Legal & privacy
Security
This page collects Expeal's security posture in one place: what protects this site, what protects the Expeal application, how long information is kept, what rights you have over it, and how to tell us when something is wrong. Each section links the policy that governs it — this page summarizes; the policies control.
1. How to tell it's really us
Expeal will never call, text, or email you asking for payment by gift card or wire. We never knock on your door.
- Our website is expeal.com, and our app is app.expeal.com. We use no other web address.
- Our email comes only from addresses ending in @expeal.com. The app's sign-in codes come from no-reply@expeal.com.
2. This website
expeal.com is a static site with a deliberately small attack surface. It has no accounts and no database. Its only forms are two questions: your state and your county. Your state leads to that state's own page, so its address carries your answer; your county stays after the "#" in the page address, which your browser never sends. Without scripts, both questions lead to our own lists, whose addresses carry what you typed. Our web host's routine logs record each address your browser asks for (Section 4). The site sets no cookies, uses no browser storage, and makes no third-party requests — commitments recorded in the Privacy Policy and enforced by our build checks on every change.
All traffic is served over HTTPS with HTTP Strict Transport Security; requests over plain HTTP are redirected. Responses carry a Content Security Policy, frame-ancestors, content-type, and referrer-policy headers.
3. The Expeal application
The application at app.expeal.com handles the sensitive information you provide to prepare a case, and its protections are described in the Application Privacy Policy: HTTPS encryption of all traffic, a strictly enforced Content Security Policy, sign-in passcodes stored only as cryptographic digests, encryption of data at rest on our database platform, access controls limiting case data to authorized staff, and security review of changes before release.
4. Retention
The only record this site keeps of you is its web host's routine logs. They hold your IP address, the time, and the page address your browser asked for. The host keeps them for about 30 days (see the Privacy Policy, Section 3.3, and our subprocessors page). Your answers to the guided questions stay after the "#" in the page address, which your browser never sends. The logs do hold the page you open, such as your state's page or your county's guide, and, with scripts off, what you type into the state or county question.
The application retains your account and case answers for as long as your account exists, so your case can be processed and resumed; server logs are kept for approximately one week. Published retention durations are being finalized in the Application Privacy Policy (its Section 7), and updates follow that policy's notice process.
5. Your data rights
You may request access to or deletion of your information at any time — the process and its limits are in the Application Privacy Policy (its Section 8). Privacy requests go to privacy@expeal.com.
6. Who processes data for us
The third-party providers that host or deliver Expeal services — and what each one handles — are listed on the subprocessors page. We do not use analytics, advertising, or data-broker services anywhere.
7. Certifications
Expeal holds no third-party security certification today — no SOC 2 report, no ISO 27001 certificate. We say so rather than imply otherwise; if that changes, this page will say so.
8. Reporting a vulnerability
Security research is welcome under our Vulnerability Disclosure Policy. Reports go to security@expeal.com; the same address and policy are published machine-readably at /.well-known/security.txt.