What happens to your case here.

Signing in

An account is an email address and a password. Passwords are never stored — what is kept is a scrypt hash with a random salt for each one, at the work factor OWASP currently recommends, so a stolen database does not hand anyone a password.

Your session is a signed cookie that JavaScript cannot read, marked Secure in production and restricted to this site. It is re-issued daily and expires on its own.

In transit

Every page and every request, including the connection your AI assistant makes, is served over HTTPS. There is no unencrypted route into CaseMagic.

What is stored

• Your account: email address, password hash, and which organization you belong to.
• The cases you connect: the caption, court, judges and docket entries as the court source reported them, with the time each read happened.
• Case correspondence sent to a CaseMail address, including the full header block exactly as it arrived — because correspondence in a lawsuit gets disputed, and the headers are what answer "did this really come from them, and when".
• Attachments to that correspondence.
• Your subscription status. Card numbers are not stored, and never reach CaseMagic at all.

Documents and attachments

Attachments live in a private bucket with no public access. They are reached only through links that are signed and expire within minutes, generated when you ask for the file.

The Case Passport — the record an assistant loads — deliberately carries no such link. A snapshot an assistant might hold for weeks must not contain a door that was meant to close in five minutes.

Who can reach your case

Every case belongs to an organization, and every request is answered only for the organization that owns it. There is no route by which one account reads another's case.

Nothing behind a sign-in is crawlable. Your cases, your correspondence and your Case Passport carry a no-index instruction as an HTTP header, not merely a request in robots.txt, so a crawler that ignores the file still cannot publish what it found.

What an AI assistant receives

A connection you authorise is granted exactly four permissions, named on the sign-in screen before anything is shared:

• Read the cases you have connected: docket activity and your Case Passport.
• Connect a case and start or stop CaseMagic Watch on it.
• Read the correspondence in your CaseMail address for a connected case.
• Draft a CaseMail message for you to review. It can never send one by itself.

The connection is one-way: CaseMagic receives the requests your assistant makes and nothing else — not your conversation, not your files, not your other tools. It can draft a message and can never send one. Removing the connector ends the access immediately. More about connecting an assistant.

Payments

Checkout happens on Stripe's own page. Card details go from your browser to Stripe and never touch a CaseMagic server, which is why we can say we do not store them: we never have them. What CaseMagic keeps is the subscription status Stripe reports, and that report is accepted only when its cryptographic signature checks out.

Who else is involved

• The hosting provider that runs the application.
• The database and file storage provider.
• Stripe, for payments.
• The email provider that sends alerts and receives CaseMail.
• CourtListener, where the public docket data is read from.
• Any AI assistant you personally connect, for as long as you leave it connected.

Each holds only what it needs for its part. Nothing is sold, and nothing is shared for advertising.

Analytics

CaseMagic records which pages are visited and which steps are completed, so the product can be improved. IP addresses are hashed with a secret salt before they are written and are never stored in the clear. The contents of your case are not sent to any analytics system.

Keeping and deleting

Your data is kept while your account exists. Email support@casemagic.ai and ask for it to be deleted, and it is — apart from the records we are legally required to keep for tax and payment purposes. Public court records are not ours to delete; they are the court's.

Cancelling a subscription does not delete anything. Monitoring stops; the case record stays readable.

If something goes wrong

Report anything that looks like a security problem to support@casemagic.ai. If you have found a real one, say so plainly and we will treat it as the first thing of the day.

If customer data is ever exposed, we will email the affected accounts with what happened, what was reached, and what to do about it. We will not wait until we have a polished explanation.

What CaseMagic does not claim

• No certification. CaseMagic holds no SOC 2, no ISO 27001 and no HIPAA attestation, and you will not find a badge for one anywhere on this site.
• No independent penetration test has been carried out yet.
• No "bank-level" anything. That phrase describes nothing and appears on this site nowhere else.
• CaseMagic is not a law firm, gives no legal advice, and is not a substitute for reading the docket yourself when something matters.
• Docket data is reported from a public source and is not real time. Every answer carries the time it was last read, so you can see for yourself how fresh it is.

When any of that changes, it changes here first. The privacy policy covers what is collected and why, in the formal wording.

Questions people ask before they start