EADly Privacy Policy

Effective date: August 11, 2026

EADly (“the app”) is operated by Ethos Systems, LLC (“we”, “us”, “our”). Ethos Systems, LLC is a limited liability company formed in Wyoming, United States. It operates the Service and is the controller for the personal data described here.

This policy explains what information the app handles, where it is stored, and the choices you have. EADly is local-first and privacy-first. Your immigration data belongs on your device, not on our servers.

In this policy, “we,” “us,” and “our” mean Ethos Systems, LLC. Ethos operates the app and its backend. It also uses the service providers listed in Section 6.

This Privacy Policy works together with our Terms of Use.

1. Information stored only on your device

The following stays in local storage on your phone and is never transmitted to us unless you turn on cloud backup (Section 2) or use an online feature described in Section 3:

• Profile and timeline information, including your selected app category, prior F-1 history choice, school/program facts, OPT/STEM OPT dates, and EAD validity dates.
• H-1B and O-1 records, including petitioner or agent details, petition pathway, receipt number, decision and validity dates, employment or activity dates, and notes.
• Admission and extension records. These may include class, source, document dates, an Admit Until value, and optional I-94 or receipt numbers.
• Employment and activity records, including employer, petitioner, agent, work-location, and unemployment-day information you enter.
• Travel logs, document-fact checklists, and saved admission-record snapshots.
• CPT records and reporting logs.
• Documents you attach (PDF or JPEG files).
• USCIS receipt numbers and case-status history (see Section 3).
• Reminders, notification schedules, and app settings.
• Your app PIN (stored only as a salted cryptographic hash; we never see your PIN).
• A local activity log (event types and timestamps only, such as sign-in, backup, export, or reset; never the contents of your records), kept on your device for security
• Your choice to enable Face ID or Touch ID unlock. The biometric match is performed entirely by your device’s operating system; we never receive or store your fingerprint or face data.

Reminders and notifications are generated locally on your device. We do not operate a push-notification server.

If you delete the app, this on-device data is deleted with it (subject to your device’s operating-system behavior).

Manual encrypted backup files and cross-platform transfer

You can create a password-protected .eadlybackup file and restore it on a supported iOS or Android device, including when moving from iOS to Android or from Android to iOS. This manual file feature is separate from the account-based, end-to-end encrypted cloud-backup service described in Section 2 and does not require an EADly account.

The app encrypts each new manual backup file on your device using AES-256-GCM. The encryption key is derived from the file password you select using PBKDF2-SHA-256 with 210,000 iterations. The password and derived key are not sent to Ethos. We cannot recover the password or decrypt the file without it. If you forget the file password, the encrypted manual backup is unrecoverable.

A manual backup may contain core profile and immigration-status information, I-94/admission and extension records, immigration timeline data, settings, employment and travel records, saved documents and attachments, planner and GrowthV2 data, and completed tasks. It does not contain your cloud-account login session, OTP credentials, automatic-backup encryption keys or recovery credentials, app PIN, biometric configuration, or operating-system notification permission.

When you create a manual backup, storage depends on your platform. On iOS, if iCloud Drive is available, the app saves an encrypted recovery copy in EADly’s app-owned iCloud Drive folder and also opens the system export picker. On Android 10 or later, the app saves the encrypted file in Downloads/EADly. Browser and fallback flows offer a system share or download action. These actions occur only after you choose to create a backup and set its password.

EADly and Ethos do not receive, upload to our systems, host, or retain the manual file. Apple, Google, or another destination provider may store it under that provider’s terms and privacy practices.

When you tap Get Started, the native app may check its managed recovery location for an actual .eadlybackup file. It validates the encrypted file before offering restore. It does not treat an earlier installation or a second tap as proof that a backup exists. On iOS, EADly cannot scan arbitrary Files locations; you must choose any file outside its app-owned iCloud Drive folder with the system document picker.

When you import, the operating system’s document picker gives the app access only to the file you select. The feature does not require broad access to your photo or file library. The app validates and size-limits the file, decrypts it locally, and shows a preview.

The app applies the restore only after your clear confirmation. A confirmed restore replaces the app data on that device. The app creates a rescue snapshot and tries to roll back if the restore fails. Keep a separate copy until you verify the restored data.

If you are already signed in, choosing the separate “Use file and update cloud” action may send the restored data into your existing end-to-end encrypted cloud backup. Revision-aware conflict protection pauses the update instead of silently overwriting a newer cloud version. No manual-file data is sent to our cloud service merely because you select, preview, or restore the file locally.

For compatibility, the app may import a legacy plaintext JSON backup after warning you that it is unencrypted. New manual exports use the encrypted .eadlybackup format. Treat any legacy plaintext backup as sensitive and delete or secure unnecessary copies.

2. Information we process if you create an account

Creating an account is optional and is only needed for automatic backup, in-app feedback, and API-based USCIS case-status tracking if that feature becomes available after USCIS approval. Saving a receipt locally and opening the official USCIS Case Status website do not require an account.

• Account identity. You may sign in with an email one-time code, Apple, or Google. Depending on your choice, we process your email address and the provider identity needed to create the EADly session. Sign in with Apple may provide a private relay address. We do not receive your Apple or Google password. Sign-in uses short-lived session tokens that expire and rotate automatically.

Automatic backups. Automatic backup is off until you enable it and choose iCloud Drive or Google Drive. The app then writes encrypted backup snapshots to an EADly-specific location in the storage account you authorize. Every new snapshot is end-to-end encrypted on your device before upload. Ethos and Supabase do not receive or host the snapshot contents.

A random data key encrypts each backup with AES-256-GCM. The recovery method depends on the destination:

• iCloud Drive: EADly generates the key automatically and stores it in an app-private, synchronizable iCloud Keychain item. No separate backup passphrase is required. Apple describes iCloud Keychain data as end-to-end encrypted and states that Apple cannot read it. Restoring requires the same Apple Account with iCloud Keychain available. Ethos and Supabase never receive the key.
• Google Drive: EADly protects the key with a backup passphrase you choose and a one-time recovery code, using PBKDF2-SHA-256 with independent random material. Neither credential is sent to Ethos, Supabase, or Google. We cannot read the backup or reset the passphrase.

If iCloud Keychain is unavailable, disabled, or no longer accessible through the same Apple Account, the iCloud backup may be unrecoverable. If you lose both the Google Drive passphrase and recovery code, the Google Drive backup is unrecoverable. Your on-device data is not affected. You may also create a password-protected manual backup file from Settings.

Backup routing metadata. To find the right provider backup after you sign in on another device, Supabase stores only your EADly user ID, selected provider, a random backup-set identifier, protocol version, connection state, and timestamps. It does not store your provider access token, provider file ID, iCloud encryption key, Google Drive passphrase or recovery code, wrapped key, or backup contents.

EADly Plus and purchase status. If you open the EADly Plus screen, make or restore a purchase, or use a Plus feature, the Apple App Store or Google Play and RevenueCat process purchase and entitlement information. This may include the selected product, store, transaction and subscription status, trial or offer status, purchase and expiration dates, and a RevenueCat App User ID.

When you are signed in, EADly may link that identifier to your non-email Supabase user UUID so a verified entitlement can follow your EADly account. EADly does not send RevenueCat your email, name, employer, school, immigration category, receipt number, document metadata, or exact immigration dates. Apple or Google processes your payment credentials. Ethos and RevenueCat do not receive your full payment-card number.

Session data. Standard authentication tokens with automatic expiry, used to keep you signed in securely.

Database access is restricted by row-level security so an account can only ever access its own records.

Your choices, and the trade-offs of sharing

Sharing any data with our backend is optional and within your control:

• Stay fully local. If you never create an account, your data stays on your device and we receive nothing. You may still save receipt numbers locally, open the official USCIS Case Status website, and transfer your data manually between supported iOS and Android devices using an encrypted .eadlybackup file. The trade-off is that you get no account-based automatic backup or recovery.
• Enable cloud backup. The benefit is that you can restore your data if you lose or replace your phone. The risk is that an encrypted copy leaves your device. We cannot read it. iCloud recovery depends on access to the same Apple Account and iCloud Keychain; Google Drive recovery depends on the passphrase or recovery code.
• Open official USCIS Case Status. The current public app opens the official USCIS website when you choose to check a saved receipt. The receipt is sent directly to USCIS through that website. It does not pass through EADly’s backend, and EADly does not retrieve or monitor the result.
• Use API-based tracking, if available. This feature depends on USCIS production approval and is not part of the current public app. If activated later, it will require an account and will send the receipt through EADly’s authenticated backend to USCIS so the status can be returned to the app.
• Turn on analytics. The benefit is helping us improve the app. It is off by default, anonymous, and limited to a fixed list of non-personal events, and you can turn it off at any time.
• Use EADly Plus. The benefit is access to optional organization features. The trade-off is that the applicable app store and RevenueCat process purchase and entitlement information. Your immigration records remain local unless you separately enable encrypted backup.

3. USCIS case status checks

USCIS considers receipt numbers Personally Identifiable Information (PII). EADly treats a receipt number as personal information.

Current public app. You may save a receipt number in local app data. When you select Check on USCIS.gov, EADly opens the official USCIS Case Status website with that receipt. The receipt is sent directly from the website view to USCIS. It does not pass through EADly’s backend. EADly does not retrieve, monitor, or store the result.

API-based tracking if available after USCIS approval. EADly may later offer optional in-app case-status tracking after USCIS grants production access. If that feature is activated, it will require a signed-in account. EADly will use the receipt only to request matching status information from the USCIS Case Status API. The app will send it over a TLS-encrypted HTTPS connection to our authenticated backend. The backend will make the corresponding TLS-encrypted request to USCIS and return the response to your device. We will not use the receipt for advertising, analytics, profiling, or any unrelated purpose.

• The receipt number and any case-status history created by an available API-based tracking feature are stored in the app’s local, OS-protected storage on your device. The optional app PIN controls access to the app; we do not describe it as a separate encryption layer for local storage.
• If you enable automatic backup, the receipt number and case-status history may be included in the end-to-end encrypted backup stored in the iCloud Drive or Google Drive account you select. Ethos and Supabase do not receive the backup plaintext or decryption keys.
• If API-based tracking is activated, the Supabase backend will process the receipt number transiently in the authenticated Edge Function. We do not intentionally write receipt numbers, request URLs, or response bodies to a backend database or provider logs. Rate-limit counters use account and request metadata and do not contain receipt numbers.
• We retain the receipt number in local app data until you edit or remove it, reset or delete your local EADly data, or remove the app, subject to copies you export or store with Apple, Google, or another destination. Removing a saved receipt also removes any older local case-status history and refresh metadata for it. If the same receipt is saved in your OPT, STEM OPT, H-1B, or O-1 record, removal also clears that matching receipt. Application, filing, receipt-notice, EAD, and decision dates remain saved because they support your timeline independently of the receipt number.
• Your receipt number is shared with USCIS (a U.S. government service) only when you use this feature, so USCIS can identify the case and return its status. USCIS handles it under applicable law and its own privacy terms.

4. Feedback

In-app feedback requires a signed-in account. If you submit feedback, we deliver the message you write to our support mailbox through our email delivery provider so we can respond. We include it with the email address associated with your account (and a separate reply email if you provide one), a reference to your account, and which app screen you were on. Please do not include sensitive information you do not want to share.

5. Analytics (opt-in)

Analytics is disabled by default. If you opt in:

• Events are sent to PostHog (hosted in the United States) using a random install identifier that is not linked to your name, email, or account.
• Only a fixed allowlist of product events is sent (for example, “screen viewed”, “feature used”), with properties filtered through a blocklist so that emails, names, dates, employers, schools, receipt numbers, files, notes, and similar personal values are never transmitted.
• We do not use cookies for analytics, autocapture, session replay, or heatmaps, and we do not build personal profiles.

You can turn analytics off at any time in Settings, with immediate effect.

6. Service providers

Ethos engages the following service providers to deliver specific functions. They process data for Ethos under their own security and privacy commitments and, where applicable, only on Ethos’s instructions:

Our service providers are contractually bound to protect your data and handle it consistently with this Privacy Policy. They may use data only to provide the service we hired them to provide. They may not sell it or use it for their own advertising or marketing. Apple and Google act as independent identity or storage providers under their own terms when you select them. USCIS handles receipt numbers under applicable law and its own terms when you request a case-status lookup.

Limits on third-party use and disclosure

We do not permit a third party to use or disclose user information for its own purpose without the user’s active consent. This rule includes information described as de-identified, anonymized, or pseudonymized. We do not share such information for advertising, marketing, research, sale, or any other independent use.

PostHog receives anonymous product events only after you actively turn on analytics. Supabase, RevenueCat, Resend, and Netlify may process only the information needed for the services listed above. They must follow contractual protections that are consistent with this policy. A third party may disclose information when the law requires it, but it may not use that information for another purpose.

We may disclose information when the law, legal process, or a valid government request requires it. We may also disclose limited information to protect users or others, investigate abuse, or enforce our Terms. We disclose only what we believe is necessary. Where the law permits, we will try to notify the affected user.

7. International data transfers

EADly is operated from the United States by Ethos Systems, LLC. Our service providers, and Apple or Google when you select them, may process information in the United States and other countries where they operate. If you use optional online features, your account identity, purchase status, or encrypted backup package may therefore be processed outside your country of residence. If API-based USCIS tracking is activated and you use it, your receipt may also be processed in those locations. Where required by law, Ethos uses appropriate safeguards for transfers for which it is responsible.

8. What we do NOT do

• We do not sell, rent, or trade your personal information.
• We do not show ads or use advertising networks or cross-app trackers.
• We do not collect precise location from your device, contacts, photos (beyond documents you explicitly attach), or device identifiers for tracking. The app stores any employment location you choose to type as part of an employment record under Section 1.
• Because every cloud backup is end-to-end encrypted on your device, we cannot read your backups, your documents, or your timeline data.

Your information concerns only you. The service providers identified as such in Section 6 act on our behalf. Apple and Google act under their own terms when you select their identity or storage service. The U.S. government’s USCIS Case Status service receives only a receipt number you choose to check.

EADly does not ask for genetic information, family history, biometric identifiers, financial details, payment-card details, or medical records. Do not place medical or health information in notes or uploaded documents. If you choose to include it anyway, it stays on your device unless you enable cloud backup. A cloud copy is end-to-end encrypted and cannot be read by us.

EADly does not ask you to type payment-card details into the app. Apple or Google presents and processes the native purchase sheet. RevenueCat receives purchase and entitlement information needed to operate EADly Plus, but it does not receive your full payment-card details or your immigration records from EADly.

How sharing could affect other people. EADly does not ask for data about anyone other than you, and it never asks for genetic information or family medical history. Your notes and uploaded documents can still mention someone else, such as a dependent, a family member, or an employer contact. If you share a backup file or a document that includes their details, you could expose that person’s private information without their consent. That exposure could affect their immigration, insurance, or job interests. Please get a person’s permission before you include their information, or remove it before sharing.

9. Data retention and deletion

• Local data and manual files: app data is under your control; delete it in-app (reset) or by removing the app. Manual .eadlybackup files are retained where the app saves them or where you choose to share them, not on our systems. Deleting your EADly account or app does not delete manual files or copies that you created, exported, or moved into Files, Downloads, iCloud Drive, Google Drive, messages, or other third-party destinations; you must delete those copies yourself.
• Account and automatic backups: use Settings → Delete Account & Data in the app. Before deleting the EADly account, the app attempts and verifies deletion of the connected provider backup while it still has authorization. It then deletes routing metadata and the EADly account. If provider deletion cannot be verified, account deletion stops so the app can tell you what remains. Provider copies you created or moved outside EADly’s managed location must be deleted by you.
• Feedback emails: retained in our support mailbox as long as needed to handle your request.
• Subscription records: Apple, Google, and RevenueCat retain purchase and entitlement records under their own legal, accounting, security, and service requirements. EADly keeps current RevenueCat customer information in memory and does not store a separate local isPlus flag. Account-linked entitlement history may remain with RevenueCat as required to restore, audit, or administer purchases.
• Operational records: transient technical records such as rate-limit counters are kept only as long as needed for security and abuse-prevention.
• Inactive (dormant) accounts: we keep your EADly account and routing metadata until you delete them. If an account has had no activity for 24 months, we may email you and then delete that EADly-held account data if you do not respond within 30 days. We cannot later delete an automatic backup held by Apple or Google without current provider authorization; it may remain in the provider account until you delete it there or use the app’s authenticated deletion flow. Your on-device data is never affected.

Business transfer, change of operator, or closure

We will notify you of a material ownership or operator change. Where reasonably possible, we will give in-app notice before the change takes effect.

Backend data includes your account email, minimal provider-routing metadata, and operational records. It will be securely transferred to a successor that must protect it, or it will be securely deleted. Provider-owned automatic-backup snapshots are not part of EADly’s backend data. Any transfer remains subject to applicable law.

A successor must follow a privacy policy that is materially consistent with this one. If it will not, we will notify you and let you export or delete your data before the change.

Because every cloud backup is end-to-end encrypted with a key unavailable to Ethos, no successor operator or backend provider can read your cloud backup contents. Access to the USCIS Case Status service is granted specifically to the current operator and is not transferable. A successor operator must obtain its own access before that feature can resume, which may take time.

You can also export your own data as an encrypted backup file and import it again at any time (Settings → Export / Import backup file). That lets you keep an independent copy, or move it to another operator of the app.

10. Security

Security measures include:

• For automatic backups: end-to-end encryption performed on your device with a random AES-256-GCM data key. For iCloud Drive, the app stores that key in a private synchronizable iCloud Keychain item and does not ask for a separate passphrase. For Google Drive, it wraps the key under a passphrase and one-time recovery code using PBKDF2-SHA-256 with 210,000 iterations and fresh random material. Our servers receive neither provider-backup ciphertext nor any decryption key or recovery credential.
• For manual .eadlybackup files: client-side AES-256-GCM encryption with a file key derived from your selected file password using PBKDF2-SHA-256 (210,000 iterations). This file password is distinct from your cloud-backup passphrase, recovery code, account OTP, and app PIN. We do not receive it and cannot reset or recover it.
• For EADly account and routing data: encryption in transit (TLS), encryption at rest in Supabase, and row-level security so each account can access only its own routing record.
• For API-based USCIS case-status tracking, if activated: TLS-encrypted connections from the app to the authenticated backend and from the backend to USCIS; receipt numbers are processed transiently and are not intentionally written to the backend database or provider logs.
• Salted-hash PIN protection with lockout, OTP-only sign-in, and short-lived rotating session tokens.
• Server-side rate limiting on backend functions, and a strict content-security policy in the app.

No system is perfectly secure. A breach of our servers could expose account and minimal routing information. Provider-owned backup snapshots are not stored on our servers, and every backup package is end-to-end encrypted with keys we do not have.

Vulnerability reports

If you believe you have found a security vulnerability, email support@eadly.app with enough detail for us to investigate. Please do not access another person’s data, disrupt the Service, or publicly disclose an unresolved vulnerability before giving us a reasonable opportunity to investigate and address it.

Data-breach notification

If we learn of a personal-data breach that affects you, we will notify you without undue delay. We will also meet any deadline set by law. We will use your account email or an in-app notice.

The notice will explain what happened and what information was involved, as far as we know. It will explain what we are doing and what steps you can take. Cloud backups are end-to-end encrypted with keys unavailable to us. Our servers do not hold the provider backup ciphertext.

11. Your rights

Depending on where you live, you may have rights over your personal data. Because almost all data lives on your device, and cloud backups are end-to-end encrypted with keys unavailable to us, many of these rights are exercisable directly in the app (export, reset, delete account, analytics toggle, and backup controls).

United States (state privacy laws, including the California Consumer Privacy Act)

You may have rights to know, access, delete, and correct your personal information. You may also have the right to act without discrimination. We do not “sell” or “share” personal information as those terms are defined by U.S. state privacy laws. Where the California Consumer Privacy Act (CCPA), as amended by the CPRA, applies, we honor its requirements. Use the app or contact us to exercise your rights. We will not discriminate against you for doing so.

EU / UK (GDPR)

You have the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent at any time. Our legal bases are: performing our agreement with you (providing the app’s online features), our legitimate interests (security and abuse-prevention), and your consent (optional analytics and optional cloud backup). You may lodge a complaint with your local supervisory authority (in the UK, the ICO).

To exercise any right not available directly in the app, contact us (see the Contact section below). We will verify your request as needed and respond within the period required by applicable law.

12. Children

EADly is intended for people age 16 or older organizing personal immigration records. It is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us and we will delete it.

13. Our website (eadly.app)

The eadly.app website is hosted for us by Netlify (United States). Like most website hosts, Netlify keeps standard server logs, which include visitor IP addresses, for security and to deliver the site. The website itself sets no analytics or advertising cookies.

If you join the launch waitlist, Netlify Forms stores the email address for us. We use it only to tell you about EADly’s launch and availability. We do not use waitlist emails for other marketing. We share them only with Netlify, which stores them on our behalf.

You can ask us to delete your waitlist email at any time. Write to admin@eadly.app.

14. Important note on immigration information

EADly provides informational tools only. It does not provide legal advice, and nothing in the app creates an attorney-client relationship. Immigration rules change and individual circumstances differ. Always verify deadlines and requirements with official USCIS sources, your Designated School Official (DSO), and a qualified immigration attorney before acting.

EADly is a private service and is not affiliated with, endorsed by, or connected to USCIS, DHS, ICE, SEVP, the U.S. Department of State, any other government agency, any university or school, any DSO, or any employer. References to these organizations and to government data are for identification and informational purposes only.

15. Governing law

This Privacy Policy is governed by the laws of the State of Wyoming, United States, and applicable U.S. federal law, without regard to conflict-of-laws rules, except where mandatory data-protection or consumer-protection law in your country or state of residence applies.

16. Changes to this policy

We will post any changes on this page with an updated effective date. For minor or clarifying changes, posting the update is enough.

For a material change, we will notify you in the app before it takes effect. We will show a plain-language summary of the change. We will ask for your active consent through an explicit “I agree” action.

The new policy will not apply to you until you agree. You must agree before you continue using optional online features, including the account, cloud backup, in-app feedback, and API-based USCIS tracking if it becomes available. If you do not agree, you may keep using on-device features and official external links under the prior terms. You may also export your data or delete your account.

17. Contact

For privacy questions, requests, or grievances, contact the operator and data controller:

See also our Terms of Use.