Privacy, safety & security

Some people who use Custody Commander are dealing with someone who may check their phone, read their email, or know their passwords. This page explains what the app does to protect you, and what you can do on your own devices.

What the app does#

• Private by default. Nothing you add is visible to anyone else until you share it — and you choose exactly who, what, and at what level. See Sharing.
• Two-factor sign-in with an authenticator app and single-use recovery codes.
• Lockout after repeated failures. Ten wrong passwords in a row locks the account for 15 minutes, and sign-in errors never reveal whether an account exists.
• Sign out everywhere with one click from My account → Security. Resetting your password also signs out every device.
• Password required for security changes. Turning two-factor sign-in on or off and signing out all sessions need your current password.
• Sessions end after a period of inactivity, and have a maximum length even when active.
• Verified email. Case tools only unlock after you verify your email, and sharing invitations only work for the exact address they were sent to.
• Photo location data is hidden in the app and removed from copies that collaborators download and from exhibit PDFs.
• Originals are never altered, and every file has a fingerprint recorded at upload.
• Nothing is sent from the app. Comms Guard and the Assistant never message anyone on your behalf.

Two-factor sign-in#

With two-factor sign-in, someone who learns your password still can't get in without the six-digit code from your authenticator app.

1. Open SecurityGo to My account → Security and click Set up authenticator. Enter your current password.
2. Add it to your authenticatorScan the QR code with an authenticator app (such as the Passwords app on iPhone, Google Authenticator, or 1Password), or type the key shown.
3. VerifyEnter the six-digit code and click Verify and enable within 10 minutes.
4. Save your recovery codesYou'll see eight single-use recovery codes, once. Store them somewhere safe that no one else can reach — each one can be used in place of a code if you lose your phone.

Turning on two-factor sign-in signs out every other session. From then on, sign-in asks for an authenticator or recovery code after your password. To turn it off, use Disable authenticator and sign out (you'll need a current code).

If you think someone has been in your account#

1. Reset your password from the sign-in page with Forgot password? — this signs out every device.
2. Turn on two-factor sign-in.
3. Check Sharing → People with access and remove anyone you don't recognize.
4. Check your email account too: its password, its recovery phone and email, and any forwarding rules. Whoever controls your email can reset your Custody Commander password.

On your own device#

• Use a private email address that no one else can read or reset.
• Don't let your browser save your password on a shared or monitored device. Sign out when you're done.
• Use private/incognito browsing on a device someone else uses. Some things — like Assistant chat history and Mediation settings — are stored in the browser you use.
• Clear your browsing history if your device may be checked. Leaving a website doesn't erase the record that you visited it.
• Watch downloads. Exported PDFs and ZIPs stay in your Downloads folder until you move or delete them.
• Consider a device that's only yours — a library computer or a friend's device can be safer than a shared one. An advocate can help you think through which is safest for you.
• On this website, pressing Esc twice leaves immediately for weather.com. It doesn't clear your history.

Recordings and messages#

When you upload audio or video, the app asks you to confirm you were allowed to make the recording, and when you import messages, that the export came from your own device or account (or one you're legally allowed to access). Recording and privacy laws differ from state to state; if you're unsure, ask a licensed attorney where you live before relying on a recording.

Your data#

You can export your records at any time — see Binders & exports. For how we collect, use, and protect personal information, read the Privacy Policy.