Law Enforcement Guidelines

These guidelines are for law enforcement and other government agencies asking for information about Cotrest users. Cotrest is operated by Juschin Labs, a company in Brentwood, California, United States. Users can read this page too: it explains when we disclose data and when we tell you about it. It isn't legal advice and doesn't create rights for anyone.

Our approach

We disclose user information only in response to valid legal process, or in an emergency involving an imminent risk of death or serious physical injury. We review every request, ask for clarification when a request is unclear, and narrow or decline requests that are overbroad or not legally valid. We follow the US Stored Communications Act and, for California government entities, the California Electronic Communications Privacy Act.

How to submit a request

Email legal@cotrest.com from an official government email address, with "Law enforcement" in the subject line. We don't accept requests through the support form, the report form or social media. Please include:

• Agency name, the requesting officer's name, badge or ID number, official email address and phone number.
• The legal process document, signed and attached as a PDF.
• The account you are asking about: the profile URL (cotrest.com/u/handle), the handle, or the email address used to sign up. We can't search by name alone.
• The specific information requested and the date range. Narrow requests are handled faster.
• Any deadline, and whether a court has ordered us not to notify the user.

What legal process we need

• Basic account information (email address, handle, sign-up date, sign-in times and IP addresses): a subpoena, or a court order or warrant.
• Other records (activity logs, sessions, device and browser information, approximate location): a court order such as one under 18 U.S.C. § 2703(d), or a search warrant.
• Content (pitches, topics, comments, support messages, uploaded images): a search warrant.

Requests from outside the United States should come through a mutual legal assistance treaty, letters rogatory or another process recognised under US law. We may respond directly to genuine emergencies from any country.

What we can provide

• Account details: email address, handle, display name, bio, account type, sign-up date, last sign-in.
• Sign-in methods (for example Google), sign-in and session times, and device and browser (user agent).
• IP addresses with approximate location derived from them (country, region, city) and network provider, for the last 180 days.
• Activity on the service: pitches, backing, topics, comments (including removed ones), follows, reports, appeals, profile claims and support requests.
• Images uploaded to a creator page the user manages.

We deliver records as a ZIP file with a README, a manifest of SHA-256 checksums, data in JSON and CSV, and a merged timeline in UTC. A records custodian declaration is available on request.

What we can't provide

• Passwords. We store only salted hashes and can't read them.
• Private messages between users. Cotrest has none.
• Precise location, phone numbers or payment details. We don't collect them.
• IP addresses older than 180 days, or data from accounts that have been purged after the 30-day deletion grace period, unless the data was preserved first.
• Information about public figures listed on Cotrest who haven't joined, beyond what is shown publicly on their page.

Emergency requests

If there is an imminent risk of death or serious physical injury, email legal@cotrest.com with "EMERGENCY" in the subject. Tell us the nature of the emergency, who is at risk, how the information requested would help, and how to reach the requesting officer. We may disclose information without legal process if we believe in good faith that the emergency is real and the information will help. We check the legal inbox regularly, including for emergencies, but can't guarantee a response time. If someone is in immediate danger, contact local emergency services first.

Preservation requests

On a valid preservation request (for example under 18 U.S.C. § 2703(f)) we keep a copy of the account's existing data for 90 days, and for one further 90-day period if you renew the request. Preservation stops the data from being deleted, including by the user's own deletion request, but we don't disclose preserved data without valid legal process.

Telling users

We tell users before we disclose their information, so they can seek legal advice or challenge the request. We don't give notice when the law prohibits it (for example a nondisclosure order under 18 U.S.C. § 2705(b)), in emergencies, in child-safety matters, or when notice would be counterproductive, for example because it would put someone at risk. When a nondisclosure order ends, we may notify the user then.

Child safety

We report apparent child sexual exploitation to the National Center for Missing & Exploited Children (NCMEC), as US law requires, and preserve the related data.

Costs

We may ask for reimbursement of reasonable costs where the law allows.

Transparency reporting

We plan to publish the number of government requests we receive, by type and country, and how we responded, as part of our transparency reporting. We won't include details that identify an investigation.

Contact

Juschin Labs, Brentwood, California, United States · legal@cotrest.com. Privacy requests from users go to privacy@cotrest.com.