Privacy Policy
Effective: May 17, 2026 · Last updated: July 29, 2026
LawLert ("LawLert – LawTracker") is operated by Gino Cattuzzo, based in Nevada, USA. You can reach us anytime at support@lawlertapp.com. This policy explains what information LawLert collects, how we use it, who processes it on our behalf, and how to delete it. It covers the LawLert iOS app, the LawLert website and web app at lawlertapp.com, and — when released — the LawLert Android app distributed through Google Play.
1. The short version
- We collect the minimum needed to run the app: your email address and an account ID, your subscription status, your device's location while you use location features, the setup you choose to save (tracked categories, home state, trip plans, and any permit details you add), a push-notification identifier if you enable notifications, and basic product analytics so we can fix what breaks.
- Background location is off by default. It is used only if you explicitly turn on crossing alerts — a free feature. You can turn it off at any time and the rest of the app keeps working.
- We do NOT sell or rent your personal data, and we do NOT run targeted or behavioral advertising: no advertising identifiers, no ad profiles, and nothing about you is sold or shared with an ad network. LawLert does show clearly-labeled Sponsored listings from local businesses, and affiliate links on some travel and guide pages. Which one you see is decided only by the page you are reading — its state, category, or country — never by anything we know about you, your location history, or your account.
- We use a small set of service providers — listed in full in section 4 — to run accounts, payments, push notifications, analytics, and geocoding. We share data with no one else.
- You can browse every state's laws without an account. An account is only needed for saved setup and alerts — and if you enable alerts without signing up, the app creates an anonymous account (a random ID with no email, name, or password attached).
- You can delete your account and your data at any time: in the app (Settings → Delete account), on the web at https://www.lawlertapp.com/account/delete, or by emailing support@lawlertapp.com.
2. What we collect and why
2.1 Account
Your email address and a password (managed by Supabase, our authentication and database provider), plus an internal account ID — used to sign you in, keep your saved setup in sync across devices, and respond to your support requests. If you enable alerts without signing up, we instead create an anonymous account: a random account ID with no email, name, or password attached, which you can later upgrade to a full account. We do not collect your name. You can use most of LawLert — browsing laws for every state — without any account at all.
2.2 Location while you use the app (foreground)
If you grant location permission, we use your device's location to work out which U.S. state — and, where our data goes deeper, which county or city — you are in, so the app can show the laws that apply where you are standing. To turn coordinates into a place name we send them to a reverse-geocoding service (BigDataCloud); the lookup contains coordinates only, never your name or email. We do not keep a running history of your coordinates or movements.
You can deny or revoke location permission at any time in your device settings. Without it, you simply pick your state manually and everything else works.
2.3 Background location (crossing alerts only)
LawLert's signature feature — free for everyone — alerts you the moment you cross into a place where your tracked laws change. If, and only if, you turn this feature on, the app reports your device's location in the background to our server, which checks whether you have crossed a legal boundary we track: a state or country line, federal land such as a national park or forest, or regulated waters. When a crossing is detected, we send you a push notification and record a crossing event — the boundary involved and the time — linked to your account, so we can deliver the alert, avoid sending duplicates, and monitor that the feature is working. Crossing-event records are locked down so that only our backend service can read them.
We do not use background location for anything else. We do not build a timeline of your movements, track your routes, or share your location for advertising. Turning the feature off in the app, or revoking "Always Allow" location in your device settings, stops background collection immediately; the rest of the app is unaffected.
2.4 Setup you choose to save
If you save preferences — the law categories you track, your home state, trip plans (states you intend to visit), alert preferences, or permit details such as the state that issued your concealed-carry permit — we store them in your profile so the app can personalize what it shows you (for example, a carry-permit reciprocity readout, or alerts relevant to your permit when you cross a state line). We treat permit details as sensitive: they are used only to compute the information and alerts you asked for, and are never shared or sold. You can edit or remove saved setup at any time.
2.5 Subscription status
LawLert is currently free, with no paid consumer subscription offered. If you hold a legacy subscription, its status (start and renewal dates) comes from Apple's App Store (In-App Purchase) on iOS — and from Google Play Billing on Android when released — and subscription state is managed for us by RevenueCat. Apple or Google is the merchant of record — we never see your card number or full payment details.
2.6 Push notifications
If you enable notifications, OneSignal (our push provider) creates a device-level push identifier ("player ID") that we store on your profile, protected so it cannot be claimed by another account. It is used to deliver the alerts you opted into — crossings, law changes, and weekly digests. Turn notifications off at any time in the app's settings or in your device's notification settings (iOS: Settings → Notifications → LawLert; Android: Settings → Apps → LawLert → Notifications).
2.7 Analytics and error reports
We use PostHog for product analytics: which screens are viewed, which features are tapped, how features perform, and automatic error reports when something in the app breaks (error telemetry is capped at roughly five events per session). Events carry an analytics identifier and, where you are signed in, may be associated with your account ID so we can reproduce and fix problems you hit. We use this data to improve LawLert — never for advertising, and we never share it with data brokers.
2.8 Bundled third-party SDKs (transparency disclosure)
Current LawLert iOS builds (version 2.3.0 and later) are built on the open-source Capacitor runtime and include exactly the third-party SDKs we actively use: OneSignal (push notifications), RevenueCat (subscription state), and a background-geolocation plugin that runs only when you enable crossing alerts. Earlier builds used the Despia web-native runtime, which bundled dormant SDKs (Google Mobile Ads (AdMob), Facebook Audience Network, AppsFlyer, Pushwoosh, Firebase) that were never configured or activated by LawLert and sent us no data. Separately, Stripe processes payments on the web for business advertisers who purchase listings — it is never used for consumer payments, and advertiser billing details go to Stripe, not to us. If we add a new SDK or a new category of data collection, we will update this policy and the relevant store privacy labels before the change goes live.
2.9 Things we explicitly do NOT collect
- No contacts, no health or fitness data, no financial account data.
- No access to your photos, camera, microphone, calendar, or browsing history.
- No advertising identifiers, no ad profiles.
- No continuous record of your coordinates or movement history.
3. How we use what we collect
Only to: show you the laws that apply where you are; send the alerts you opted into (crossings, law changes); personalize the app using the setup you saved; operate any subscription you may hold; understand product usage and fix errors; and respond to your support requests. Where European data-protection law applies, our legal bases are performance of our contract with you (account, subscription, core features), your consent (location, background location, push notifications, saved permit details), and our legitimate interest in keeping the service reliable and secure (analytics, error telemetry, abuse prevention). We do not use your data for advertising, profiling for marketing, or third-party marketing of any kind.
4. Service providers we share data with
We share personal data only with the providers below, only so they can perform services for us:
| Provider | What it does for LawLert | Data it processes |
|---|---|---|
| Supabase | Account sign-in, database, and backend functions (US-hosted) | Email address, password (hashed), account ID, saved setup and permit details, subscription status, push identifier, crossing events |
| RevenueCat | Manages subscription state across devices | Account ID, app-store subscription receipts and entitlement events (no card details) |
| Apple (App Store) | Payment processing for iOS subscriptions | Your purchase, handled by Apple under Apple's own privacy policy |
| Google (Google Play) | Payment processing for Android subscriptions, when the Android app is released | Your purchase, handled by Google under Google's own privacy policy |
| PostHog | Product analytics and error reporting | Usage events, device/browser type, analytics identifier (and account ID where signed in) |
| OneSignal | Delivers push notifications | Push identifier, device push token, the content of notifications sent to you |
| BigDataCloud | Converts coordinates into a place (reverse geocoding) | Coordinates at the moment of lookup — no name, email, or account ID |
| Stripe | Payment processing for business advertisers who purchase listings (web only — never consumer payments) | The advertiser's payment details, handled by Stripe under Stripe's own privacy policy |
| Cloudflare | Hosts the website and web app | Standard web-server logs (IP address, browser user agent) |
| Esri | Provides the map imagery in our interactive map | Like any web request: your IP address and the map area you are viewing |
We do not sell or rent your information to data brokers, advertisers, or anyone else, and we do not "share" personal information for cross-context behavioral advertising (as those terms are defined by the California Privacy Rights Act).
5. Data retention and security
- Account, setup, and permit details: kept until you delete them or delete your account.
- Crossing events: kept for feature operation and reliability monitoring, and removed when your account is deleted.
- Subscription records: kept as long as needed for accounting, tax, and fraud-prevention obligations.
- Analytics and error data: retained by our analytics provider under our project settings and used in aggregate.
- Support emails: kept as long as needed to resolve your request.
All data is encrypted in transit (HTTPS/TLS) and encrypted at rest by our infrastructure providers. Database access is restricted with row-level security so accounts can only read their own data.
6. Deleting your account
You can delete your LawLert account and the data associated with it at any time, three ways:
- In the app: Settings → Delete account.
- On the web (no app install needed): https://www.lawlertapp.com/account/delete
- By email: write to support@lawlertapp.com from your account's email address.
Deletion removes your account, profile, saved setup and permit details, crossing events, and push registration, and signs you out everywhere. We complete deletion within 14 days at most. Records we are legally required to keep (for example, purchase records for tax purposes) are retained only as required and are no longer linked to an active profile.
Note on subscriptions: deleting your account does not cancel an active subscription, because billing is handled by Apple or Google. Cancel in your device's subscription settings (iOS: Settings → [your name] → Subscriptions; Android: Play Store → Payments & subscriptions) before or after deleting your account.
7. Your rights
Everyone: you can ask us what data we hold about you, ask us to correct it, delete your account (section 6), opt out of push notifications, and deny or revoke location access at any time.
California residents (CCPA/CPRA): you have the right to know what personal information we collect and how we use it (this policy), to access and correct it, to delete it, and to opt out of "sale" or "sharing" of personal information — we do not sell or share personal information, so there is nothing to opt out of. We do not use or disclose sensitive personal information for purposes requiring a right to limit. We will never discriminate against you for exercising your rights. Email support@lawlertapp.com; we will verify requests using your account email.
EEA/UK residents (GDPR): you have the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent at any time (for example by turning off location or push). LawLert is operated from the United States and your data is processed and stored in the United States. You also have the right to lodge a complaint with your local supervisory authority.
Nevada residents: we do not sell covered information as defined by NRS 603A.
To exercise any right, email support@lawlertapp.com.
8. Children
LawLert is not directed at children. The app deals with adult-oriented legal topics (firearms, cannabis, alcohol, gambling) and our Terms require you to be at least 17 to use the Service. We do not knowingly collect personal information from children under 13 (or under the applicable age of consent where you live). If you believe a child has created an account, email support@lawlertapp.com and we will delete it.
9. Changes to this policy
If we change this policy materially, we will notify you in the app and update the "Last updated" date above. If we ever begin collecting a new category of data, or activate an SDK beyond what section 2.8 describes, we will update this policy and the app-store privacy labels before the change goes live.
10. Contact
support@lawlertapp.com — Gino Cattuzzo, operator of LawLert, Nevada, USA.