Privacy Policy
This policy may change. New versions are posted here with a new version number and effective date, and account owners are told by email before the change takes effect.
1. The short version
SimpleMatter holds legal matter data, which is often privileged. We treat it that way. We do not sell it, we do not advertise against it, we do not train models on it, and we do not look at it except when you ask us to help with a specific problem.
2. Where your data lives depends on how you run it
- Local. Everything stays in your browser's storage or on your own server. It never reaches us. We have no copy and cannot recover it — your backups are your responsibility.
- Hosted. Your data is stored on servers we operate in the United States, on encrypted storage volumes.
The rest of this policy describes the hosted service.
3. What we hold
| What | Why |
|---|---|
| Your name, email, organization | To give you an account and let colleagues find you |
| A hash of your password | To sign you in. We never store the password itself |
| Two-factor secret, if enabled | To verify your codes |
| Your matter data | Because it is the point of the product. Stored as you entered it |
| Files you upload | Stored by content hash on encrypted volumes |
| Mailbox tokens, if you connect email | Encrypted, so a copy of the database alone cannot use them |
| Technical error records | To notice failures. These record what failed and where — never your matter contents |
We do not use third-party analytics or advertising trackers.
4. Who else is involved
Running a hosted service means some suppliers necessarily handle data:
- Our hosting provider — operates the servers your data sits on.
- Our email provider — delivers invitations and password resets. These messages carry names and email addresses. They never carry client matter content.
- Microsoft or Google, only if you choose to connect a mailbox — and then the connection is between you and them; we pass messages through, we do not resell or repurpose them.
We do not share your data with anyone else unless you ask us to, or the law compels us. If we are ever legally compelled, we will tell you unless we are forbidden from doing so.
5. Keeping it safe
- Encrypted in transit (HTTPS) and at rest (encrypted storage volumes).
- Passwords hashed with bcrypt; mailbox tokens separately encrypted.
- Each organization's data is isolated, and every query is scoped to it.
- Optional two-factor authentication, which we recommend.
- Regular backups, and point-in-time copies you can restore yourself.
No system is perfectly secure and we cannot guarantee absolute security. If a breach affecting your data occurs, we will notify you as required by applicable law. You remain responsible for keeping your own copies of anything you cannot afford to lose.
6. How long we keep it
While your account is open. After termination we retain your data for up to 30 days so you can request an export, after which we may delete it; residual copies in backups age out within a further 90 days. We may retain records we are required to keep by law.
7. Your control
- Export everything at any time, in open formats.
- Correct anything by editing it directly.
- Delete your account and its data by asking us.
- Leave at any time, taking your data with you.
Depending on where you live you may have further rights — access, portability, objection, or a complaint to a regulator. Write to us and we will respond as the applicable law requires.
8. A note for law firms
If you are a firm using SimpleMatter for client work, you are the controller of your clients' information and we process it on your behalf, on your instructions. We will sign a data processing agreement if you need one for your own compliance obligations — just ask.
9. Children
SimpleMatter is for professional use and is not directed at children.
10. Contact
support@simplematter.app — for privacy questions, data requests, or a processing agreement.
Gunacar, Inc. dba Pontic Labs