Law Enforcement Requests

For each Stovyn customer who has paired a device, we typically hold:

• --Account info: email, name, signup timestamp, IP address at signup, hashed password.
• --Device pairing: device ID, hardware tier (Standard or Pro), pairing timestamp, display name and location label the customer provided.
• --Status snapshots: most recent device-state JSON (cooking on/off, burner active counts, battery percent, firmware version, Wi-Fi RSSI). Retention: rolling 90 days.
• --Event log: cooking-started, cooking-cool, alert, capture-saved transitions with timestamps. Retention: rolling 90 days.
• --SMS escalation log (for trusted-contact alerts): timestamps, masked recipient phone, status of delivery. Retention: 12 months for compliance audit.

What we do NOT have

• --Camera images, frames, or video. The Pro model's camera processes locally on-device and does not stream image bytes to our cloud. Snapshots remain on the device. We cannot produce camera content because we do not store it.
• --Audio recordings. The microphone runs on-device frequency-band detection and does not record speech.
• --Real-time location of the customer beyond the IP address from which they accessed our services.

We require valid legal process before producing customer information. The required process depends on the data category and the requesting jurisdiction:

• ·Subpoena: basic subscriber information (name, email, signup date, last-seen).
• ·Court order under 18 U.S.C. § 2703(d) or equivalent: non-content records (status snapshots, event log timestamps, login IP history).
• ·Search warrant or equivalent judicial order: any data we may have that constitutes content (e.g., the customer's display-name and location-label fields if you consider those user-generated content).
• ·Mutual Legal Assistance Treaty (MLAT) / equivalent: we generally require non-US authorities seeking data on US-resident customers to use MLAT, unless an exception applies.

Emergency disclosure

In good-faith emergencies involving an imminent risk of death or serious bodily injury, we may voluntarily disclose limited information without legal process, consistent with 18 U.S.C. § 2702(c)(4) and analogous laws in other jurisdictions. Emergency requests must come from a verifiable government email and include the nature of the emergency. We will document and audit all emergency disclosures.

User notice policy

We will notify customers of legal-process requests for their information before producing data, unless:

• --we are legally prohibited from doing so (e.g., a non-disclosure order accompanies the process);
• --the request is in connection with a child-safety investigation, an ongoing criminal investigation involving imminent harm, or another exception recognized in the applicable jurisdiction.

When a non-disclosure order expires, we will notify the customer if reasonably possible.

Transparency reporting

We will publish an annual transparency report disclosing the number of law-enforcement requests received (by jurisdiction and process type), the number we complied with in whole or in part, and the number we rejected as facially defective. The first report will cover the period beginning on our first commercial sale.