Privacy Policy
Effective: May 17, 2026 · Last updated: October 6, 2026
LawLert ("LawLert – LawTracker") is operated by Gino Cattuzzo, based in Nevada, USA. You can reach us anytime at support@lawlertapp.com. This policy explains what information LawLert collects, how we use it, who processes it on our behalf, and how to delete it. It covers the LawLert iOS app, the LawLert website and web app at lawlertapp.com, and — when released — the LawLert Android app distributed through Google Play.
1. The short version
- We collect the minimum needed to run the app: your email address and an account ID, your subscription status, your device's location while you use location features, the setup you choose to save (tracked categories, home state, trip plans, and any permit details you add), a push-notification identifier if you enable notifications, and basic product analytics so we can fix what breaks.
- Background location is off by default. It is used only if you explicitly turn on crossing alerts — a free feature. You can turn it off at any time and the rest of the app keeps working.
- We do NOT sell or rent your personal data, and we do NOT run targeted or behavioral advertising: no ad profiles, and we never ask for your advertising identifier. The website shows affiliate links on some travel and guide pages, chosen only by the page you are reading — its state, category, or country — never by anything we know about you, your location history, or your account.
- Starting with LawLert for iOS version 3.0, the app shows banner ads served by Google AdMob. We request them as non-personalized ads with Google's restricted data processing turned on, we do not show Apple's "Allow tracking" prompt, and we never give Google your location history, your saved setup, your permit details, or your account. To deliver and measure an ad, Google receives standard device and network information (such as IP address, device model, and OS version) — see section 2.8. Ads never appear inside alerts or notifications.
- The LawLert website shows display ads served by Google AdSense. Google's ad code loads on the website's public pages; Google serves ads only once it has approved the site, and until then the ad space stays empty and collapsed. We request non-personalized ads, place at most one ad per page, never inside a rule or its source, and never inside the LawLert apps. Google, as a third-party vendor, uses cookies to deliver and measure these ads, limit how often you see the same ad, and prevent fraud. You can manage Google's ad cookies at https://adssettings.google.com and learn how Google uses data at https://policies.google.com/technologies/ads. Visitors in the EEA, the UK and Switzerland are asked for consent through Google's consent message before any ad cookie is set.
- We use a small set of service providers — listed in full in section 4 — to run accounts, payments, push notifications, analytics, and geocoding. We share data with no one else.
- You can browse every state's laws without an account. An account is only needed for saved setup and alerts — and if you enable alerts without signing up, the app creates an anonymous account (a random ID with no email, name, or password attached).
- You can delete your account and your data at any time: in the app (Settings → Delete account), on the web at https://www.lawlertapp.com/account/delete, or by emailing support@lawlertapp.com.
2. What we collect and why
2.1 Account
Your email address and a password (managed by Supabase, our authentication and database provider), plus an internal account ID — used to sign you in, keep your saved setup in sync across devices, and respond to your support requests. If you enable alerts without signing up, we instead create an anonymous account: a random account ID with no email, name, or password attached, which you can later upgrade to a full account. We do not collect your name. You can use most of LawLert — browsing laws for every state — without any account at all.
2.2 Location while you use the app (foreground)
If you grant location permission, we use your device's location to work out which U.S. state — and, where our data goes deeper, which county or city — you are in, so the app can show the laws that apply where you are standing. To turn coordinates into a place name we send them to a reverse-geocoding service (BigDataCloud); the lookup contains coordinates only, never your name or email. We do not keep a running history of your coordinates or movements.
You can deny or revoke location permission at any time in your device settings. Without it, you simply pick your state manually and everything else works.
2.3 Background location (crossing alerts only)
LawLert's signature feature — free for everyone — alerts you the moment you cross into a place where your tracked laws change. If, and only if, you turn this feature on, the app reports your device's location in the background to our server, which checks whether you have crossed a legal boundary we track: a state or country line, federal land such as a national park or forest, or regulated waters. When a crossing is detected, we send you a push notification and record a crossing event — the boundary involved and the time — linked to your account, so we can deliver the alert, avoid sending duplicates, and monitor that the feature is working. Crossing-event records are locked down so that only our backend service can read them.
We do not use background location for anything else. We do not build a timeline of your movements, track your routes, or share your location for advertising. Turning the feature off in the app, or revoking "Always Allow" location in your device settings, stops background collection immediately; the rest of the app is unaffected.
2.4 Setup you choose to save
If you save preferences — the law categories you track, your home state, trip plans (states you intend to visit), alert preferences, or permit details such as the state that issued your concealed-carry permit — we store them in your profile so the app can personalize what it shows you (for example, a carry-permit reciprocity readout, or alerts relevant to your permit when you cross a state line). We treat permit details as sensitive: they are used only to compute the information and alerts you asked for, and are never shared or sold. You can edit or remove saved setup at any time.
2.5 Subscription status
LawLert is currently free, with no paid consumer subscription offered. If you hold a legacy subscription, its status (start and renewal dates) comes from Apple's App Store (In-App Purchase) on iOS — and from Google Play Billing on Android when released — and subscription state is managed for us by RevenueCat. Apple or Google is the merchant of record — we never see your card number or full payment details.
2.6 Push notifications
If you enable notifications, OneSignal (our push provider) creates a device-level push identifier ("player ID") that we store on your profile, protected so it cannot be claimed by another account. It is used to deliver the alerts you opted into — crossings, law changes, and weekly digests. Turn notifications off at any time in the app's settings or in your device's notification settings (iOS: Settings → Notifications → LawLert; Android: Settings → Apps → LawLert → Notifications).
2.7 Analytics and error reports
We use PostHog for product analytics: which screens are viewed, which features are tapped, how features perform, and automatic error reports when something in the app breaks (error telemetry is capped at roughly five events per session). Events carry an analytics identifier and, where you are signed in, may be associated with your account ID so we can reproduce and fix problems you hit. We use this data to improve LawLert — never for advertising, and we never share it with data brokers.
2.8 Bundled third-party SDKs (transparency disclosure)
Current LawLert iOS builds (version 2.3.0 and later) are built on the open-source Capacitor runtime and include exactly the third-party SDKs we actively use: OneSignal (push notifications), RevenueCat (subscription state), and a background-geolocation plugin that runs only when you enable crossing alerts. Earlier builds used the Despia web-native runtime, which bundled dormant SDKs (Google Mobile Ads (AdMob), Facebook Audience Network, AppsFlyer, Pushwoosh, Firebase) that were never configured or activated by LawLert and sent us no data. LawLert for iOS version 3.0 and later is a native app. It includes the Google Mobile Ads SDK (AdMob) and Google's User Messaging Platform (which asks for consent where the law requires it, for example in the EU/UK). Ad requests are sent as non-personalized with restricted data processing on; the app does not request App Tracking Transparency permission, so it cannot read your advertising identifier (IDFA). Version 3.0 also sends LawLert optional anonymous reliability counts so we can tell whether crossing alerts are detected and delivered on phones other than our own: a random ID created on your phone (not your advertising identifier and not tied to any account), the app and iOS version, and fixed outcome words such as "alert delivered", "Time Sensitive on" or "location permission: Always". They never include your location, the state you are in, what you track, or permit details. You can turn them off in the app (Settings → Reliability), and they are deleted after 90 days. Starting with version 3.1, the app also checks the public list of recent law changes (the same list shown at lawlertapp.com/changes) so it can tell you when a law you track changes in your home state or the state you are in. It downloads the list for every state and picks out yours on the phone: the request carries no location, no state, no identifier and none of your setup. Any other third-party SDK in version 3.0 will be listed here before it is released. (Until 2026-09-26 the website also sold sponsored listings to local businesses and used Stripe to bill them; that program is retired, no consumer ever paid through it, and Stripe processes nothing for LawLert today.) If we add a new SDK or a new category of data collection, we will update this policy and the relevant store privacy labels before the change goes live.
2.9 Things we explicitly do NOT collect
- No contacts, no health or fitness data, no financial account data.
- No access to your photos, camera, microphone, calendar, or browsing history.
- No advertising identifier (we never request App Tracking Transparency permission) and no ad profiles.
- No continuous record of your coordinates or movement history.
3. How we use what we collect
Only to: show you the laws that apply where you are; send the alerts you opted into (crossings, law changes); personalize the app using the setup you saved; operate any subscription you may hold; understand product usage and fix errors; and respond to your support requests. Where European data-protection law applies, our legal bases are performance of our contract with you (account, subscription, core features), your consent (location, background location, push notifications, saved permit details), and our legitimate interest in keeping the service reliable and secure (analytics, error telemetry, abuse prevention). We do not use your data for advertising, profiling for marketing, or third-party marketing of any kind. (The AdMob banners in the iOS app, version 3.0 and later, are requested as non-personalized ads and receive only the device and network information described in section 2.8 — not your account, location history, or saved setup.)
4. Service providers we share data with
We share personal data only with the providers below, only so they can perform services for us:
| Provider | What it does for LawLert | Data it processes |
|---|---|---|
| Supabase | Account sign-in, database, and backend functions (US-hosted) | Email address, password (hashed), account ID, saved setup and permit details, subscription status, push identifier, crossing events |
| RevenueCat | Manages subscription state across devices | Account ID, app-store subscription receipts and entitlement events (no card details) |
| Apple (App Store) | Payment processing for iOS subscriptions | Your purchase, handled by Apple under Apple's own privacy policy |
| Google (Google Play) | Payment processing for Android subscriptions, when the Android app is released | Your purchase, handled by Google under Google's own privacy policy |
| PostHog | Product analytics and error reporting | Usage events, device/browser type, analytics identifier (and account ID where signed in) |
| OneSignal | Delivers push notifications | Push identifier, device push token, the content of notifications sent to you |
| BigDataCloud | Converts coordinates into a place (reverse geocoding) | Coordinates at the moment of lookup — no name, email, or account ID |
| Google (AdMob) | Serves and measures banner ads in the iOS app, version 3.0 and later (non-personalized, restricted data processing) | IP address, device model and OS version, ad interaction data (views and taps), and consent status where applicable — handled by Google under Google's own privacy policy |
| Google (AdSense) | Serves and measures display ads on the lawlertapp.com website (non-personalized; not in the apps) | IP address, browser and device information, the page URL, ad interaction data, and Google's ad cookies — handled by Google under Google's own privacy policy |
| Cloudflare | Hosts the website and web app | Standard web-server logs (IP address, browser user agent) |
| Esri | Provides the map imagery in our interactive map | Like any web request: your IP address and the map area you are viewing |
We do not sell or rent your information to data brokers, advertisers, or anyone else, and we do not "share" personal information for cross-context behavioral advertising (as those terms are defined by the California Privacy Rights Act).
5. Data retention and security
- Account, setup, and permit details: kept until you delete them or delete your account.
- Crossing events: kept for feature operation and reliability monitoring, and removed when your account is deleted.
- Subscription records: kept as long as needed for accounting, tax, and fraud-prevention obligations.
- Analytics and error data: retained by our analytics provider under our project settings and used in aggregate.
- Support emails: kept as long as needed to resolve your request.
All data is encrypted in transit (HTTPS/TLS) and encrypted at rest by our infrastructure providers. Database access is restricted with row-level security so accounts can only read their own data.
6. Deleting your account
You can delete your LawLert account and the data associated with it at any time, three ways:
- In the app: Settings → Delete account.
- On the web (no app install needed): https://www.lawlertapp.com/account/delete
- By email: write to support@lawlertapp.com from your account's email address.
Deletion removes your account, profile, saved setup and permit details, crossing events, and push registration, and signs you out everywhere. We complete deletion within 14 days at most. Records we are legally required to keep (for example, purchase records for tax purposes) are retained only as required and are no longer linked to an active profile.
Note on subscriptions: deleting your account does not cancel an active subscription, because billing is handled by Apple or Google. Cancel in your device's subscription settings (iOS: Settings → [your name] → Subscriptions; Android: Play Store → Payments & subscriptions) before or after deleting your account.
7. Your rights
Everyone: you can ask us what data we hold about you, ask us to correct it, delete your account (section 6), opt out of push notifications, and deny or revoke location access at any time.
California residents (CCPA/CPRA): you have the right to know what personal information we collect and how we use it (this policy), to access and correct it, to delete it, and to opt out of "sale" or "sharing" of personal information — we do not sell or share personal information, so there is nothing to opt out of. We do not use or disclose sensitive personal information for purposes requiring a right to limit. We will never discriminate against you for exercising your rights. Email support@lawlertapp.com; we will verify requests using your account email.
EEA/UK residents (GDPR): you have the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent at any time (for example by turning off location or push). LawLert is operated from the United States and your data is processed and stored in the United States. You also have the right to lodge a complaint with your local supervisory authority.
Nevada residents: we do not sell covered information as defined by NRS 603A.
To exercise any right, email support@lawlertapp.com.
8. Children
LawLert is not directed at children. The app deals with adult-oriented legal topics (firearms, cannabis, alcohol, gambling) and our Terms require you to be at least 17 to use the Service. We do not knowingly collect personal information from children under 13 (or under the applicable age of consent where you live). If you believe a child has created an account, email support@lawlertapp.com and we will delete it.
9. Changes to this policy
If we change this policy materially, we will notify you in the app and update the "Last updated" date above. If we ever begin collecting a new category of data, or activate an SDK beyond what section 2.8 describes, we will update this policy and the app-store privacy labels before the change goes live.
10. Contact
support@lawlertapp.com — Gino Cattuzzo, operator of LawLert, Nevada, USA.