Privacy notice

1. The two things we refuse to hold

These come first because they are the reason several other choices look the way they do.

• No EIN and no Social Security number. We do not ask for either one, there is no field for either one, and neither is stored. A court caption carries a company name, not a tax number, so neither would improve a match — and holding them would attach federal data-security obligations to this database for no gain. If a page claiming to be DocketEye asks you for one, it is not us.
• No addresses of other people out of court records. When we read a filing we keep the case caption, the court, the docket number, the filing date, the document type and the link. We do not keep the parties' addresses, and there is no column to put one in.

2. The free lookup writes no row about what you looked up

The free company lookup on the home page and at docketeye.com/check/ takes no account and no card, and it is the part of this product most people will touch. It is also the part that keeps the least, so here is the whole of it.

• The company name you type is not stored. It is used to build one query to the state's public register and is then gone. There is no table of search terms, no log of them and no file of them.
• The answer you are shown is not stored. No record is written against you, against the company, or against anything else. Everything in section 3 below that describes a stored address check belongs to a company added inside a signed-in account — the free lookup writes none of it.
• No account is created, nothing is emailed to you, and the four "Is that still you?" buttons on the answer card send nothing anywhere. They only change what the page says.
• The lookup sets no cookie. The one cookie described in section 7 is the signed-in session cookie, and an anonymous lookup never issues it.
• One thing is kept, and it is not about your company. An abuse counter keyed to the IP address the request came from, so an automated crawl can be slowed down. It holds the IP and a timestamp, nothing about what was searched for or what came back, and it is swept on the schedule in section 5.

The one thing that does leave our server is the company name or registry ID itself, which goes to that state's public open-data endpoint so the record can be read back. That is in section 4 with the other three recipients.

3. What we collect, and why each item is there

• Your email address. It is the account. It is where the sign-in code goes and where an alert goes.
• Your password, hashed. We store a one-way hash, not the password. We cannot read it and cannot tell it to you.
• Sign-in codes and trusted devices. A new device confirms with a six-digit code emailed to you. If you let us remember the device, we keep a token for it for a few days so you are not asked for a code on every visit.
• The companies you add — the legal name, the state, the state-issued registry ID, the entity type and the formation date, all read from the state's own public register, plus your attestation that you own or control that company.
• The address you tell us is yours, and a mobile number if you choose to give one. Both are encrypted in the database, not stored in the clear. Your address exists for one purpose: to compare against the address the state will mail a lawsuit to.
• Each address check we run for a company on your account — what the state had on file that day, the verdict and the sentence shown to you. We keep the history rather than only the latest value, because the signal that matters most is the state's address changing. This is the signed-in check, against a company you added and attested to. The free public lookup runs the same comparison and stores none of it (section 2).
• Filings that matched a company on your account, and the alerts we sent you about them, including the exact words that were sent and whether delivery succeeded.
• Billing records. Payments run through Stripe. Card numbers go to Stripe and never reach us; what we keep is the plan, the states, the invoices and Stripe's identifiers.
• Security and abuse records. Sign-in attempts, the IP address a request came from, and rate-limiting counters. These exist to stop someone else getting into your account and to stop automated abuse of the free registry lookups.
• Your acceptance of these documents — which version, when, and from which IP. That is how a fees-paid liability cap can be shown to have been agreed.

4. Where it goes

We do not sell your data, we do not rent it, and we do not share it for advertising. It leaves our server in four places, each for a stated reason:

• Our email provider, to deliver your sign-in codes and your alerts.
• Stripe, to take a payment and to bill a renewal.
• Cloudflare Turnstile, for the "I'm human" check. Two places: the sign-in page, and the free lookup — but on the free lookup only after the same IP address has run a burst of searches in one hour, which an ordinary visitor does not do. Where it is shown, the widget is loaded from Cloudflare and Cloudflare sees that a browser visited that page. It does not see your companies, your address or what you searched for. Turnstile is switched on and off by configuration; while it is off, no request goes to Cloudflare from anywhere on this site.
• The state registry you asked us to search. When you look up a company we send the name or the registry ID you typed to that state's public open-data endpoint. We do not send your email address, your own address, or anything identifying you.

Beyond those, we disclose data when the law requires it of us, and we say so to the account holder unless we are prohibited from saying so.

5. How long we keep it

• Sign-in codes — minutes. They expire and are then useless.
• Trusted-device tokens — a few days, then the device is asked for a code again.
• Rate-limiting records, including the free lookup's IP counter — swept on a schedule, and nothing older than two days survives it. Two days is the longest window any limit on this site counts over, with a day of slack on top. Nothing has to come back and visit us again for its rows to go.
• Other security records — sign-in attempts and the like, a short rolling window, long enough to catch an attack in progress.
• Your companies, address checks and alerts — for as long as the account is open, because the history is the product. Close the account and they are deleted, apart from what is named below.
• Billing and invoice records, and your acceptance of these documents — kept after an account closes, for as long as tax and limitation rules require. A liability cap you agreed to has to remain provable for at least as long as a claim can be brought.

6. What you can ask us to do

• See it. Most of it is on screen inside your account already; ask and we will send the rest.
• Correct it. The address you gave us and the companies on your account are editable by you. If something else is wrong, write to us.
• Delete it. Closing the account deletes your companies, your address, your address checks and your alerts. Billing records and your acceptance of these documents are kept for the period in section 5.
• Take it with you. Ask and we will send your companies and their address-check history in a plain machine-readable file.

Write to the address at the foot of this page from the email address on the account. If you write from another address we will ask you to confirm from the account's own, because the alternative is handing your data to whoever asks for it.

7. Cookies

One cookie, for your signed-in session. The free lookup sets none, and there is no analytics script on this site, no advertising tag and no third-party tracker.

Fonts and images on every page come from this domain, and there are no image files at all — the drawings are part of the page. There is one exception to "nothing loads from anywhere else", and it is the Cloudflare Turnstile check described in section 4: where Turnstile is shown, that page loads Cloudflare's script and Cloudflare may set its own storage in your browser for it. That can happen on the sign-in page, and on the home page or the free lookup once an IP address has run a burst of searches in an hour. Nowhere else, and nothing else.

8. Children

DocketEye is a product for business owners. It is not for anyone under 18, and we do not knowingly hold data about a child.

9. Security, stated plainly

The site is served over HTTPS. The address and mobile number you give us are encrypted in the database. Passwords are hashed. New devices confirm by email code. Backups are taken and kept off the machine that made them.

None of that is a promise that nothing can go wrong. If a breach affects your data we will tell you what happened, what was in it, and when — in writing, to the address on your account.

10. Changes to this notice

If this notice changes, the version identifier at the top changes with it and we describe what moved. A material change is emailed to the address on your account before it takes effect.

What moved in version 2026-09-17. Section 2 is new and covers the free public lookup, which the rest of the pages had been describing as keeping no copy while this notice said nothing about it either way; every section after it moved down one number. The Turnstile entry in section 4 used to confine that check to the sign-in page, which stopped being true when the free lookup grew the same widget, and the sentence in section 7 saying nothing on the home page loads anything from another domain is now written with that exception in it. The address-check entry in section 3 now says it is the signed-in check. Rate-limiting records in section 5 used to be described as a short rolling window; they are now swept on a stated schedule, which is what makes that description true.

If something in here does not match what the product actually does, that is a bug in this page and we want to hear about it. Write to us and we will correct the page or the product, and say which.