Privacy Policy

1Who we are

This Privacy Policy applies to the CaseStep app for iPhone and Android (“CaseStep” or “the app”) and to this website. CaseStep is operated by D&B Evergreen Adventure LLC (“we”, “our” or “us”), a company registered in the State of Washington, USA. By using CaseStep, you agree to this policy.

CaseStep is built to know as little about your case as it can. Where this policy says something stays on your phone, it never reaches us.

2Information we collect

2.1 Your account

CaseStep asks you to sign in with Apple or Google, so every case check is tied to a real account. Sign-in goes through Google Firebase Authentication, which keeps:

• an account ID that Firebase creates for you
• your email address. With Sign in with Apple you can choose Hide My Email, and we receive a private relay address instead
• your name, if Apple or Google shares it, and the basic profile details Google shares (such as a profile photo link)

We never see your Apple or Google password.

2.2 The cases you add

For each case, you can enter:

• the receipt number (for example IOE1234567890)
• a nickname, if you give it one
• a priority date, only when you confirm or enter one
• the form category and USCIS office you pick for processing times

CaseStep also saves what it learns about each case: the status history (as status codes and dates), the form type, the date USCIS received the case, when it last checked and whether you’ve seen the latest update. All of this is saved on your phone, separately for each account you sign in with. It leaves your phone only as this policy describes.

2.3 Case status from USCIS

When CaseStep checks a case, the app sends the receipt number to our server inside the request (never in a web address). Our server asks the USCIS Case Status API and passes USCIS’s reply back to your phone: the status, its description, the form type and dates. We don’t send USCIS your name, email address or account ID. USCIS’s own privacy policy covers the information USCIS holds about your case.

2.4 Usage analytics (you can turn this off)

While Share usage analytics is on (it is until you turn it off in Settings → Privacy & security), the app sends anonymous usage events to Google Firebase Analytics: which screens you open, actions such as adding a case or turning on backup, and settings such as language and appearance. Firebase also records the app version, device model, operating system, an approximate location worked out from your IP address, and a random ID for this installation of the app.

Analytics never include receipt numbers, nicknames, statuses, form types, dates, your name or your email address, and we don’t link analytics to your account. CaseStep doesn’t use an advertising ID on iPhone or Android.

2.5 Crash reports

If the app crashes or hits a serious error, it sends a report to Google Firebase Crashlytics: technical details about the error, the app version, device model, operating system and the state of the device (such as free memory), and your account ID, so we can tell whether one account keeps running into the same problem. Receipt numbers and email addresses are removed from error messages before they’re sent, and crash reports never include your cases.

2.6 App checks

To make sure requests come from the real CaseStep app on a real device, the app uses Firebase App Check, with Apple App Attest on iPhone and Google Play Integrity on Android. These checks confirm the app hasn’t been tampered with. They don’t give us personal information.

2.7 What our server receives

Like any internet service, our server receives your IP address and basic request details, such as the app’s language, with each request. We use them to answer the request and to slow down abusive traffic.

2.8 Feedback you send

Send feedback opens an email draft in your own mail app. The draft lists your app version, operating system, device model, language and appearance setting, so we can help. It never includes your cases or account. You decide what to write and whether to send it. When you write to us, we receive your email address and your message.

2.9 What we don’t collect

• Your precise location, contacts, photos, camera or microphone
• Your Apple or Google password
• Face ID, Touch ID or fingerprint data. App lock uses your phone’s own unlock, and the app only learns whether it succeeded
• An advertising ID, or anything that tracks you across other companies’ apps and websites
• Payment information. CaseStep has no purchases

3How we use it

• Check your cases with USCIS and show their status and history
• Tell you on your phone when a case changes, when a case can ask USCIS about a delay, and when a new Visa Bulletin is out (you choose which)
• Back up your cases and restore them on a new phone, if you turn on backup
• Show the Visa Bulletin and USCIS processing times, and work out each case’s inquiry date on your phone
• Keep CaseStep secure and within the limits USCIS sets for its Case Status API
• Find and fix crashes, and understand which features people use
• Answer your messages
• Meet our legal obligations

We don’t use your information for advertising, we don’t sell it and we don’t build profiles about you.

Legal bases (EEA and UK). We use your information to provide the app you asked for (sign-in, case checks, notifications), with your choice for backup, and for our legitimate interests in keeping CaseStep secure, fixing problems and understanding how it’s used (server logs, crash reports and analytics, which you can turn off).

4Where it’s stored

4.1 On your phone

Your cases and settings are saved in the app’s private storage on your phone, separately for each account. If your phone’s own backup is on (iCloud Backup or Android backup), it may include this storage; Apple’s or Google’s terms cover that backup. Signing out hides an account’s cases, and signing back in with the same account shows them again. Deleting the app deletes them from the phone.

4.2 Backup to your account (optional)

Backup is off unless you turn it on, either when CaseStep offers it after your first case or in Settings → Privacy & security. While it’s on, CaseStep keeps a copy of your cases in Google Cloud Firestore in the United States, which only your signed-in account can read:

• receipt numbers, nicknames and when each case was added and last changed
• priority dates you confirmed or entered, and where each one came from
• the form category and office you picked for processing times
• the status history, as status codes and dates; short codes for the latest status CaseStep found and told you about; and, for a new receipt, when USCIS first couldn’t find it

The backup never holds status text, the form type or the date USCIS received the case. Turning backup off deletes the backup right away. Your cases stay on your phone.

4.3 On our server

CaseStep’s server runs on Cloudflare. It keeps:

• a short-lived copy of USCIS’s reply for each receipt number, so it can answer quickly and stay within USCIS’s limits. It’s stored under a scrambled key (a one-way hash of the receipt number), with the receipt number removed from the text, and expires within 7 days
• usage counters for each account, also under a scrambled key, deleted 48 hours after your last request
• status titles and history sentences that CaseStep doesn’t recognize yet, so we can add them to the app. We keep only the general English wording, with receipt numbers and form types removed, and never anything with a long run of digits, a status description or an account
• request logs for up to 7 days. They record that a request happened and how USCIS answered, and may include the IP address it came from. They never include receipt numbers, account IDs or sign-in tokens

Our server never stores a readable receipt number or your account ID.

4.4 Visa Bulletin and processing times

The Visa Bulletin and processing times come from public pages of the U.S. Department of State and USCIS. We publish them on our own data server, and the app downloads them from there. These downloads carry nothing about you beyond what every internet request carries, such as your IP address. The app works out case inquiry dates on your phone.

5Notifications

CaseStep checks your cases from your phone, in the background every few hours and whenever you open the app, and creates its notifications on your phone. It doesn’t use a push service, so we hold no notification token for your device.

Notifications are private by default (“One of your cases has a new status”). If you turn on Show case details, they show the case’s nickname and new status title. They never show a receipt number. You can turn each kind of notification on or off in Settings → Notifications, or turn them all off in your phone’s settings.

6Who receives it

We share information only with the organizations that run parts of CaseStep, and only what each one needs:

Each of them handles information under its own terms and privacy policy. We may also share information when the law requires it; to protect the rights, safety or property of our users, us or others; or as part of a merger or sale of our business, in which case this policy keeps applying to your information.

We don’t sell or rent personal information, and we don’t share it for targeted advertising.

7How long we keep it

8Your choices and rights

8.1 In the app

• Remove a case at any time. It’s deleted from your phone and from your backup, if it’s on
• Back up cases to my account: turn it on or off in Settings → Privacy & security
• Share usage analytics: turn it off in the same place
• Notifications and Show case details: Settings → Notifications
• App lock: require Face ID or your fingerprint to open CaseStep

8.2 Deleting your account

Go to Settings → Delete account. After you confirm and sign in once more, CaseStep deletes your backup, removes CaseStep’s access to your Apple and Google sign-in, deletes your account and removes the account’s cases from that phone.

If you can’t open the app, email support@casestep.app from the email address on your account, with the subject “Delete my account”, and we’ll delete your account and backup within 30 days. Delete your account has the steps and the full list of what’s deleted.

A few things can’t be deleted on request and expire on their own instead: crash reports, which carry your account ID, after about 90 days; analytics, which aren’t linked to your account, under Google’s retention; and our server’s cached replies and counters within 7 days and 48 hours. None of them holds a readable receipt number.

8.3 Your privacy rights

Depending on where you live (for example California or another U.S. state, the European Economic Area or the United Kingdom), you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to object to or restrict some uses of it. Most of your information is on your phone, where you can see and change it in the app. For anything else, email privacy@casestep.app.

We’ll confirm the request comes from you, usually by replying to the email address on your account, and answer within 30 days. We won’t treat you differently for using these rights. In the EEA or UK, you can also complain to your local data protection authority.

9Security

• Everything the app sends travels over encrypted connections (HTTPS)
• Our USCIS credentials exist only on our server, never in the app
• Every case check needs a signed-in account and a genuine copy of the app
• Your backup can be read only by your signed-in account
• Our server stores scrambled keys, never readable receipt numbers or account IDs
• App lock and the app-switcher cover keep your cases private on a shared phone

No system is perfectly secure. If we learn of a breach that affects your information, we’ll tell you as the law requires.

10Children

CaseStep is not meant for children under 13, and we don’t knowingly collect personal information from them. If you believe a child under 13 has given us information, email privacy@casestep.app and we’ll delete it.

11Users outside the United States

CaseStep is for people with cases before USCIS, a U.S. government agency. We’re based in the United States, and your information is processed there: the backup is stored in the United States, and our server may handle your requests in a Cloudflare data center near you. By using CaseStep, you understand that your information is transferred to the United States, where privacy laws may differ from those where you live.

12This website

This website has no accounts, cookies, analytics or ads. If you pick Light or Dark appearance, your choice is saved in your browser’s local storage and never sent to us. The site loads its fonts from Google Fonts, so Google receives your IP address and browser details, and our hosting provider may keep standard request logs.

13Changes to this policy

We may update this policy as CaseStep changes. We’ll post the new version here with a new “Last updated” date. If a change matters, for example a new kind of information, we’ll tell you in the app or on this website before it applies. Using CaseStep after a change takes effect means you accept the updated policy.

14Not legal advice

CaseStep provides information only and does not provide legal advice. We can’t guarantee that information from USCIS or the Department of State is accurate, complete or current. Always check important information with USCIS at uscis.gov, and for legal guidance, talk to a licensed immigration attorney or an accredited representative. Our Terms of Service say more.

15Contact us

Questions about this policy or your information:

Company

D&B Evergreen Adventure LLC

Registered in

Washington, USA

Product

CaseStep

Privacy

privacy@casestep.app

Support

support@casestep.app

D&B Evergreen Adventure LLC is responsible for your personal information and for this policy.