Back to the site

Privacy Policy

Last updated: September 15, 2026

Short version: we collect only what is needed to check your case and reach you. We never sell your data. You can delete all of it, and this page says exactly how and how fast.

CaseCheck is operated by Immigrant App Inc, 848 Brickell Ave, Suite 800, Miami, FL 33131, United States. Questions about this document: [email protected].

What CaseCheck does

CaseCheck looks up the status of U.S. immigration cases and alerts you when it changes. For immigration court cases it reads the public EOIR case information system. For USCIS cases it reads the USCIS Case Status API. CaseCheck is an independent service. It is not a government service and it does not give legal advice.

What we collect

• Your email address — it is your login and the main place we write to.
• Your password, stored only as a scrypt hash. We cannot read it, and neither can anyone who steals the database.
• Court case details you enter: the nine-digit A-Number and country of citizenship.
• USCIS receipt numbers you enter to check or watch a USCIS case (13 characters, for example IOE0123456789). USCIS treats receipt numbers as personally identifiable information (PII), and so do we. See the section USCIS receipt numbers below.
• What the government publishes about those cases: hearing date, court, decision, case status, and the history of changes.
• Channel identifiers you connect: Telegram id and username, WhatsApp number, phone number for text messages.
• Payment facts: the plan you bought and the date. Card numbers go to Stripe. We never see them.
• Technical records: sign-in times, the browser string of a session, and server logs kept for security.

We do not collect location data, bank or card details, medical information, your contacts, documents, photographs, immigration files, or family details. Do not send them to us.

Why we use it

For one purpose: to look up the cases you asked about, watch them, and tell you when they change. Email is also used for sign-in codes and account notices. Payment facts keep your subscription current. We do not use your data for advertising, and we do not build marketing profiles.

USCIS receipt numbers

A USCIS receipt number identifies a real immigration case, so we treat it as personal information from the moment you type it in.

• How we use it. Our server sends the receipt number to the USCIS Case Status API for one purpose only: to get the current status and status history of that case, show it to you, and alert you when it changes. We use receipt numbers for nothing else.
• Where it is stored. If you only check a case once, the number is used for that single request and is not saved. If you add the case to your account for monitoring, the receipt number is stored in our database together with the status USCIS returned, for as long as the case stays in your account. The database is not reachable from the internet. Only the CaseCheck service can read it.
• How it is protected. Traffic between your browser, our server, and USCIS is encrypted (HTTPS). Our USCIS API credentials stay on the server and are never sent to the browser. Receipt numbers are masked in server logs. A stored receipt number is visible only to the account that added it and to the Immigrant App Inc staff who need access to run the service.
• Who receives it. Only USCIS, as part of the status query. We do not sell receipt numbers, share them with advertisers or other third parties, or use them to build profiles. We disclose them only when the law requires it.
• Deleting it. Remove the case from your account and the receipt number and its history are deleted at once. Deleting your account deletes all of them.

Who receives your data

• Railway — hosts the site and the database. It handles your data only as our hosting provider.
• Resend — sends our email (sign-in codes, alerts). It sees your email address and the message we send.
• Stripe — processes payments. Card details go to Stripe directly. We receive only the fact of payment and the plan.
• Telegram, WhatsApp (Meta), and the SMS carrier — only if you connect that channel, and only to deliver our messages to you.
• EOIR and USCIS — receive the case number when we look up a case. They receive nothing else about you.

These providers process your data only on our instructions and only to run the service. Each one is bound by a contract that requires protection at least as strong as this policy. They may not use or disclose your data for their own purposes, in any form, without your active consent. We do not share de-identified, anonymized, or pseudonymized data with anyone either.

We do not sell your data

We do not sell personal data, and we do not trade it for money or anything else of value. Not to advertisers, data brokers, partners, or anyone else. We disclose data only when the law requires it, for example under a valid court order, and we tell you about it when the law allows us to.

Your choices about sharing

Everything beyond your email address is your choice. Connecting Telegram, WhatsApp, or text messages is optional. The benefit: alerts arrive where you already look. The risk: those messages travel through that platform and appear on every device signed in to it, so anyone with access to that device or account can read them. The limit: we cannot guarantee delivery on networks we do not control. You can disconnect a channel at any time in your account.

A case may concern another person. Add only cases that are yours or that you are authorized to follow. If you add someone else's case, you are responsible for having their permission, because alerts about their case will reach you.

Cookies and local storage

One cookie holds your signed-in session. Without it you could not stay logged in. Your language choice is a cookie. The light or dark theme is stored in your browser only. There are no advertising or tracking cookies on this site.

How long we keep it

• Account and case data — as long as your account exists.
• Dormant accounts — if you do not sign in for 24 months, we email you a warning. If you still do not sign in within 30 days, we delete the account and every case in it.
• Sign-in codes — 10 minutes. Session records — 30 days. Server logs — 90 days.
• Support messages — 12 months after the last reply, so we can follow up.
• Payment records — as long as accounting law requires, without case details attached.

Deleting your data and closing your account

• One case. Remove it inside your account. The case, its numbers, and its history are deleted immediately.
• Your whole account. Write to [email protected] from the address on your account, or use the Support page inside your account. We confirm within 2 business days and delete the account and all its cases within 30 days. Copies in backups are gone within 90 days. Deleted data cannot be recovered.
• Closing your account means the same thing: everything is deleted on the same schedule. Payment records stay only where accounting law requires, without case details.

If there is a data breach

If we learn that your data was accessed or disclosed without authorization, we will email you without undue delay, and no later than 72 hours after we confirm the breach. The email will say what happened, which data was involved, what we have done, and what you can do, for example change your password or watch for suspicious messages. We will also notify the authorities where the law requires it.

If CaseCheck changes hands

If Immigrant App Inc is sold, merges with another company, or closes, we will email you at least 30 days before your data moves anywhere. A new owner must follow this policy or one that protects you at least as well. If that is not the case, you get the choice to download your data or delete it before the transfer. If the service closes for good, we delete all user data, except payment records that the law requires us to keep.

Changes to this policy

When we change this policy in a meaningful way, we do not treat silence as agreement. We show you a plain-language summary of what changed and ask you to accept it before you continue using your account. Until you accept, your account keeps working under the old version for 30 days, and you can delete it instead. Small edits, such as fixing a typo or a contact detail, only get a new date at the top of this page.

California residents (CCPA)

If you live in California, you have the right to know what personal information we collect and how we use it, to correct it, to have it deleted, and to not be treated differently for using these rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of. To use these rights, email [email protected] from your account address. We answer within 45 days. An authorized agent can act for you with your written permission.

Security

Traffic is encrypted in transit. Passwords are hashed with a salt. Sessions are signed cookies that a browser script cannot read. Sign-in always asks for a code from your email, so a leaked password alone is not enough to get in. Case numbers and receipt numbers are masked in logs. Access to the database is limited to the service itself and to the staff who need it to run the service.

Children

The service is for adults. If a case concerns a minor, an adult must hold the account.

Contact

Questions about your data: [email protected].