Law-enforcement guidelines
How EZ Software Labs answers requests for information about EZFinder accounts, and what we can and cannot provide.
Draft: counsel reviews every statement on this page before EZFinder is available to the public.
The short answer
We cannot provide anyone's location, now or in the past. Locations, places, alerts and circle names are encrypted on people's phones with keys only the phones in their circles hold. We hold ciphertext we cannot decrypt, and no feature, key or process exists to change that for one account.
We cannot search by area either: no request can ask who was near a place, because the places and positions we store are encrypted end to end.
What we hold
| Information | Notes |
|---|---|
| Account: name, email, phone number if given, month and year of birth, country, date created | Encrypted in our database, readable by the service |
| Devices: model, system, app version, when enrolled, when last seen | Last seen is a time, not a place |
| Circle memberships: which accounts share a circle, since when, and their roles | Circle names are encrypted and unreadable |
| Subscription status, as the App Store or Google Play reports it | No card or payment details: the stores hold those |
| The encrypted data itself, for its retention period | Kept 1, 14 or 30 days by the circle's plan. Unreadable by us or anyone without a member's phone |
| Audit entries: what our staff did with an account |
What each kind of process can reach
- Subpoena
- Basic subscriber information: name, email, phone, when the account was created, and its plan.
- Court order, 18 U.S.C. §2703(d)
- Other records: devices, and circle memberships and roles.
- Search warrant
- The encrypted data we store, exactly as stored. We cannot decrypt it.
- Preservation request
- We keep what we hold for 90 days, renewable once for 90 more (18 U.S.C. §2703(f)).
- Any process
- Never a readable location, and never a search by area.
State law can require more, as Texas does for warrants for stored electronic data.
How to submit a request
- 1Register in the portalSign up with your official agency email and set up a passkey. We confirm you by calling your agency on a number we find ourselves, never one from your application.
- 2Upload the signed legal processOne PDF, naming each account by its email address or phone number. A name alone is not enough to find an account.
- 3We review itAutomated checks first, then a person on our team. We email you when there is an update; the email never contains the data.
- 4Download in the portalFor 30 days, with a signed record of what was produced and a declaration of authenticity.
Emergencies
If someone faces an imminent danger of death or serious physical injury, submit an emergency request in the portal. We may disclose what we hold without legal process, to the extent the law allows. It still cannot include a location.
Telling the account holder
We tell people when their information is requested, before we produce it, unless a court order or statute forbids it, or telling them would put someone at risk. Please attach the non-disclosure order itself; a request for silence is not enough.
Service and transparency
The portal will be our designated channel for US government process. Accepting process through it is a convenience and waives no objection.
Civil subpoenas go to our registered agent, not the portal. They cannot reach the encrypted data at all.
We will publish how many requests we receive and how we answer them.