use your data to train AI models. AI responses are generated in real-time and are not stored by our AI provider beyond the processing session.

5. Information Sharing

We do not sell your personal information. We share information only as described above with our service providers, or when required by law, legal process, or to protect the rights and safety of our users and the public.

6. Data Security

We implement industry-standard security measures to protect your information. Evidence files are encrypted at rest. Payment information is handled entirely by Stripe and never touches our servers. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal information within 30 days. Evidence files uploaded to cases may be retained if other users have contributed to the investigation, but your personal attribution will be anonymized.

8. Your Rights

You have the right to access, update, or delete your personal information at any time through your account settings. Detectives may export their case data and subscriber information. You may also request a complete copy of your data or request deletion by contacting us.

9. Cookies and Tracking

We use essential cookies for authentication and session management. We do not use third-party advertising trackers. Analytics data is collected in aggregate to improve the Platform and is not tied to individual users.

10. Children's Privacy

Coldcase is not intended for users under 18 years of age. We do not knowingly collect information from children. If we learn we have collected information from a child under 18, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Platform. Your continued use after changes take effect constitutes acceptance.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at privacy@coldcasebureau.com.

Coldcase is operated by Nerdbeak, Inc.