Privacy Policy

Effective date: October 30, 2026

This policy covers the sjq.legal website, the free questionnaire editor, and the SJQ Processor processing service, all operated by Timbre Solutions ("we," "us"). It is written to be read, not skimmed, because how we handle juror data is the product. Where we describe how the software works, the software works that way.

The website

• The site sets no cookies, runs no analytics or advertising trackers, and loads no third-party scripts or fonts.
• If you email us or request early access, we receive what you send and use it only to respond and to provide the service you asked about.

The questionnaire editor

• Your questionnaire stays on your computer. The editor's program comes from sjq.legal, but importing, editing and building the PDF all happen in your browser. The questionnaire is never uploaded unless you choose to save an encrypted draft, below.
• Saved drafts are encrypted before they leave your browser. With an early-access code you may save a draft here. It is encrypted on your computer with a passphrase we never receive, so we store only data we cannot read. Alongside it we keep the email address you give us, for reminders, and the time of your last save.
• Drafts are deleted 30 days after your last save. We email reminders 15 and 5 days before. An encrypted copy is kept in our backup storage so a server failure can't lose your draft; it is removed when the draft is.

Processing completed questionnaires

Completed juror questionnaires contain personal information about citizens who did not choose to be our customers. The service is built so that we cannot read them, and so that they cannot outlive your case.

• Encrypted on your computer, with a key only you hold. When you create a case you choose a passphrase. Your browser makes the case's encryption key and locks it with that passphrase; we store only the locked key. Every file is encrypted in your browser before it is sent. What we store is unreadable without your passphrase. If you lose the passphrase, the case and its report cannot be recovered, by you or by us.
• Decrypted only in memory, only while processing. When you press Process, your browser sends the case key over an encrypted connection to our processing function in Amazon Web Services, which at once seals it with that case's own key. Pages are decrypted only in the memory of short-lived cloud functions, and only while they are being read. Results are encrypted with your case key, and your browser unlocks the report.
• No processing server anyone can log into. Processing runs in sealed, short-lived cloud functions; there is no processing server to sign in to, including for us. Case storage refuses every Timbre Solutions user, including our own administrator accounts, by policy, and every access to it is recorded by AWS CloudTrail. The honest limit: the owner of the cloud account can always change a policy, and that change is itself recorded.
• One case, one storage bucket, one key. Cases are never stored together. When both sides of a case use the service, each is its own case.

Who reads the handwriting

• Written answers are read by Amazon Textract, Amazon's handwriting-recognition service, inside our cloud account. Our account is set so that Amazon does not use this content to improve its services.
• Check marks, 1-to-7 scales and circled names are read by our own software inside the processing function, by measuring the ink in each printed box. No AI is involved.
• AI re-read is off unless you turn it on. In the editor you may allow it, then choose the exact questions it may re-read when the handwriting is hard to read. When you create a case you are asked again, for that case. Only the cropped answer area is sent, never the whole page, and names and signatures are never sent, whatever is chosen. AI re-read uses Anthropic's Claude. Under Anthropic's commercial terms, what it is sent is not used to train its models. We never see the answers sent or what the AI read; we record only how many answers were sent, and your Certificate of Destruction states whether AI re-read was used and that count.

Destruction, with proof

• On a schedule you can see. Every case is destroyed 7 days after it is created, or 24 hours after you first download its report, whichever comes first, or sooner if you press Destroy. A court order requiring earlier destruction controls; tell us about it.
• A cryptographic erase. Every stored file is deleted and the case's key is retired, the cryptographic erase described in NIST SP 800-88. If you choose the DoD-style wipe when creating the case, every file is first overwritten with random data.
• A signed Certificate of Destruction. Each destruction produces a certificate you can file, signed so that anyone can check it at sjq.legal/process/verify.

What we keep, and for how long

• The destruction record and certificate, kept so the certificate stays checkable and you can download it again. It holds the case number, dates, the number, sizes and fingerprints of the encrypted files, whether AI re-read was used and how many answers it was sent, and a value derived from your passphrase that lets you fetch the certificate. It holds nothing a juror wrote.
• Access records (AWS CloudTrail), kept 7 years: which system touched which encrypted file, and when, including the network (IP) address each upload and download came from. Never the files' contents.
• Processing logs, kept 14 days: case numbers, counts, timings and error types. Never a juror's answer, a file name or an image.
• Web server logs, kept 30 days. Ordinary page visits are not logged. When the server records an error or an unusual request, the entry includes the requesting computer's network (IP) address. The draft store records each save and deletion under an anonymous ID, and the address of any reminder email that fails to send. They contain no questionnaire content.

Protected-class information

Where a court-approved questionnaire collects protected-class information (such as race, religion, or national origin), it is recorded for the record only. It is never used in any analysis, flag, score, or recommendation, and the software refuses review terms that name a protected class. This restriction is enforced in the software itself.

What we never do

• Sell or share juror or client data, or use it for marketing, model training or profiling across cases.
• Keep a database of juror information across cases, or collect the questions you write. Saved drafts are encrypted so we can't read them, and are deleted 30 days after your last save.
• Collect diagnostics that contain personally identifying information.
• Keep juror data after its case is destroyed.

Questions

Contact support@timbre.solutions. We would rather answer a hard question before an engagement than after one.