Privacy Policy
Civil Rule 26 lets an attorney request scoped, revocable access to financial account records to value account-based assets as of a past date, and lets the account holder who receives that request control exactly what gets shared. This page explains what information passes through the service, who sees it, and how to revoke it.
We Don't Warehouse Financial Data
Account statements and transactions stay with the financial institution that issued them. Plaid, the data broker, aggregates authorized records under agreements with those institutions and holds the access token an invitee creates. Civil Rule 26 never sees or stores an invitee's banking username or password, and does not keep a separate financial-data warehouse of its own.
Information We Collect
- From attorneys. The name and bar number for every jurisdiction you list at signup. Once each license verifies against official bar records, we pull your email, phone, and firm directly from that record rather than a form you fill in.
- From invitees. The email and name the requesting attorney provides to send your invite, the passkey you register on your own device, and the scoped access token Plaid issues once you authorize a retrieval. We never ask for, and never receive, your online banking credentials.
- Automatically. Standard request logs (method, URL, timestamp) for security and troubleshooting, and page-view and click analytics tied to an anonymous visitor identifier, not to your name or account.
Cookies
Session, invite, and attorney-session cookies are strictly necessary - they keep you signed in and keep the invite flow working, and are never used for tracking. A separate visitor cookie supports analytics only and is never used to authorize access to anything.
How a Retrieval Moves
An invitee authorizes access at their own institution's login page. The institution confirms the authorization and releases records to Plaid under its agreement with that institution. The attorney's portal then retrieves the authorized records through Plaid using a read-only, scoped token, and displays them for that matter. No party in this chain receives more than the invitee agreed to share.
Revoking Access
An invitee can revoke an authorization at any time, from either their financial institution or their Civil Rule 26 account. Once revoked, no further retrieval occurs under that grant.
How We Protect Information
Authentication cookies are set as HTTP-only, secure, and same-site restricted. Request logs redact invite and session identifiers before they're written anywhere, and never capture credentials. All traffic to the site is encrypted in transit.
Third Parties
We share information with Plaid to aggregate authorized financial records, with an invitee's own financial institutions as part of the authorization they initiate, and with state bar associations solely to verify an attorney's license at signup. We do not sell personal information.
Changes to This Policy
If this policy changes in a way that affects how information is collected or shared, we'll update this page and change the date it was last revised.
Contact
Questions about this policy, or a request to revoke access or remove your information, can go to info@civilrule26.com.
Informational only. Nothing on this page is legal advice or creates an attorney-client relationship.