Law-Enforcement Guidelines

We disclose account or message records only in response to a valid legal request under applicable law (e.g., a court order, subpoena, or warrant), or where the law otherwise permits or requires it. Emergency disclosure requests involving a risk of death or serious harm are handled on an expedited basis.

We practice data minimization, so for many requests the honest answer is that the record does not exist. In particular, our scan records contain no IP address for the person who scanned — not raw, and not hashed — and no location, device, or browser information.

Two honest qualifications, because a flat denial would be wrong. First, our abuse-prevention store briefly holds a one-way hash of the requesting IP, used only to count how many requests that address has made in a short window. It is not the address, it is not linked to a tag or an account, and it expires on its own within minutes. Second, like any website, our hosting and bot-protection providers see the IP address of an incoming request, and our hosting provider’s own platform logs record it along with the browser and page path for a limited period. Those logs are not ours to scrub and we do not import them into our systems. Both are described in our Privacy Policy and the providers are named in our sub-processors list.

What we can generally provide, where it still exists: account records for a registered owner; the content of a message a sender submitted through the service; consent and notification logs; and scan records, which hold the time, which tag was scanned, and whether the scan used the emergency or the everyday flow.

Separately, when a scan actually displayed an owner’s medical information, we write an entry to a tamper-evident access log. That entry records that an access happened, for which tag, and when. It contains no medical information itself, and because it stores only references rather than content, it survives the deletion of the account it refers to — which is deliberate, and is what makes it an access log rather than a second copy of the data.

Retention limits what any of that is worth. Aged records are cleared by a job we run rather than by a timer that fires the instant a window closes, so we cannot certify that a given record was removed on a particular date — only that it is subject to the rules in our Privacy Policy. We would rather state that plainly than imply a schedule we do not run.

On a valid preservation request, or where our Terms’ anti-abuse provisions apply, we may preserve relevant logs beyond normal retention.

Where lawful and not counter to an ongoing investigation or a safety risk, we aim to notify an affected account holder before disclosure.

Send lawful requests to support@tyratag.com with “Legal Request” in the subject. Include the legal basis, the specific records sought, and the account, tag, or phone number they relate to. A request that does not identify a specific subject is one we cannot act on.

We have received no law-enforcement or lawful-access requests to date. We intend to report the number of requests we receive and how we responded, and to update this section as that changes.