Privacy policy

Prelaunch app-policy draft · Receipt-number disclosure updated October 8, 2026 · Other sections dated September 22, 2026 · Not yet effective.

Who we are

OficialUSA is an independent immigration-information and preparation app. It is not affiliated with USCIS or any government agency and does not provide legal representation. Contact: [email protected].

OficialUSA is provided by OficialUSA LLC, a Florida limited liability company. This policy remains a draft and is not yet effective. The remaining policy content and effective date must be approved before publication or use for consent.

Public website and development app

This public website introduces OficialUSA before its app-store release. Cloudflare hosts the public pages and processes technical connection information, such as IP addresses and request times, to deliver and protect them. We have not added visitor analytics, advertising, account-registration forms, document uploads or checkout to this website.

The rest of this draft describes the development app, existing AI/news services and restricted account and USCIS tests. Online sign-in and purchase-history reads have been tested with a development account. A separate USCIS Sandbox connection is deployed for two dedicated test accounts using published mock cases. Public app release, live payments and real-case API monitoring are not enabled by these tests or this website.

Development accounts and USCIS tests

Supabase handles development sign-in and account records, including email addresses, account identifiers and authentication/session information. Resend delivers authentication emails. Render hosts the restricted account service used to check the owner's account and purchase history. Signing in does not upload or back up saved cases, documents or guided-form answers.

Cloudflare hosts the restricted USCIS Sandbox gateway and access service. Supabase holds test-account enrollment, assigned mock-case references, lookup consent and session-revocation records. Only approved test accounts can use that demo. USCIS receives requests for its published mock cases through the backend; no real immigration case is queried through this test flow.

Withdrawing test consent prevents further authorized lookups for that mock case. Ending the demo clears the displayed results and revokes demo access for that sign-in session. Neither action deletes the online account, all test records or provider backups. Development records and provider logs still require a reviewed retention and deletion schedule before public release.

Receipt numbers and case status

We collect the USCIS receipt numbers you enter into the app to save a case or check its status. USCIS considers receipt numbers personally identifiable information (PII). We treat them as personal information, not anonymous data. Enter only your own receipt number or one you are authorized to use.

When you choose a manual case-status check, the app submits the selected receipt number to the official USCIS case-status website over HTTPS. USCIS uses it to look up the case and return its status. The app can save the returned status with your case so you can review it later. This is a user-requested check, not automatic monitoring. USCIS handles information it receives under its own privacy practices.

Saved receipt numbers and case history remain in the app's local case records on your device. Signing in does not upload these saved records to your online account. The current case store does not apply app-level encryption to those records.

On iPhone, iOS provides device-level encryption and isolates each app's local storage from other ordinary apps. The default protection does not make these records inaccessible again each time the phone locks. These platform protections are separate from app-level encryption and do not extend to every exported copy.

If you enable the app passcode, it restricts access through the app's screens; it does not encrypt the saved case records. HTTPS protects the lookup in transit, but does not protect every stored copy. Protect access to your device and any exports or backups. We cannot guarantee that unauthorized access or disclosure will never occur.

Saved case records remain until you remove them from the app. You can delete a saved case or use the app's local-data deletion control. Receipt numbers may also appear in saved documents or exported data; deleting a case does not remove every separate copy. Local data exports are not encrypted by the app. Copies you export, device or cloud backups, and records held by USCIS are not erased by deleting the app's local records.

The separate USCIS Sandbox API test accepts only published mock receipt numbers and approved test accounts. Its backend checks the signed-in account's permission for the assigned mock case before returning a result. Production API lookups of real receipt numbers are not enabled. Before enabling that service, we must verify its storage, access controls, retention and deletion procedures and update this notice to identify the providers that will handle real receipt numbers. The test controls are not a claim that those production protections are already in place.

Do not put receipt numbers into AI questions. The case-status lookup and optional AI are separate features. The AI warning does not automatically remove personal information from text you submit; see Optional online features below.

Information on your device

OficialUSA is intended for adults age 18 and older, not for children to create accounts or use independently. An authorized adult may enter information about a child when preparing a family form. That information can still be sensitive; only enter what is needed and protect any copies. If you believe a child has sent us personal information, contact [email protected] without sending additional identity documents.

Saved cases can include receipt numbers, filing dates, office details, notes and status history. Documents can include images and scanned-notice fields. Reminders, emergency contacts, saved answers, language, news interests and study progress are also stored locally.

Guided-form answers can include names, birth dates, addresses, identification numbers and immigration or family history. Form-answer, citizenship and settlement stores are encrypted with keys held in platform secure storage. Case preferences and document files do not currently have equivalent application-level encryption. An app passcode is an access lock, not a promise that every file is encrypted. Device or cloud backups may retain copies under your platform settings.

PDF preparation happens on the device. Citizenship speech uses installed device voices; the current module does not record your voice or send speech recordings to us. ZIP-code suggestions use bundled GeoNames reference data on the device.

Optional online features

Ask AI sends the question text, selected language and a randomly generated app identifier to our Cloudflare backend; the question and language are sent to Anthropic for an answer. Understand this update sends selected status text, case type, language and an identifier through a similar flow. These identifiers are pseudonymous, not a guarantee of anonymity.

Do not include Social Security numbers, A-numbers, receipt numbers, full names or confidential documents in AI prompts. AI can make mistakes and is not legal advice.

The existing backend keeps daily usage counters for about 48 hours. It may cache responses classified by the model as general information for about 75 days. Normalized question or status text can be present in cache keys. That classification does not reliably remove personal information; avoid submitting it. Repeated requests can extend cached retention. Hardening and reviewing this behavior is a public-launch requirement.

Official sources, news and links

Public configuration, news and reference requests go to our backend, GitHub or source providers. They can receive IP addresses, request times and standard connection information. News interests and bookmarks stay local and are not sent with news-feed requests.

Opening an official case-status lookup can pass the selected receipt number to the official USCIS website. Other official websites, map links and package-carrier tools follow their own privacy practices. We do not submit immigration applications for you.

Notifications, exports and support

Reminder permissions control local notifications. The in-app alerts inbox is not a guarantee of background delivery or live USCIS monitoring.

Exporting data creates a readable, unencrypted JSON file without document-image bytes; it is not a restorable backup. PDFs and anything you choose to save, share or email leave the app through your chosen destination. Protect those copies.

If you email support, we receive your email address and whatever you include. The app does not automatically attach case information to support drafts. Please send a description of the problem without immigration identifiers or documents. Incoming support mail is forwarded by Cloudflare to a Microsoft Outlook mailbox; business replies use Microsoft Exchange Online. Synced mail apps and attachments saved separately may hold additional copies.

The owner has approved a proposed six-month retention period after resolution for ordinary support conversations and a 30-day target for handling eligible, verified deletion requests. These are not yet active public commitments. Selective deletion, recovery windows, saved copies and exceptions are still being checked. No automatic support-email deletion has been enabled. Payment, security and legally required records need separately reviewed retention rules.

Providers and security

Cloudflare hosts the public website, existing AI/news backend and restricted USCIS test services, and forwards incoming support email. Anthropic processes optional AI content. GitHub hosts public app configuration. Supabase, Render and Resend support the restricted development account flows described above. Microsoft processes support correspondence. Government sites and carriers handle their own lookups. Apple provides device and App Store services; live app purchases are not enabled. Provider processing may occur in multiple countries.

A separate owner-only review copy is hosted through Sites with access controls. It is not the public business website. Hosting access and security infrastructure can process account, cookie and connection information independently of the mobile app.

Review Cloudflare's privacy policy and Anthropic's commercial data-retention explanation. Provider retention can include safety or legal exceptions. Do not interpret local app deletion as deleting provider records.

The app code has no advertising or third-party analytics SDK, and the product does not sell data or use it for targeted advertising. Network features use HTTPS and provider API secrets belong on the backend, not in the mobile app. No storage or transmission method is completely secure.

Planned owner reporting

Reporting development addendum — September 13, 2026 (not activated or effective): We have prepared a private owner report that would use aggregate counts from existing account and verified purchase records to understand registrations, membership and demand for guided forms. The report does not request case contents, documents, form answers, AI questions or individual feature activity. Small form groups are withheld and released form counts are rounded; this reduces risk but does not guarantee anonymity or remove existing account linkage in payment records. No mobile analytics SDK, tap tracking or session recording is added. Apple usage and crash-reporting tools are linked, not imported into this report. Before live activation, account/payment disclosures, provider retention and Apple privacy declarations must be updated for the actual deployment. Other features and provider retention still require review before public release.

Your choices and deletion

You can avoid optional AI, change notification preferences, delete individual records and use Export or delete my data in My Account. Delete all removes the documented local case, document, form, reminder and study stores and cancels app-scheduled notifications. It retains the app lock, language/consent preferences and purchase-related rights where applicable. Local deletion does not delete an online account.

The development app includes a separate Delete online account control, but the restricted owner-read test service does not provide that operation. Its appearance in the app does not establish that hosted deletion is available. Development testers should contact [email protected] for account-data requests. Hosted account deletion, retained transaction records and provider recovery limits must be verified before public account registration is offered.

Avoid sharing information about relatives or other people unless you have authority to do so. Form answers can contain sensitive family, health and financial information. Choosing to share a PDF, export or AI prompt can disclose information about those people as well as about you. Withdrawing a permission cannot recall copies already sent to others.

Deletion does not cancel an Apple subscription, remove files already saved or shared elsewhere, erase device/cloud backups, or recall information already sent to online providers. Do not rely on uninstalling alone to erase every keychain or external copy.

For access, correction or deletion questions about information you sent to support or our online services, email [email protected]. We may need proportionate verification; do not email identity documents unprompted. Applicable privacy rights, response procedures and the intended audience/children's-privacy position require legal review before release.

Future features and changes

Before accounts, purchases or live case monitoring launch, this notice must describe the actual identity, payment, consent, retention and deletion systems and their providers. No USCIS credentials or real-case API access are enabled by this website. Material privacy changes need a dated notice and any consent required for the new flow.