YourCelf · Legal

Law Enforcement Guidelines

Last updated 7 October 2026 · Home · Privacy Policy

Lil Dog Productions, LLC operates YourCelf and is a United States company. We respond to valid legal process under the Stored Communications Act (18 U.S.C. §§ 2701–2712) and other applicable federal and state law. This page sets out exactly what we hold — content, basic subscriber information, and metadata — and for how long.

How YourCelf Works

A photo shared in a circle is sealed on the sender’s phone to each recipient’s key and opened only on the recipients’ phones. Our relay stores those sealed blocks until the recipient’s phone collects them. We hold no key that can open them.

There are no accounts. We have no usernames, passwords, phone numbers, email sign-ups or payment records. Our relay knows a person only by the fingerprint of a public key their phone generated.

Content

• Circle content (photos, captions, comments): sealed blocks we cannot open. A block is deleted when the recipient’s phone confirms it has it, and any block not collected is deleted after 30 days. We cannot produce readable content from the relay under any legal process.
• Reports — the one exception. When a person reports a post, a comment or a reply, their phone sends it to our report service unsealed: the photograph if there is one, the signature the sharer’s phone added to it if it has one (it carries their public key and the time their phone signed it), what the reported person wrote, the reason and any note the reporter wrote, the reported person’s key fingerprint and the name the reporter’s phone shows for them, the circle’s name and ID, the post’s ID, the reporter’s key fingerprint, name and email address if they gave one, and whether the reporter’s phone flagged the photograph as possibly sensitive. We check the signature and keep the result with the report. We keep a report for 90 days and then delete it. A report we submit to NCMEC’s CyberTipline is kept for one year from the day we submit it, as 18 U.S.C. § 2258A(h) requires.

Basic Subscriber Information

• No subscriber name, email address, phone number, postal address or payment information exists, because there is no sign-up.
• The only names and email addresses that reach us are the ones inside reports, described above.
• The current app does not register for push notifications, so we hold no device tokens.

Metadata

• For each sealed block still waiting to be collected: the sender’s and recipient’s key fingerprints, the block’s size, and the time it was deposited. This is deleted with the block — when it is collected, or after 30 days.
• Blocks waiting for a recipient are kept in a folder named for that recipient’s key fingerprint. The folder is removed along with its last block.
• For each phone that has proved, through Apple’s App Attest, that it runs a genuine copy of YourCelf: its key fingerprint, the ID and public key of its App Attest key, whether the app is a release or development build, a counter used to spot replayed requests, the day the key was checked and the day it was last used. It holds no name and no hardware identifier such as a serial number, and it is deleted once 30 days have passed since the day it was last used.
• A list of refused keys: the key fingerprint of each person whose deposits our relay stopped accepting after a report showed they broke our rules, and the date it was refused. It holds no name, note or report reference, and an entry stays until we lift the refusal.
• The report service keeps an audit log of what happened to each report — its reference number, when it was received, read, submitted or closed — so we can always say what was read, and when. The log holds no images.
• IP addresses: no access logging is configured on the relay, the report service, or the web server in front of them. That web server’s error log may include the address of a connection that failed.

Legal Process Requirements

We require formal legal process before producing any non-public information:

• Subpoena: basic subscriber information. As described above, this generally does not exist.
• Court order under 18 U.S.C. § 2703(d): non-content records, such as the metadata above.
• Search warrant: content. The only readable content we hold is reports, for as long as we hold them.

We report apparent child sexual abuse material that reaches us through a report to NCMEC’s CyberTipline, as 18 U.S.C. § 2258A requires.

Preservation Requests (§ 2703(f))

On a valid, signed preservation request from a law enforcement agency, we will preserve the records we hold for 90 days pending legal process, and for a further 90 days on a renewed request. Relay blocks and their metadata are deleted when collected or after 30 days, and App Attest records 30 days after the day they were last used, so a preservation request can only preserve what exists when it reaches us. Our host backs up the whole server once a week and keeps the two most recent backups, so a record we have deleted may remain in a backup for up to about two weeks. Our host does not let us download a backup; we could reach one only by restoring the whole server to that day, which would overwrite what is on it now.

Service of Process Contact

Send legal process and preservation requests from an official government email address to:

legal@beyourcelf.com

Please include the requesting officer’s name, title, agency and direct telephone number, and the key fingerprint, report reference number, or other identifier the request concerns.

---