Law Enforcement Guidelines
1. What data exists (so requests can be scoped correctly)
| Data | Held? | Notes |
|---|---|---|
| Basic subscriber info (name, phone, email, signup date, IPs) | Yes | Via auth provider + our records |
| Profile fields and photos | Yes | |
| Home-base location (user-set point + radius) | Yes | A setting, not a track |
| Continuous / historical GPS location | No. Never collected | We cannot produce what we do not have |
| Hangout posts + attached venue points, RSVPs | Yes | |
| Private messages | Yes | Content vs. metadata distinguished below |
| Recommendation logs (who was shown whom, why) | Yes | |
| Moderation records (reports, blocks, enforcement) | Yes | Retention per doc 08 |
2. Required legal process (US)
Per the Stored Communications Act (18 U.S.C. §§ 2701–2713) and Carpenter v. United States:
| Requested data | Minimum process |
|---|---|
| Basic subscriber records, session IPs | Subpoena |
| Non-content records beyond basic (logs, RSVP metadata) | § 2703(d) court order |
| Content (messages, posts not public, photos) | Search warrant |
| Location data of any kind (home base, hangout points tied to a person) | Search warrant (we treat all location as warrant-only as a policy floor) |
| Real-time interception | We do not have this capability |
Out-of-jurisdiction/foreign requests: MLAT or CLOUD Act process only.
3. Emergency disclosure
Where we believe in good faith that there is an emergency involving danger of death or serious physical injury requiring disclosure without delay (18 U.S.C. § 2702(b)(8)), an officer may submit an emergency disclosure request in writing stating the nature of the emergency and the specific data needed. Decision maker: Hangpost's designated legal contact. Every emergency disclosure is logged with the justification.
4. Preservation requests
On receipt of a § 2703(f) request we preserve the identified records for 90 days (renewable once) without disclosing them.
5. User notice
Our policy is to notify the user before disclosure unless legally prohibited (e.g., § 2705 order) or where notice risks harm to a person or an investigation involving child exploitation. Delayed notice is given when the prohibition lapses.
6. CSAM
Apparent child sexual abuse material is reported to NCMEC under 18 U.S.C. § 2258A independent of any request, with content preserved one year per § 2258A(h), as amended by the REPORT Act (Pub. L. 118-59, 2024).
7. Service of process
Requests to: legal@hangpost.app. Required: issuing agency, agent name + badge/ID, matter reference, specific user identifier(s) (phone/email/username), data sought, date range, legal authority. Overbroad requests are narrowed or challenged. We may seek reimbursement for costs where permitted (§ 2706).
8. Internal handling checklist
- Log receipt (date, agency, scope) in the legal-requests register.
- Authenticate the requester (callback to agency main line).
- Match request to §2 table; reject/return if process is insufficient.
- Pull data minimally scoped; second person reviews scope before send.
- Notice decision per §5, with reason recorded.
- Produce via secure channel; log what was produced.
- Quarterly: count requests for the transparency report.