Privacy Policy

Librae: Legal Demand Letters Effective Date: May 1, 2026 Last Updated: May 1, 2026

Privacy Policy URL: https://libraelegal.com/privacy Contact: support@libraelegal.com

1. Introduction

Librae (“Librae,” “we,” “us,” or “our”) operates the Librae: Legal Demand Letters iOS application (the “App”) and the website at libraelegal.com (the “Site”). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have with respect to your data.

This Privacy Policy applies to:

  • The Librae iOS application
  • The libraelegal.com website

This Privacy Policy does not apply to:

  • Third-party services linked from within the App (each governed by their own privacy policies)
  • Any legal proceedings or advice you pursue independently after using Librae

Please read this Privacy Policy carefully. By creating an account or using the App, you acknowledge that you have read and understood this policy. If you do not agree, do not use the App.

2. Who We Are

Librae is operated by Elias Ahmadi, an individual developer based in the United States. We are the data controller for personal information collected through the App. Questions about this Privacy Policy may be directed to support@libraelegal.com.

3. Information We Collect

3.1 Account Information

When you create a Librae account, we collect:

  • Email address — used for authentication via one-time passcode (magic link). Your email is stored in our database and used to identify your account.
  • User identifier — a unique ID automatically generated by our authentication system. You do not choose this identifier; it is assigned to you when you create an account.
  • Authentication tokens — temporary session tokens used to keep you logged in. These are stored in encrypted storage on your device (iOS Secure Enclave/Keychain equivalent via Expo SecureStore) and are not retained on our servers after use.

3.2 Profile and Subscription Data

We maintain a profile record associated with your account that includes:

  • Email address
  • Subscription tier (free or Claim Premium)
  • Subscription status (active, cancelled, expired, or grace period)
  • Subscription expiration date
  • Credit balance (number of purchased letter credits remaining)
  • Your RevenueCat customer identifier (used to manage subscriptions)
  • Timestamps recording when you accepted required disclosures (including the FCRA/CROA disclosure required before generating credit dispute letters)
  • Account creation and last-updated timestamps
  • Push notification token (stored only if you grant notification permission; see Section 3.5)

3.3 Dispute Intake Data

This is the most sensitive information we process. When you use the App to generate a demand letter, you provide facts about your dispute through an intake form. The specific fields vary by the type of dispute you are addressing:

  • Credit report disputes (FCRA): Credit bureau names, account in dispute, nature of the error, furnisher name and address, description of the inaccuracy
  • Debt collector harassment (FDCPA): Collector name and address, nature of the violation, debt amount, original creditor name, dates of violations
  • Unauthorized charges: Company name, subscription details, charge amounts, dates, cancellation attempts
  • Airline and travel claims: Airline name, flight number, travel date, nature of the claim, compensation sought
  • Wage theft and unpaid wages: Employer name and address, type of violation, wages owed, pay period, dates
  • Security deposit disputes: Rental property address, landlord name and address, deposit amount, move-out date, landlord’s stated reason for withholding
  • Warranty and defective product claims: Product name, manufacturer, purchase date, defect description, remedy sought

This intake data is stored in our database associated with your account and letter session. It is also transmitted to Anthropic’s Claude API to generate your letter — see Section 5 (Third-Party Data Sharing) for full details.

3.4 Generated Letter Data

We store the letters generated for you, including:

  • The full text of each generated letter
  • The PDF file of each completed letter (stored in our file storage system)
  • Metadata about each letter: the scenario type, dispute round number, jurisdiction, billing classification, and generation status

This data is retained so you can access your previously generated letters within the App.

3.5 Push Notification Data

If you grant notification permission on your iOS device, we store your device’s push notification token so we can notify you when letter generation is complete. We do not store the content of delivered notifications after delivery. You can revoke push notification permission at any time in your iOS device Settings, at which point we stop using your token.

3.6 Transaction Data

We maintain records of credit transactions associated with your account, including purchases and usage of letter credits. These records include a reference identifier from RevenueCat for payment validation purposes.

3.7 Information We Do Not Collect

  • We do not collect your full payment card number, bank account information, or any financial credentials. All payment processing is handled exclusively by Apple’s App Store infrastructure.
  • We do not collect precise geolocation data.
  • We do not use advertising SDKs, tracking pixels, or behavioral tracking tools.
  • We do not collect data from your contacts, camera, or microphone.
  • The App does not use cookies. Authentication state is stored locally on your device in encrypted storage.

3.8 Website (libraelegal.com)

The libraelegal.com website is hosted on GitHub Pages. GitHub Pages may set minimal technical cookies as part of its hosting infrastructure; we do not control these. We do not operate analytics, advertising, or tracking tools on the website at this time. If we add analytics in the future, we will update this Privacy Policy and implement appropriate consent mechanisms.

4. How We Use Your Information

We use the information we collect for the following purposes:

Purpose Data Used Legal Basis
Providing the App and generating demand letters All intake data, account data Performance of contract with you
Authentication and account security Email, authentication tokens Performance of contract; legitimate interests
Processing subscriptions and credits Subscription data, RevenueCat ID Performance of contract
Delivering push notifications Push token Consent (you grant permission explicitly)
Complying with CROA §1679c (FCRA Round 1 always free) FCRA disclosure timestamp Legal obligation
Communicating with you about your account Email Legitimate interests; performance of contract
Error tracking and service reliability Server-side error data (no PII intentionally included) Legitimate interests
API performance monitoring Request metadata (no PII or letter content) Legitimate interests

We do not use your intake data or generated letters for any purpose other than generating your requested letter and storing it for your access. We do not use your personal information to train AI models.

5. Third-Party Data Sharing

We share your information with the following third-party service providers. We do not sell your personal information. We do not share your personal information with advertisers.

5.1 Supabase

Role: Primary database, authentication, and file storage infrastructure. Data received: All account data, profile data, intake data, letter data, and transaction data described in Section 3. Infrastructure: Amazon Web Services, us-east-1 (Northern Virginia, USA). Privacy policy: https://supabase.com/privacy

5.2 Anthropic (Claude API)

Role: AI-powered letter generation — the core functionality of the App. Data received: Your dispute intake data (the facts you provide about your dispute, including names, addresses, dates, and amounts). This data is transmitted to Anthropic’s Claude API to generate your demand letter. What Anthropic does NOT receive: Your email address, payment information, or account credentials. Important: Anthropic’s API usage policies provide that API inputs are not used to train Anthropic’s models by default. For current details on Anthropic’s data handling, please review Anthropic’s privacy policy. Privacy policy: https://www.anthropic.com/privacy

5.3 RevenueCat

Role: Subscription and in-app purchase management. Data received: Your account identifier (UUID), Apple App Store purchase receipts, subscription event data, and product identifiers. What RevenueCat does NOT receive: Your email address, letter content, or intake data. Privacy policy: https://www.revenuecat.com/privacy

5.4 Apple Inc.

Role: App distribution and in-app purchase payment processing. Data received: Standard App Store data per Apple’s developer agreement, including payment processing for subscriptions and credits, and device identifiers as governed by Apple’s privacy framework. Privacy policy: https://www.apple.com/privacy

5.5 Resend

Role: Transactional email delivery. Data received: Your email address and your generated letter as a PDF attachment. When triggered: Only when you explicitly tap “Email Letter” within the App. Resend does not receive your email address unless you take this action. Privacy policy: https://resend.com/privacy

5.6 Upstash (Redis)

Role: Legal knowledge base caching and API rate limiting. Data received: Cache keys based on scenario type and jurisdiction (no personally identifiable information), and rate limit counters keyed by account identifier or IP address. What Upstash does NOT receive: Letter content, intake data, or email addresses. Privacy policy: https://upstash.com/privacy

5.7 Expo / Expo Push Notification Service

Role: Push notification delivery for letter generation status. Data received: Your device push token and notification payload (letter generation status — no letter content is included in notification payloads). Privacy policy: https://expo.dev/privacy

5.8 Sentry

Role: Server-side error tracking and crash reporting. Data received: Error messages, stack traces, request metadata, app version, and server identifiers. Sentry is configured with sendDefaultPii: false — we do not intentionally transmit personally identifiable information to Sentry. In limited cases, error messages may incidentally contain fragments of data being processed at the time an error occurs. Privacy policy: https://sentry.io/privacy

5.9 Datadog

Role: Server-side API performance monitoring. Data received: Request traces (URL paths, response times, HTTP status codes), trace identifiers, and service metadata. Datadog does not receive request bodies, user personal information, or letter content. Privacy policy: https://www.datadoghq.com/privacy

5.10 Lob (Certified Mail — Disabled at Launch)

Role: Certified mail delivery of generated letters. Current status: This feature is disabled at launch and is planned for a future update. All certified mail requests currently return an error. Data that will be shared when enabled: When this feature is activated in a future update, Lob will receive the recipient’s name and mailing address, your return address, and your generated letter as a PDF. We will update this Privacy Policy before enabling the feature. Privacy policy: https://lob.com/privacy

6. Data Retention

We retain your personal information for as long as your account is active. If you delete your account, all of your personal information is permanently deleted from our systems as described in Section 8. We do not retain personal information after account deletion except where required by applicable law.

Server-side error logs (Sentry) and performance monitoring data (Datadog) are subject to those services’ respective retention policies, which may result in limited technical metadata being retained beyond account deletion.

7. Security

We implement industry-standard security measures to protect your information:

  • Encryption in transit: All data transmitted between the App and our servers uses TLS encryption.
  • Encryption at rest: Your authentication tokens are stored in encrypted iOS secure storage (Expo SecureStore). Our database employs encryption at rest.
  • Row-level security: Our database enforces row-level security policies ensuring that each user can only access their own data.
  • Authentication: We use one-time passcode (magic link) authentication — no passwords are stored.

No security system is impenetrable. We cannot guarantee absolute security of your information. If you have reason to believe your account has been compromised, contact us immediately at support@libraelegal.com.

8. Your Rights and Choices

8.1 Account Deletion

You have the right to delete your account at any time. You may do so:

  • Within the App: Navigate to Settings and select “Delete Account.”
  • By email: Send a deletion request to support@libraelegal.com with the subject line “Account Deletion Request.”

When you delete your account, all of your personal information is permanently and irreversibly deleted from our systems, including:

  • Your account and profile data
  • All dispute intake data
  • All generated letter text and PDF files
  • All transaction records

This deletion is permanent. We cannot recover deleted data. We will complete deletion requests within 30 days of receipt.

8.2 Push Notification Opt-Out

You can disable push notifications at any time in your iOS device Settings under Notifications > Librae. We will stop sending notifications and stop using your push token.

8.3 Access to Your Data

You may contact us at support@libraelegal.com to request a copy of the personal information we hold about you.

8.4 Correction of Inaccurate Data

If you believe we hold inaccurate information about you, contact us at support@libraelegal.com.

9. California Privacy Rights (CCPA)

This section applies to California residents and supplements the rest of this Privacy Policy.

9.1 Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information as defined by the CCPA:

  • Identifiers: Email address, account UUID, device identifiers
  • Personal records information: Dispute intake data (which may include financial account details, employer information, and landlord information you voluntarily provide)
  • Commercial information: Subscription status, credit balance, transaction records
  • Inferences: None — we do not build consumer profiles or make inferences from your data

9.2 Sale of Personal Information

We do not sell your personal information. We have not sold personal information in the past 12 months. Because we do not sell personal information, there is no opt-out required — but California residents may contact us at support@libraelegal.com to confirm this.

9.3 Your California Rights

California residents have the right to:

  • Know what personal information we collect about you, the purposes for collection, and the categories of third parties with whom we share it
  • Delete your personal information (subject to certain exceptions) — see Section 8.1
  • Correct inaccurate personal information
  • Non-discrimination — we will not discriminate against you for exercising your privacy rights

To exercise your rights, contact us at support@libraelegal.com. We may ask you to verify your identity before processing your request.

10. Children’s Privacy

Librae is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. Use of Librae requires creating an account, which requires being at least 18 years of age (or the age of majority in your state). If we learn that we have inadvertently collected personal information from a child under 13, we will delete that information promptly. If you believe we may have such information, contact us at support@libraelegal.com.

11. Geographic Scope

Librae is available to United States residents only. The App is not intended for use by individuals located outside the United States. We do not knowingly collect information from users located outside the United States.

12. AI-Generated Content

All demand letters generated by Librae are created using artificial intelligence — specifically, Anthropic’s Claude large language model. You acknowledge and understand that:

  • Letters are generated by an AI system, not by a licensed attorney
  • AI-generated content may contain errors, omissions, or inaccuracies
  • The accuracy and effectiveness of generated letters depends on the facts you provide and the specific circumstances of your dispute
  • Librae does not guarantee any particular outcome from use of a generated letter

Librae is not a law firm and does not provide legal advice. Use of the App does not create an attorney-client relationship.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date at the top of this policy and notify you by email or through the App. Your continued use of the App after such notification constitutes your acceptance of the updated policy. We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

Email: support@libraelegal.com Website: https://libraelegal.com/support

We will respond to all privacy inquiries within 30 days.