Privacy Policy

CrashCompute provides traffic crash investigation tools and worksheets for investigators. This page explains what we collect, what we do not, and what happens to a case file.

1. Who we are

CrashCompute (“we”, “us”) operates www.crashcompute.com. For any privacy question, or to request deletion of your data, write to crash@crashcompute.com.

2. What we collect

If you use the site without an account

You can use every calculator without signing in. In that case we do not create a record about you. Your worksheets and case files are held in your browser’s local storage on your own device, and we cannot read them.

If you create an account

• Account details — your email address, and your name and profile picture if you sign in with Google.
• A user identifier assigned by Firebase Authentication.
• Workspace membership — which Team or Department workspace you belong to and your role in it, if you join one.
• Report identity — on paid accounts, any preparer name, title, credential identifier, organization or division, public contact details, and badge or logo you choose to save for printed reports.

If you save a case to the cloud

• Case contents — the measurements, notes and results you entered on the worksheets in that case.
• Case metadata — when it was created and last changed, and its case identifier.
• An audit record of each write, holding the case identifier, the operation, its size and the time. This record does not contain the contents of the case.

A cloud case may include a location you looked up, and any scene details you typed. Treat a case file as you would any other investigative document.

If you choose your own storage provider

You may save a case to a file on your device or connect Dropbox, OneDrive or Google Drive. The case file is encrypted in your browser with your case password, then sent directly to the destination you choose. It is not copied into CrashCompute Cloud. The browser working copy is also encrypted at rest with a non-exportable key held by this browser until you clear it. Provider authorization tokens are held only in memory and expire when the page closes, the connection expires or you disconnect. The selected provider processes and retains the file under its own terms and your account settings. We use provider access only to perform the save, open and update actions you request. We do not sell, advertise against or share the contents of provider files. CrashCompute is responsible for the privacy, security and integrity of provider data while our integration accesses it.

Privacy-safe diagnostic events may record the provider, requested operation, success or failure, a general error code and time. They do not include case contents, filenames, case numbers, authorization codes or provider tokens. See case storage help for provider paths, disconnection and access-revocation instructions.

If you subscribe

Payments are processed by Stripe. We never receive or store your card details. We keep a Stripe customer identifier, your plan, the billing cycle and the subscription status so we know what your account is entitled to.

Automatically

• Analytics — we use Google Analytics to count page views and understand which worksheets are used. This is aggregate usage data, not case content.
• Abuse prevention — Firebase App Check with reCAPTCHA Enterprise runs to stop automated abuse of our backend.
• Server logs — standard request logs kept by our hosting provider.

3. How cloud case links work

New cloud cases are private by default and encrypted in your browser before upload. The owner may enable password-protected view or edit sharing. A recipient needs both the link and case password, which should be sent separately. CrashCompute stores a one-way password verifier for access checks, but cannot decrypt the case or recover a forgotten password.

4. Third parties we send data to

Lookups only happen when you ask for them. If you never use the scene conditions or VIN tools, nothing is sent to those services.

5. How long we keep things

CrashCompute Cloud is available only with a paid plan or active trial. Cloud cases are retained for the period attached to the paid plan under which they were created. We warn you before a case reaches the end of its retention period, and a case placed on legal hold is exempt from expiry for as long as the hold stands.

We do not delete case contents on a timer without notice. Audit records are kept for 90 days. Account records are kept until you ask us to delete the account.

6. Your choices

• Work locally. Never save to the cloud, and we hold nothing but anonymous analytics.
• Use your own storage. Save directly to your device, Dropbox, OneDrive or Google Drive without creating a CrashCompute Cloud case.
• Export at any time. Every case can be exported to a file you keep.
• Delete your account. Email crash@crashcompute.com and we will delete your account and its cloud cases.
• Access or correct your data. Ask us and we will provide a copy or fix it.
• Opt out of analytics using any standard browser or extension blocker; the calculators work regardless.

7. Security

Traffic is encrypted in transit. Case content is encrypted in your browser using AES-256-GCM with a key derived from your password using PBKDF2-HMAC-SHA-256. Access, sharing, and revisions are enforced server-side, and entitlement fields can only be written by our billing backend. Passwords are not stored or logged. No system is perfectly secure, and we do not claim otherwise.

8. Children

CrashCompute is a professional tool and is not directed at children. We do not knowingly collect information from anyone under 13.

9. International users

Our infrastructure is operated in the United States. If you use CrashCompute from elsewhere, your information is transferred to and processed in the United States.

10. Changes

If we change this policy we will update the date at the top of this page. Material changes affecting how case data is handled will also be announced in the app.

11. Contact

Questions, access requests, or deletion requests: crash@crashcompute.com.