GreenLight does not ask for or store your USCIS receipt number. Protected inputs reject receipt-shaped values before they can be decoded, saved, analyzed, emailed, or synced. This page maps every important exception and destination.
Custom case labels: Stored in browser storage and removed from every cloud-sync payload.
Checklist completion: Checked item IDs stay in browser storage for that device.
Unsubmitted RFE draft: A receipt-free draft stays in browser storage until you request an AI outline or letter.
Auth identity, selected case fields, fixed safe history, preferences, entitlements, activity timestamps, and owner-scoped generated letters. Owner checks and row-level security constrain access.
DeepSeek handles requested AI work, Maileroo delivers email, PostHog measures masked production use, Stripe processes payments, and Cloudflare delivers and protects the app.
The server derives the owner from the authenticated session. An explicit browser allowlist excludes custom labels, browser timestamps, profile-repair flags, and future UI-only fields; the API rejects unknown keys.
“Server” includes GreenLight's API, durable Supabase records, or a named processor. The row says which one.
| Data or action | Browser boundary | Server or processor boundary |
|---|---|---|
| USCIS receipt number | Not requested; protected fields reject receipt-shaped values | Not stored or intentionally transmitted |
| Selected case profile | Local case object | Supabase after sign-in through owner-checked APIs |
| Custom label + checklist | Stored on that device | Excluded from sync |
| Decoder input | Receipt-rejected before submit | GreenLight API; unknown receipt-free text may reach DeepSeek transiently |
| Saved history | User deliberately selects Save | Fixed safe summary/classification, dates, owner + case IDs; no raw text or AI prose |
| RFE drafting | Receipt-free draft can stay local until requested | DeepSeek processes requested input; Supabase stores finished paid letter only |
| Community milestone | Separate deliberate share action | Account-free public row + private HMAC anti-duplication receipt |
| Product use | Masked production events and replay | PostHog receives sanitized events and pseudonymous signed-in ID |
The share request is authenticated and includes the owned case and history IDs so GreenLight can verify ownership and derive the milestone. The resulting public observation can include case type, canonical field office, milestone, days from filing, optional petition type, and timestamp. It has no account, case, history, email, IP, or receipt-number field.
A separate private HMAC receipt, derived with a server secret, prevents repeat observations without storing the raw account or case ID in that receipt table. Public cohorts with fewer than 5 observations are suppressed.
Handles sign-in, selected signed-in case records, safe history, preferences, entitlements, and owner-scoped generated letters.
Provider policy →Delivers the app and can process request, network, cache, security, and operational log data.
Provider policy →Processes unknown receipt-free decoder input and receipt-free RFE drafting input when you request AI help. Its policy says data is stored in the People's Republic of China.
Provider policy →Processes the recipient, rendered message, delivery headers, and delivery information for enabled email.
Provider policy →Processes masked production analytics, heatmaps, session replay, product events, and error or performance signals.
Provider policy →Processes checkout, card and billing information, subscriptions, one-time purchases, refunds, and required transaction records.
Provider policy →Device state is cleared on each browser. Account deletion removes the Supabase Auth identity and linked application rows only after active subscription, open checkout, and processing-payment checks pass.
Account-free Community observations, identity-free completion receipts, backups, and security, tax, billing, dispute, or legally required provider records may remain. Read the authoritative Privacy Policy for the complete retention statement.