Law Enforcement Guidelines
These guidelines are for law enforcement and other authorities seeking information about content or an account on cubeupload.com. Nothing here is legal advice, and nothing here waives any requirement of valid legal process.
Making a request
Send requests from an official email address to legal@cubeupload.com.
Include the legal basis for the request, the specific images (by URL) or account
in question, and a point of contact.
[TODO: confirm postal service address for legal process, the specific form of process required for each data category and jurisdiction, and the designated contact.]
Emergency disclosure
If a request involves an imminent risk of death or serious physical harm to a person, mark it “EMERGENCY DISCLOSURE REQUEST” and describe the emergency and the information needed. We review these immediately.
[TODO: confirm the emergency-request process and any standard form.]
Preservation
We will preserve records and content relevant to a specified investigation on request, ahead of formal process. Content that our systems have identified as child sexual abuse material is already retained indefinitely in secure storage; see Child Safety.
What we can provide
Subject to valid process, we can typically provide:
- Account records — registration details and account activity.
- Upload records — for a given image or file: original filename, content hashes (multiple hash types are recorded, so a hash you supply can be matched regardless of format), the uploading account, the IP address used, and timestamps. These records are kept even after an image or account is deleted.
- Address history — the IP addresses associated with an account over time.
- The image file itself, where it is still held. Note that the copy cubeupload serves has camera and location metadata (EXIF) removed; the exact original is retained only for a short period after upload unless it has been preserved for an investigation or flagged by our child-safety systems.
How we disclose
Records are provided as a fixed document whose integrity checksum we record, so a copy can later be verified as the one we sent. Where a record is delivered electronically, the recipient collects it through a time-limited, access-logged link, with a one-time password provided separately.
Notice to users
Our default is to notify an account of a request for its data, unless we are legally prohibited from doing so, a court has ordered otherwise, or notice would be counterproductive in an emergency.
Draft — pending review.