Privacy Policy

Version 1.1.0
September 20, 2026

Privacy Policy

Effective Date: September 20, 2026

1. Introduction

ImmSight LLC ("ImmSight," "we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our immigration case tracking service at immsight.us.

2. Information We Collect

2.1 Information You Provide

Account Information:

  • Email address (from Google sign-in, or the address you request a sign-in link for)
  • Google account identifier, if you sign in with Google. We request only your email address from Google — not your name, contacts, or profile.
  • Display name for community features (a generated name is assigned at sign-up; you may change it)
  • Profile photo (optional)
  • Notification preferences

Case Tracking Information:

  • USCIS case receipt numbers you add
  • Form type, eligibility category, priority date and applicant nationality (all optional) that you attach to a case
  • Your personal notes on cases
  • Custom labels/names for your cases

A case record is shared: if another ImmSight user adds the same receipt number, they see the same case record, including the form type, category, priority date and nationality attached to it. Your notes, labels, email address and identity are never shared with them.

Community Content:

  • Discussion posts, comments and reactions you create
  • Tags on your posts
  • Reports you submit about other users' content

Support Communications:

2.2 Automatically Collected Information

Authentication and Session Data:

  • Login event records (timestamp, sign-in method, IP address, browser user agent) written to our internal audit log on every sign-in. These records are retained for the windows described in §6.4 and are used solely for account-security investigations and abuse prevention.
  • Active-session records (device/browser description, IP address, last-seen time) so you can review and sign out your devices in Settings
  • Session identifiers (stored as one-way hashes; the identifier itself lives only in your browser cookie)
  • Sign-in link requests (email address, IP address, browser user agent)

Activity Records:

  • Account changes (display name, photo, settings), case tracking actions, and community actions (posts, comments, reactions, reports) in our internal audit log

Server Logs:

  • Our web servers and network provider record the IP address, request path and browser user agent of each request for security and operational purposes. We do not run third-party analytics or advertising trackers.

2.3 Government Data

Case Information:

  • Case status and status history retrieved from the official USCIS Case Status API for the receipt numbers you add
  • Monthly Visa Bulletin data from the U.S. Department of State
  • Immigration news from the USCIS news feed

3. How We Use Your Information

We use your information for the following purposes:

3.1 Service Provision:

  • Create and manage your account
  • Track and update your immigration cases
  • Display case status, processing time and Visa Bulletin analytics
  • Enable community discussions

3.2 Service Improvement:

  • Analyze usage patterns to improve features
  • Develop new features based on user needs
  • Optimize performance and reliability

3.3 Communication:

  • Send case status update notifications
  • Send community reply notifications, service announcements and, if you opt in, a weekly digest or product news
  • Provide security alerts, legal notices and important notices
  • Respond to your inquiries and support requests

3.4 Security and Compliance:

  • Detect and prevent fraud and abuse
  • Comply with legal obligations
  • Enforce our Terms of Service

3.5 Analytics:

  • Generate aggregated, anonymized statistics
  • Understand immigration trends and processing times
  • Improve data accuracy and completeness

3.6 Community Insights (Aggregated & De-identified):

  • We combine the cases our users choose to track into aggregate, de-identified insights that we show back to you inside the app — for example, how cases similar to yours are progressing, typical processing times for your cohort, recent approval durations, and where your case sits relative to others filed around the same time.
  • These insights are always aggregated or de-identified. We never show you another user's individual case — their receipt number, personal timeline, or identity — and we never show your case to another user. Only you (and anyone else who has added the same receipt number, as described in §2.1) can see your case's full detail.
  • We compute these insights from data already stored in ImmSight; generating them never requires sending your information to USCIS or any third party.

4. How We Share Your Information

WE DO NOT SELL YOUR PERSONAL INFORMATION. We do not sell, rent, or trade your data for profit or any monetary transactions.

We prohibit third-party use or disclosure of user information (including de-identified, anonymized, or pseudonymized data) for any reason without your active consent. The providers below may process your information only to deliver their service to us and are bound to protect it under terms consistent with this policy.

We may share information only in the following limited circumstances:

4.1 With Your Explicit Consent:

  • When you specifically authorize us to share your information

4.2 Essential Service Providers:

  • Google — receives your sign-in request when you choose to sign in with Google, and tells us your email address and account identifier
  • Resend — delivers our email to you; it receives your email address and the content of each message we send
  • Cloudflare — carries all traffic between your browser and our servers and filters malicious requests; it sees your IP address and the requests you make
  • USCIS — receives the receipt numbers you add when we retrieve case status on your behalf, through the official Case Status API
  • Our servers and database are operated by ImmSight

4.3 Legal Requirements:

  • To comply with legal obligations, court orders, or government requests
  • To protect our rights, property, or safety, or that of our users

4.4 Business Transfers:

  • In the event of a merger, acquisition, or sale of assets:
    • You will be notified via email at least 30 days in advance
    • The new owner must maintain equivalent privacy protections
    • You may export your data and request account deletion before the transfer

4.5 Aggregated Analytics Data Only:

  • We may share anonymized, aggregated statistics that cannot identify individuals
  • Example: "Average I-485 processing time for EB-2 India cases"

4.6 Public Content:

  • Your community posts, comments, display name and profile photo are public and can be read by anyone, including people without an ImmSight account. Reaction counts are public, but who reacted is not shown. Your email address is never displayed.

5. Data Security

We implement industry-standard security measures to protect your information:

5.1 Technical Safeguards:

  • Encryption in transit (HTTPS/TLS)
  • Secure session management with HTTP-only cookies
  • Sign-in links and session identifiers are stored only as one-way hashes
  • Profile photos are resized and stripped of embedded metadata (such as location) before storage

5.2 Access Controls:

  • Role-based access control (RBAC) for our staff
  • Multi-factor authentication for administrative access
  • Principle of least privilege

5.3 Monitoring:

  • Security incident logging
  • Automated vulnerability scanning of our code, dependencies and container images on every release
  • Regular vulnerability assessments

5.4 Limitations: No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention and Deletion

6.1 Active Accounts:

  • We retain your information for as long as your account is active or as needed to provide services.

6.2 Account Deletion — Easy and Complete:

  • You can delete your account at any time from your account Settings page
  • Your account is deactivated immediately: your email address, profile photo and notification preferences are removed, all your devices are signed out, and we email you a one-time restoration link
  • You have 14 days to use that link and restore your account with all your data intact. Signing in again does not restore it; only the link does.
  • After 14 days, an automated job permanently deletes your personal information
  • What we permanently delete:
    • Your email address and sign-in linkages (Google account identifier)
    • Your display name and profile photo
    • Your personal notes on cases and your custom case labels
    • Your case tracking list, and every case record and status history that no other user is tracking
    • Your notification preferences, notifications and policy consent records
  • What we keep:
    • Your community posts and comments remain visible, permanently attributed to "Deleted User" with no link back to you. You can delete individual posts and comments yourself before deleting your account.
    • Case records that another ImmSight user is still tracking remain, without any link to you
    • Audit-log entries for the windows in §6.4. Once your account is purged they are detached from it and contain no email address or display name.
  • If you never accepted our policies (you signed in but did not complete registration), your account is deleted immediately with no grace period.

6.3 Dormant Accounts:

  • Inactive accounts remain until you explicitly delete them
  • We do not automatically delete dormant accounts
  • You remain in full control of your data

6.4 Audit Log and Housekeeping Retention:

  • Login and routine activity records (sign-ins, case tracking actions, reactions) are retained for 365 days and then automatically purged.
  • Security and moderation audit records (account changes, community posts, comments and their moderation, administrative actions) are retained for up to 3 years to support dispute resolution and abuse investigations.
  • Sign-in link requests are deleted 7 days after they are used or expire. Session records are deleted once the session can no longer be used: at most 7 days after sign-in, or 7 days after you sign out or we revoke it.
  • In-app notifications are deleted 30 days after you read them, or after 180 days regardless.
  • Legal-hold material subject to a court order, subpoena, or other legal obligation will be retained for as long as the law requires, even past the windows above.
  • Security incident records may be kept for the duration of an active investigation.

7. Your Rights and Choices

You have the following rights regarding your information:

7.1 Access and Portability:

  • Download a copy of everything we hold about you from Settings ("Export your data"), as a machine-readable JSON file. For your protection, a recent sign-in is required.

7.2 Correction:

  • Update your display name, profile photo, case labels, notes and case details in the app

7.3 Deletion:

  • Delete your account and personal information from Settings, as described in §6.2
  • Delete individual cases, notes, posts and comments at any time
  • Some information may be retained for legal compliance

7.4 Opt-Out:

  • Turn off case status emails, community reply emails, service announcements, the weekly digest and product news in Settings. Community, announcement, digest and product-news emails also carry an unsubscribe link.
  • Sign-in links, security alerts, legal notices and data-breach notices are essential to the Service and cannot be turned off

To exercise these rights, contact us at [email protected] or use your account settings.

8. Cookies

We use only essential cookies required for authentication and session management. We do not use analytics, advertising, or third-party tracking cookies.

Cookies we set:

  • __Host-immsight_session — sign-in session (HTTP-only, Secure; expires after 7 days, or after 24 hours of inactivity)
  • sidebar_state — remembers your sidebar layout (7 days)

We also cache your basic profile (email, display name, avatar) in your browser's localStorage for up to 10 minutes after sign-in so the app loads faster, and store a few display preferences there (for example, list or grid view). This data stays on your device; the profile cache is cleared when you sign out.

9. Third-Party Services

9.1 Google Sign-In:

  • Google OAuth for authentication, requesting only your email address
  • Subject to Google's privacy policies

9.2 Government Data Sources:

  • Case status information is obtained from the official USCIS Case Status API, under the USCIS Terms of Use, for the receipt numbers you add
  • Visa Bulletin data is obtained from the U.S. Department of State; immigration news from the USCIS news feed. Neither request includes any information about you.

9.3 Third-Party Links:

  • Our Service may contain links to third-party websites
  • We are not responsible for third-party privacy practices

10. Children's Privacy

ImmSight is not intended for children under 13. We do not knowingly collect information from children under 13. If we discover we have collected such information, we will delete it promptly.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for international transfers.

12. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

  • Right to know what personal information is collected
  • Right to delete personal information
  • Right to opt-out of sale of personal information (we do not sell information)
  • Right to non-discrimination for exercising privacy rights

13. European Privacy Rights (GDPR)

If you are in the European Economic Area, you have rights under the General Data Protection Regulation:

  • Right to access, rectify, and erase personal data
  • Right to restrict or object to processing
  • Right to data portability
  • Right to withdraw consent
  • Right to lodge a complaint with a supervisory authority

14. Security Incident Notification

In the event of a data breach that affects your personal information, we will notify you:

  • Via email to your registered email address, describing what happened, what information was affected, what we have done, and what you can do
  • Through an in-app notification the next time you sign in
  • Within the timeframe required by applicable law

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Every change is published as a new numbered version with its own Effective Date, both shown at the top of this page.

We will get your active consent for changes:

  • You will receive an email notification when this policy is updated with a plain-language summary of what changed
  • When you next use the Service, you will be prompted to review and accept the new policy
  • You must actively accept the updated policy to continue using the Service
  • If you do not accept, you may delete your account from Settings instead

16. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us:

Email: [email protected]

For data deletion requests, security concerns, or privacy inquiries, email us at [email protected] and we will respond within 7 business days.

By using ImmSight, you acknowledge that you have read and understood this Privacy Policy.