Privacy policy

The short version

• You can use the case lookup without an account and without giving us anything about yourself.
• If you create an account, we collect an email address, the receipt numbers you choose to track, and any case details you choose to add.
• We do not sell or share your personal information as those terms are defined by California law, and we do not run advertising.
• You can permanently delete your account and all associated data from your settings page. Deletion completes within 30 days.
• We will notify you within 72 hours of confirming a breach affecting your information.
• We require valid legal process before disclosing anything to law enforcement or any government agency, and we will tell you unless the law forbids it.

Who we are

uscasestatus is operated by Mundus Consult LLC, at Texas, USA. In this policy, "we," "us," and "our" mean that entity. "You" means anyone who uses our website or services.

What we collect

Information you give us

Information collected automatically

We do not collect precise geolocation (GPS-level location) under any circumstances.

Payment information

If we ever offer a paid service, payments are processed by Stripe. We receive only a transaction identifier, the last four digits of the card, and the billing country. We never receive or store full card numbers or bank account details.

What we never collect

• Social Security numbers or Individual Taxpayer Identification Numbers (ITINs)
• Alien registration numbers (A-numbers) or USCIS online account numbers
• Passport numbers, visa numbers, or images of any identity document
• Biometric data of any kind — fingerprints, facial scans, voiceprints
• Health or medical information
• Financial account information, credit history, or income
• Your contacts, address book, calendar, photos, or files
• Precise geolocation
• Information about your criminal history or any pending proceedings
• Your USCIS account password or credentials — we will never ask for these

Sensitive information

Some of what you may choose to tell us — your country of birth, your petition category, or the fact that you have a pending immigration matter at all — can reveal your citizenship or immigration status. Under the California Consumer Privacy Act, as amended by AB 947 effective January 1, 2024, information revealing citizenship or immigration status is sensitive personal information. Comparable laws in Connecticut, Virginia, Colorado, and other states treat it as sensitive data as well.

We treat all of it accordingly:

• We use sensitive personal information only to provide the service you asked for — that is, to show you statistics for cases comparable to yours and to send you alerts you requested.
• We do not use it to infer characteristics about you, to build a profile, or for any advertising or marketing purpose.
• We do not disclose it to any third party except the service providers listed below, each of which is contractually restricted to processing it on our instructions only.
• Because we limit our use to what is necessary to provide the service, we do not use or disclose sensitive personal information for purposes that would trigger a separate right to limit under California law. You can still delete it at any time.

How we use it

We do not use your information for advertising, ad targeting, audience building, cross-context behavioral advertising, credit or insurance decisions, employment screening, or automated decision-making that produces legal effects about you.

Who we share it with

Conditions we impose on every recipient

• Each service provider is bound by a written contract that requires it to comply with the terms of this Privacy Policy and applicable privacy law.
• Third parties are prohibited from using or disclosing your information — including de-identified, anonymized, or pseudonymized information — for any purpose other than performing the service we hired them for, without your active, informed consent. They may not sell it, share it, combine it with other datasets, use it to train models, or retain it after our relationship ends.
• We require each provider to notify us promptly of any security incident affecting your data.
• We do not permit onward subcontracting without equivalent contractual protections.

We do not share your information with marketers, data brokers, advertising networks, immigration law firms, employers, or any other third party for their own purposes.

We do not sell your data

In the twelve months preceding the date of this policy, we have not sold or shared any category of personal information, including any sensitive personal information.

Government and law enforcement requests

• We do not voluntarily disclose user information to immigration enforcement, law enforcement, or any government agency.
• We require valid legal process. We evaluate every request for legal sufficiency and scope, and we object to requests that are overbroad, defective, or that seek more than the requester is entitled to.
• We disclose the narrowest set of data responsive to a valid request.
• We will notify you before disclosing your information so that you have an opportunity to object, unless we are legally prohibited from doing so or there is an emergency involving a risk of death or serious physical injury. Where a non-disclosure order applies, we will notify you as soon as it expires.

You should be aware that the case status information we display is already held by USCIS. Deleting your account with us does not remove anything from USCIS's own records.

Aggregate and de-identified data

The core of our service is statistical: to tell you how many cases are ahead of yours, we compute figures across all the cases we observe in a receipt block. Here is exactly how that works.

• We aggregate case status transitions — for example, "a case in block IOE09351 moved to Approved on July 12" — not information about the people behind them.
• Aggregate statistics are computed over blocks containing thousands of cases. We do not publish any statistic derived from fewer than 25 cases, to prevent anyone from isolating an individual.
• De-identified data is stripped of your account identifier, email, IP address, and any profile details you provided, and we make no attempt to re-identify it.
• We commit to maintaining de-identified data in de-identified form and to contractually obligating any recipient to do the same.
• We do not sell, license, or transfer de-identified or aggregate datasets to third parties — including researchers, journalists, or commercial buyers — without a separate published policy and, where the data derives from your account, your active consent.

If you delete your account, we remove your personal information. Historical status transitions already incorporated into block-level counts cannot be individually withdrawn, because they are no longer associated with you in any way. You can request that we stop incorporating your case's future transitions by contacting us.

How sharing affects other people

• A receipt number for a Form I-130 or I-140 identifies a petition that concerns at least two people. If you are a petitioner tracking a relative's case, the details you add describe their situation as well as yours.
• Country of birth and petition category can indirectly reveal information about family members, including their national origin and their relationship to you.
• If you are tracking a case on someone else's behalf, you should have their permission. By adding case details, you confirm that you have the authority to do so.
• Alerts are sent to the email address on the account. If that mailbox is shared, other people may see case updates.
• Benefits of sharing details with us: more accurate comparisons, tighter estimates, and alerts tuned to your situation.
  Limitations: our statistics describe groups and can never predict an individual outcome.
  Risks: any data held anywhere can be exposed by a breach or compelled by legal process. The only information that carries no risk is information you don't provide. Every case profile field is optional for exactly this reason.

Your choices

• Use us anonymously. The case lookup works without an account. Nothing is stored against you.
• Provide only what you want. Every case profile field can be skipped, and every one can be removed later.
• Turn off alerts from your settings or the unsubscribe link in any email.
• Access, correct, or export everything we hold about you, in a machine-readable format, from your settings page.
• Delete everything at any time. See below.

How long we keep data

Dormant accounts

If you do not sign in for 24 consecutive months, we treat your account as dormant. We will email the address on file at 24 months and again 30 days later. If you do not sign in within 30 days of the second notice, we permanently delete the account and all associated data. We would rather delete data you have stopped using than hold it indefinitely.

Deleting your data

1. Sign in and go to Settings → Privacy → Delete my data.
2. Choose Delete specific case details (removes profile fields but keeps your account) or Delete my account and all data.
3. Confirm. You will receive a confirmation email immediately.

If you cannot access your account, email info@uscasestatus.com from the address on the account, or use the form on our privacy request page. We may need to verify your identity, which we do by sending a confirmation link to the email on the account — we will not ask you for identity documents.

How fast deletion happens

• Immediately: your account is deactivated and your data becomes inaccessible through the service.
• Within 30 days: your data is permanently erased from all production systems, and we instruct every service provider holding it to do the same.
• Within 35 days: encrypted backups containing your data have rotated out and are unrecoverable.
• We will confirm by email when erasure is complete.

We may retain the minimum necessary to comply with a legal obligation (for example, tax records for a payment), to resolve a dispute, or to enforce our agreements. If we do, we will tell you what and why.

Closing your account

To close your account without deleting historical data, go to Settings → Account → Close account. Closing deactivates the account and stops all alerts. If you want your data erased as well, use the delete option above — closing alone does not erase. Dormant closed accounts are deleted on the 24-month schedule described above.

If there is a breach

If we determine that your personal information has been subject to unauthorized access, disclosure, or loss, we will:

• Notify you by email at the address on your account within 72 hours of confirming the incident, and sooner where the risk is severe;
• Tell you plainly what happened, what data was involved, when it happened, and what we have done about it;
• Give you specific instructions for protecting yourself — which may include changing your password, being alert to phishing that references your case, or, where immigration information was involved, contacting an immigration attorney;
• Notify regulators and any other parties required by applicable law, including state attorneys general, within the timeframes those laws require;
• Publish a public post-incident report at https://uscasestatus.com/breach-report once the investigation concludes.

We will not delay notice to protect our reputation, and we will not use vague language to obscure what was lost.

If our ownership changes

If we are involved in a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be among the assets transferred. If that happens:

• We will notify you by email at least 30 days before any transfer takes effect, and post prominent notice on the site.
• The acquiring entity must agree in writing to honor this Privacy Policy with respect to information collected before the transfer, and may not materially change it without your active consent.
• If the acquirer will not make that commitment, or if you simply prefer not to continue, you will have at least 30 days before the transfer to either download a complete copy of your data in a portable format, or have your data securely destroyed rather than transferred. You choose.
• If we cease operations without a transfer, we will notify you at least 30 days in advance, make your data available for export during that period, and then securely destroy all user data.

California privacy rights

If you are a California resident, the CCPA as amended by the CPRA gives you the rights below. We honor these requests from all users, wherever you live.

Categories of personal information

Your rights

• Right to know what we collect, why, and who receives it — including the specific pieces of information we hold.
• Right to delete your personal information.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share, so there is nothing to opt out of — but the mechanism exists at Do not sell my info regardless.
• Right to limit use of sensitive personal information. We already limit our use to providing the service you requested.
• Right to non-discrimination. We will never deny service, charge a different price, or degrade quality because you exercised a privacy right. We do not offer financial incentives for data.

To exercise any right, use the privacy request form or email info@uscasestatus.com. We respond within 45 days and may extend once by another 45 days with notice. An authorized agent may submit a request on your behalf with written permission. We verify identity via the email address on the account, and we never require identity documents.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have substantially similar rights, including the right to appeal a denied request. To appeal, reply to our decision email or write to info@uscasestatus.com with "Appeal" in the subject line.

Children

Our service is not directed to children under 16, and we do not knowingly collect personal information from them. We recognize that minors are beneficiaries on many immigration petitions; a parent or guardian may track such a case using their own adult account. If you believe a child has provided us information, contact info@uscasestatus.com and we will delete it. We do not sell or share the personal information of any user under 16 under any circumstances.

Changes to this policy

• For clarifications and non-material changes, we update the "last updated" date and post a summary in our changelog at https://uscasestatus.com/changelog.
• For material changes — any change to what we collect, how we use it, who we share it with, how long we keep it, or whether we sell it — we will:
  1. Email every account holder at least 30 days before the change takes effect;
  2. Show an in-product notice the next time you sign in;
  3. Present a plain-language summary of exactly what changed, in a side-by-side "before and after" format, not a redlined legal document;
  4. Require you to actively click "I agree" to continue using your account. Continued use alone does not count as consent, and we will not treat silence as agreement.
• If you do not agree, you may export your data and delete your account, and we will not apply the new terms to you in the meantime.
• We will never apply a materially changed policy retroactively to information collected under an earlier one without your separate, active opt-in.
• Every previous version of this policy remains available at https://uscasestatus.com/policy-archive.

Contact us

Privacy questions, requests, and complaints: info@uscasestatus.com
Postal mail: Mundus Consult LLC, Texas, USA
Data protection contact: info@uscasestatus.com

If you are unsatisfied with our response, California residents may contact the California Privacy Protection Agency, and residents of other jurisdictions may contact their state attorney general or supervisory authority.