Privacy Policy

Core Principles

We exist only to help families. Every design and technical decision starts from one question: "Would I want my own family’s data handled this way?"

What we collect

• Only the name (or MDOC number) you search for, plus the date/time of the search (for rate-limiting and abuse prevention).
• If you sign up for a launch notification: your email address (stored encrypted at rest, never shared, never sold).
• Nothing else. No IP logs tied to searches. No device fingerprinting. No third-party analytics cookies or pixels.

What we never do

• We never display or log who searched for whom. Not to the public, not to MDOC, not to researchers, not to law enforcement, not even to our own team beyond aggregate rate-limit counters.
• We never sell, rent, or trade any data.
• We never use search data for advertising, profiling, or any purpose other than delivering the locator service and preventing abuse.
• We never require you to create an account to search.

Data retention and destruction

Search queries are retained for a maximum of 30 days solely for abuse detection, then permanently deleted. Launch notification emails are retained until you unsubscribe or the service launches, then purged within 30 days of launch unless you actively opt in to ongoing updates.

Sources

All data surfaced is drawn exclusively from public records (primarily MDOC OTIS and related FOIA releases). We add no private information. If a record is later sealed or expunged under Michigan law, we will remove it from results within 10 business days of verified notice.

Your rights

You may request deletion of any notification email address at any time (email families@findbehindbars.com). You may also request a record of any searches performed from your IP in the last 30 days (we will provide only the count and timestamps, never linked to names searched).

Security

The site is served over HTTPS only. Notification emails are stored encrypted at rest using keys held in a separate secrets manager. We undergo annual independent security review once the service handles real volume.

Changes

We will post any material changes to this policy at least 14 days before they take effect and notify anyone who has an active launch notification subscription.