MyCases

Privacy Policy

Last updated: 2026-10-17

1. Scope

This Privacy Policy describes how ABAI (the “Service Operator”, “we”, “us”) processes information when you use the MyCases product at mycases.us (the “Service”).

2. Information We Collect

  • Account information: email address, display name, authentication identifiers (OAuth provider identifier when you use Google sign-in; invite code for invited firm accounts).
  • USCIS case data: receipt numbers you enter, form type, nicknames, public case status returned by USCIS, and status history retrieved on your behalf.
  • Beneficiary and folder metadata you organize inside the product.
  • Team and staff data only when a firm/team account invites collaborators (email, display name, role, membership status).
  • Document input for AI-assisted parsing: when you upload a receipt image or file, the content is sent to a hosted AI provider for one-time parsing/extraction so we can populate case fields. The Service is not a long-term document archive today; source files are not retained as an addressable document store, and any processing by the external AI/hosting processors is subject to their own terms.
  • Notification channel configuration you provide (Telegram chat id, WeCom webhook, email address). Delivery records store masked recipients only.
  • Android push and installation identifiers: Google’s Firebase Cloud Messaging (FCM) provides push notifications. The Firebase SDK may initialize a Firebase installation ID and FCM device token before OS notification permission is granted; OS notification permission is distinct from SDK installation ID initialization. Google processes these identifiers to provide push services. MyCases push registration receives the FCM device token, an app installation binding ID, binding verification information, and language, and binds the installation to your account and current sign-in session. The app installation binding ID is not the Firebase installation ID; the latter is not a separately registered field in our service. This information is used for notification delivery, app functionality, and security, not advertising.
  • Plan and usage: the personal version is currently free ($0) and collects no card data. Plan and usage counters are kept for quota enforcement; if a paid service is ever purchased, card data is handled entirely by Stripe.
  • Operational logs such as request timing, error signals, and coarse device information used for reliability and abuse prevention.

3. How We Use Information

  • Provide case lookup, status history, and change notifications.
  • Organize cases via beneficiaries, folders, and team membership.
  • Enforce quotas and plan entitlements.
  • Protect the Service, detect abuse, and support you.
  • Comply with applicable legal obligations.

The personal version shows no ads, and we do not sell your personal information.

4. Third-Party Categories

  • Managed hosting and database (Supabase-managed infrastructure).
  • Product hosting and delivery (Lovable-managed platform).
  • Payments (Stripe), used only if a paid service is purchased.
  • Public USCIS data sources used to look up your cases at your direction.
  • Optional notification channels you configure yourself (Telegram, WeCom webhooks, email).
  • Google as the Android push service processor (Firebase Cloud Messaging / FCM).
  • AI providers used for one-time parsing of documents you upload. AI fallback translation of case status is currently disabled; case text is not sent to an AI translation service for that purpose. Existing Chinese and English templates remain in use for common statuses, and the original USCIS English is retained. Statuses without a matching template may have no Chinese explanation.

We do not claim any specific external certifications on your behalf.

5. Data Export, Account Deletion, and Your Choices

When signed in, you can request an account data export and request self-serve account deletion under Settings → Data & privacy (/settings/data). A deletion request is scheduled at least 30 days out and can be cancelled before then; see Account deletion for the full process. If you cannot sign in, use the data request form.

You can control notification permission in Android system settings and adjust notification preferences in the app. Turning off OS notification permission controls notification display; it does not delete Firebase SDK installation identifiers or our registration records. Signing out ends the current session; server-side delivery checks that the bound session remains valid. Unregistering that installation’s push registration deactivates its account binding and clears the encrypted device token stored on our server, but does not delete Google’s Firebase installation ID or guarantee immediate unbinding while offline.

Installation bindings and delivery records support notification operations and security; clearing a device token on unregistration does not delete all historical records. Account data deletion follows the request process above. This policy does not promise immediate deletion of all push-related records or data processed by Google when you sign out, turn off notification permission, or submit a deletion request, nor an unverified fixed retention period.

6. International Users, Children, and Regional Rights

The Service is not directed to children. Depending on where you reside, you may have rights to access, correct, or delete personal data, and to object to certain processing. We handle such requests in good faith and within a reasonable time. This section is a summary and is not legal advice.

7. Security

FCM device tokens stored on the server are encrypted using AES-256-GCM, with integrity checked during decryption. Visible push reminder text is generic, such as “Your case status changed. Open MyCases for details,” and excludes receipt numbers, names, priority dates, and case text; push data used to open the relevant details still includes internal case and event identifiers. Whether notifications appear on the lock screen depends on system settings.

See our Security page for the specific technical controls currently in place. No online service can guarantee absolute security.

8. Contact

For privacy questions, please use the contact form. For data export or deletion requests, use the data request form.