Exhibit A privacy notice

Version 2026-10-26 · Effective October 26, 2026

Exhibit A holds some of the most private things in your life. This notice says what it keeps, where it comes from, who handles it and why, and how to have it deleted. Phynk LLC, a California company, makes Exhibit A and is responsible for your information.

Exhibit A shares accounts with Sidebar, our co-parenting app, which has its own notice. Our websites are covered by the websites' notice. Exhibit A is for adults in the United States.

What we collect, and where it comes from

Your account

• Your email address, name and password. We keep the password only as a one-way hash, never the password itself.
• Your second sign-in step: an authenticator app (we keep its secret encrypted) or a US or Canadian phone number we text codes to. Backup codes are kept only as hashes.
• The plan you chose, and that you've read that Exhibit A isn't legal advice.
• Your sign-ins: a session cookie in your browser, and the phones and desktop computers you've signed in on (device name, type, when last used).

Your cases

Everything you put in a case, or ask Exhibit A to bring in:

• Case details: state, county and case number.
• People in your case: names, roles, birth dates, phone numbers and email addresses.
• Court orders and papers: the originals and their text.
• Evidence: photos, screenshots, documents, recordings and videos. We keep originals exactly as you uploaded them, so any details your phone stored in a file, such as where a photo was taken, stay in it.
• Message imports that you choose to run: an Android text message backup and call log, an iPhone backup read by the Exhibit A desktop app on your computer, OurFamilyWizard reports, Gmail (a Google Takeout file you upload), and Outlook. An import brings in what's in the backup or file you choose, which can include messages with people outside your case.
• Outlook: if you connect it, Exhibit A gets read-only access through Microsoft and fetches only mail where the people in your case are participants (to, from or cc). We delete the access token when the fetch ends, at the latest about a day later.
• Transcripts of your recordings.
• What Exhibit A makes for you: captions, events, findings, claims, declarations, exhibits and questions for your lawyer.
• Comments, from you and from a lawyer you share with, and records of what you've shared and with whom.
• The AI's working record: the prompts sent to AI models for your case and their responses (see AI).

Your records will contain information about other people, such as the other parent, your children and people you've written to. We handle it for you, to run Exhibit A, under the same rules as the rest of your information.

From how you use Exhibit A

• An access log: which account did what, to which item (by ID), and when, with a keyed hash of your IP address rather than the address itself. We use your IP address in memory to limit repeated attempts, and don't store it.
• AI cost records: how much AI work each case used, without its content.
• Analytics and session replay through PostHog (see Analytics and session replay).

How we use it

We use your information to:

• run Exhibit A for you: store your records, read them, organize them, and make what you ask for;
• sign you in and keep your account secure, including sending sign-in codes and emails about your account;
• share what you choose with a lawyer you invite;
• apply your monthly AI spend cap;
• find and fix problems, and make Exhibit A easier to use;
• keep Exhibit A and its users safe, and meet our legal obligations.

We don't sell your information, we don't use it for advertising, and we don't use your content to train AI models.

AI

Exhibit A uses AI models to read your documents, photos, messages and orders, find events, answer your questions and draft text. Your content is sent to these providers so they can do that work, under their business API terms:

• Anthropic: most AI work, including reading documents, photos and messages, finding events, answering your questions, and drafts.
• Google (Gemini models and Document AI, in the US): reading order fields and obligations, finding events in messages, telling what kind of document a file is, and turning orders and court papers into text.
• OpenAI: building search indexes from messages, order passages, captions, transcripts and questions.

Recordings are transcribed on our own servers. Your audio isn't sent to another company for that.

When Exhibit A finds background reading on the law for a question for your lawyer, it searches CourtListener, a public library of court opinions, using general legal search words only, never names or details from your case.

We keep the prompts sent to AI models for your case, and their responses, sealed, until the case or your account is deleted. They let us check and fix what the AI did. Whenever someone at Phynk opens one, that's logged.

Who we share it with

Companies that run parts of Exhibit A for us

They handle your information only to provide their service to us:

• Google Cloud: hosting, our database (in Oregon, US) and the AI services above.
• Cloudflare: our websites, network protection, file storage (in western North America), and sending and receiving email.
• Anthropic and OpenAI: the AI services above.
• Twilio: texting sign-in codes, if you chose that (your phone number and the code only). We may move this to Telnyx, which would get the same.
• PostHog (US): analytics, error reports and session replay.
• Microsoft: only if you connect Outlook for an import.

A lawyer you invite

A lawyer sees only what you choose to share with them, and you can stop sharing at any time. Stopping ends their access in the app, but can't take back copies they've already downloaded.

When the law requires it

We'll disclose information if the law requires it, such as a valid subpoena or court order, or if it's needed to protect someone from serious harm. Unless the law or a court forbids it, we'll tell you first so you can object or speak to your lawyer.

If Phynk changes hands

If another company takes over Exhibit A, your information would go with it, under the promises in this notice.

We don't share your information with anyone else.

Analytics and session replay

We use PostHog to see how Exhibit A is used, find errors, and watch recordings of sessions to see what's confusing. Once you sign in, PostHog links this to your account by its ID, your name and your email, so we can help if something went wrong for you.

Recordings show what's on your screen, including your messages, evidence, case details and photos; anything you type into a field is hidden. They also include your browser's console messages (what the page logs as it runs, such as errors). Only staff who work on Exhibit A can watch them, and only to fix and improve it. The websites' notice covers PostHog's cookie.

How long we keep it, and deleting it

• Until you delete it. We keep your cases and account until you delete them.
• 30 days to undo. When you delete a case or your account, it's hidden at once. For 30 days you can restore the case, or sign in again to bring back your account. After that, its records and files are removed for good.
• Backups. Our database backups rotate out over about 30 more days, so deleted information can stay in a backup that long before it's gone.
• What we keep after deletion: AI cost records (without content), and the access log (account IDs, what was done and to which item (by ID), times and hashed IP addresses), which we keep for security.
• Short-lived things: sign-in and reset codes expire within 30 minutes and texted codes within 10. Unfinished uploads are removed within a week.

Security

• Originals are encrypted before they're stored, and never changed. Each uploaded file has its own encryption key.
• Secrets and access tokens are encrypted. Passwords, codes and IP addresses are kept only as hashes.
• Signing in takes two steps. Your browser session lives in a cookie that scripts can't read, ends after 30 minutes idle, and lasts at most 12 hours.
• Our database is on a private network, and connections to it are encrypted.
• Staff reads of saved AI prompts and responses are logged.

No system is perfectly secure. We don't scan uploaded files for viruses, so take care opening files you didn't make. If we learn of a breach that affects you, we'll tell you as the law requires.

Your choices and rights

• See and correct: you can see and edit your account and case details in Exhibit A. For anything you can't change there, ask us.
• Delete: delete a case or your account in Exhibit A, or ask us to.
• A copy: ask us and we'll send you a copy of your information.
• Stop sharing: stop sharing with a lawyer at any time.

Write to privacy@phynk.com. We'll check it's really you before we act on a request.

California residents

If you live in California, the California Consumer Privacy Act gives you the rights below. This section uses the law's terms.

What we collected in the last 12 months

• Identifiers: name, email address, phone number, account ID, device names, and a hashed IP address.
• Customer records (Cal. Civ. Code § 1798.80(e)): name, email address, phone number.
• Characteristics of protected classifications: ages and birth dates, and family and marital status, as they appear in your case.
• Commercial information: the plan you chose and your AI use.
• Internet or other electronic network activity: how you use Exhibit A, sign-ins, the access log, and session replay recordings of your screen.
• Audio, electronic and visual information: photos, screenshots, recordings and videos you upload.
• Geolocation: we don't collect your location, but files you upload can contain it.
• Inferences: what Exhibit A's AI makes from your records, such as events, findings and claims.
• Anything else in your records, such as information about work, school, health or money, if it's in what you upload.

Sensitive personal information we collect: your account sign-in (email and password); the contents of messages and email you import; and any sensitive details that appear in your records, such as health information. We use sensitive personal information only to provide Exhibit A to you and for the other purposes the law allows, not to infer things about you.

Sources: you; the devices, backups and accounts you import from; services you connect; a lawyer you share with (their comments); and Exhibit A itself, which makes things from your records.

Purposes: those in How we use it.

Disclosures: we disclose each category to the service providers in Who we share it with, for the business purposes described there, and to a lawyer only when you choose.

No sale or sharing. We don't sell your personal information or share it for cross-context behavioral advertising, and haven't in the last 12 months. We don't knowingly sell or share the personal information of anyone under 16.

Retention: as in How long we keep it, for every category: until you delete it, plus 30 days to undo, plus about 30 days for backups; cost records and the access log are kept after that.

Your California rights

• Know and access: ask what we've collected about you, where it came from, why, and who we disclosed it to, and get a copy.
• Delete: ask us to delete it, subject to the law's exceptions.
• Correct: ask us to correct anything that's wrong.
• Limit: ask us to limit our use of sensitive personal information. We already use it only to provide Exhibit A.
• Opt out of sale or sharing: we don't sell or share, so there's nothing to opt out of.
• No discrimination: we won't treat you differently for using any of these rights.

Making a request: email privacy@phynk.com. We'll confirm we got it within 10 business days and answer within 45 days, or tell you if we need longer, as the law allows. We'll verify your identity, usually by asking you to confirm from the email address on your account.

Authorized agents: someone you authorize can make a request for you. We'll ask for your signed permission and may ask you to confirm your identity with us directly.

Changes and contact

Each version of this notice has a version number. This one is Version 2026-10-26. If we make a change that matters, we'll tell you by email or in Exhibit A before it takes effect.

Privacy questions and requests: privacy@phynk.com. Anything else: support@phynk.com. Both reach a person. Our Terms of Service also apply.

Version 2026-10-26. Effective October 26, 2026.