Law Enforcement Requests
Guidelines for agencies requesting records from an editorial review site that holds almost no personal data: required legal process, emergency standard, preservation, notice, and contacts. Updated: September 3, 2026.
Summary
These guidelines explain how the operator of this website responds to requests from law-enforcement and government agencies. They are written for investigators and for readers who want to know what could be disclosed about them. Key points:
- this website is an editorial review site with no user accounts, no uploads, and no stored images. The records that exist are limited to server logs, form submissions, and aggregate analytics (see Privacy Policy).
- Records are disclosed only in response to valid legal process — a subpoena, court order, or warrant — issued by a court or agency with jurisdiction, or in a documented emergency involving danger of death or serious physical injury.
- Requests go to lawenforcement@clothoff.ai from an official government domain; the response target is 10 business days, faster for emergencies.
- Preservation requests are honored for 90 days, extendable once for another 90 days, following the standard of 18 U.S.C. § 2703(f).
- Where the law allows, the affected person is notified before disclosure.
- Request counts are published in the Transparency report.
- Investigators looking for images or account data should contact the third-party provider that hosts them, not this site.
1. What data exists on this website
Before sending a request, please understand what the site is. this website publishes reviews and comparisons of third-party AI image tools. It operates no generator, hosts no user-generated content, accepts no uploads, and offers no user accounts, payments, or messaging. As a result, the site holds no images, no account histories, no payment records, and no content authored by visitors.
The categories of data that may exist, and their default retention, are:
| Category | What it contains | Default retention |
|---|---|---|
| Web server logs | IP address, timestamp, requested URL, user-agent, referrer | 30 days, then deleted or truncated |
| Form submissions | Text typed into the Report, Report NCII, DMCA, DSAR, and Contact forms, plus the sender’s email address | 12 months, or until the case is closed |
| Email correspondence | Messages sent to role mailboxes on the this website domain | 24 months |
| Analytics | Aggregate, cookie-consent-based page statistics; no cross-site identifiers | Aggregate only; not attributable to a person |
| Affiliate redirect logs | Timestamp and destination of clicks on sponsored links; no personal identifiers beyond the IP in server logs | 30 days |
| Age-gate cookie | A first-party flag that the visitor confirmed 18+ | 30 days, stored only in the visitor’s browser |
The site does not hold images, prompts, generation history, or subscriber data for any reviewed provider. Each review page lists the provider’s name and its published contact for legal requests as observed on the test date; investigators should direct requests about images or accounts to that provider or its hosting company.
2. What we require before disclosing records
We disclose records to a government agency only when one of the following applies:
- Valid legal process. A subpoena, court order, or search warrant issued in accordance with the law of the issuing jurisdiction, signed by the authorized official or court, and directed to the operator of this website. We apply the tiered standard of the Stored Communications Act, 18 U.S.C. § 2703, as a policy benchmark: basic log records may be produced in response to a subpoena or court order; any content of communications (for example the text of a form submission) requires a warrant or its equivalent.
- Emergency disclosure. Where a requesting agency states in writing, in good faith, that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay — the standard of 18 U.S.C. § 2702(b)(8). The request must describe the nature of the emergency, the specific records sought, and why they are needed immediately. Emergency requests are reviewed within 24 hours and, where credible, answered before formal process follows.
- Consent of the person concerned. A person may ask us to release their own records to an agency; this is handled through the DSAR route.
Informal requests — emails without legal process, requests from private investigators, or requests for “anything you have” — are declined with a pointer to this page. We do not provide records in response to foreign process directly; agencies outside the United States should use a mutual legal assistance treaty (MLAT) or letters rogatory through the U.S. Department of Justice, Office of International Affairs, or provide a domestic order recognized by a U.S. court.
3. How to submit a request
Send requests to lawenforcement@clothoff.ai from an official government email domain. A request should include:
- the requesting agency, the officer’s name, badge or ID number, and a call-back number;
- the legal authority (statute and type of process) and a copy of the signed process;
- the specific records requested, with the exact URL, date and time range (with time zone), and any IP address or email address that identifies the records — overly broad requests are returned for narrowing;
- the requested response deadline and, if applicable, the basis for asking that the affected person not be notified.
Attachments are accepted in PDF. Requests sent to other mailboxes (editorial, privacy, ncii) are forwarded internally, which adds delay. Because the operator publishes no postal address of individuals for privacy reasons, service by email to lawenforcement@clothoff.ai is the designated channel; where a jurisdiction requires formal service, ask for instructions by email first. Contact routes for non-legal matters are listed on the Contact page.
4. Response time and preservation requests
Standard requests are acknowledged within 2 business days and answered within 10 business days of receipt of valid process. Emergency requests are reviewed first. Requests that are deficient (unsigned, wrong entity, no jurisdiction, overly broad) are returned with an explanation rather than rejected silently.
Because default retention is short — 30 days for server logs — agencies that anticipate needing records should send a preservation request first. We preserve identified records for 90 days from receipt of a written preservation request and extend the hold once for a further 90 days on renewed request, mirroring 18 U.S.C. § 2703(f). Preservation does not by itself result in disclosure; legal process is still required to obtain the records.
Records are produced as exported text or CSV files with a cover statement describing how they were retrieved. We do not charge for routine requests. We do not provide expert testimony or interpretation of another company’s data.
5. Notice to the person concerned
Our policy is to inform the person whose data is requested before disclosure, so that they can seek legal remedies, unless one of the following applies: the process is accompanied by a court order under 18 U.S.C. § 2705(b) or an equivalent that prohibits notice; notice is otherwise prohibited by law; the request is an emergency disclosure under section 2 and notice would endanger a person; or we have no contact information for the person (for example, records consist only of an IP address in a server log). Where notice is delayed rather than prohibited, we notify the person once the restriction expires.
6. Transparency reporting and scope of these guidelines
We publish the number of law-enforcement requests received, the number answered in full or in part, the number of emergency requests, and the number of preservation requests in the Transparency report, updated at least twice a year. Because the site holds very little data, most reporting periods show zero or near-zero figures; we publish them anyway. Requests that concern reviewed providers rather than this site are counted separately as “misdirected”.
These guidelines do not create any rights enforceable against the operator and do not constitute legal advice. They may be updated as the law changes; the “Updated” date above is the current version. The consent standards that govern which providers we review are described in Responsible AI and the Acceptable Use Policy.
7. Contact
Law-enforcement requests: lawenforcement@clothoff.ai (official domains only; 24-hour review for emergencies; 10 business days for standard process). Legal questions: legal@clothoff.ai. Reports of non-consensual imagery from victims or their representatives: Report NCII or ncii@clothoff.ai — this route is faster than legal process for a victim seeking help, because the response target is 48 hours and includes referral to the provider’s removal route. Data subject requests: DSAR or privacy@clothoff.ai.
Related policies
- Privacy Policy — the full description of the data listed above.
- Transparency report — request statistics and policy changes.
- DSAR — how individuals request their own data.
- Report NCII and DMCA — abuse and copyright routes.
- Terms of Use and Acceptable Use Policy — the rules readers agree to.
Law Enforcement Requests: Common Questions
What data can this website actually provide to investigators?
Very little. The site has no accounts, uploads, images, payments, or messages. The records that exist are server logs (IP, timestamp, URL, user-agent) kept 30 days, text and sender emails from the report and contact forms kept 12 months, role-mailbox correspondence kept 24 months, and aggregate analytics that cannot be tied to a person.
Which legal process is required?
A subpoena, court order, or search warrant issued under the law of the requesting jurisdiction and directed to the operator of this website. As a policy benchmark we follow 18 U.S.C. § 2703: basic log records on a subpoena or court order, content of form submissions only on a warrant or equivalent. Informal requests are declined.
How are emergency requests handled?
A written request stating in good faith that an emergency involving danger of death or serious physical injury requires disclosure without delay — the 18 U.S.C. § 2702(b)(8) standard — is reviewed within 24 hours. It must describe the emergency, the exact records, and the urgency. Credible emergency requests are answered before formal process follows.
How do I send a preservation request, and how long does it last?
Email lawenforcement@clothoff.ai from an official domain with the exact URL, time range with time zone, and identifiers such as an IP address. Identified records are held for 90 days from receipt and extended once for a further 90 days on renewed request, following 18 U.S.C. § 2703(f). Legal process is still needed to obtain the preserved records.
Will the person concerned be told about a request?
Yes, where the law allows. The operator notifies the person before disclosure unless a court order under 18 U.S.C. § 2705(b) or another law prohibits notice, the request is a credible emergency where notice would endanger someone, or no contact information exists — for example when the record is only an IP address. Delayed notice follows once the restriction expires.
Can agencies outside the United States request records?
Not directly. Foreign agencies should use a mutual legal assistance treaty (MLAT) or letters rogatory through the U.S. Department of Justice, Office of International Affairs, or obtain a domestic order recognized by a U.S. court. Emergency requests involving danger of death or serious injury are reviewed from any jurisdiction under the same 24-hour standard.
I am investigating an image made with a reviewed tool. Who holds the evidence?
The third-party provider that operated the tool, together with its hosting and payment companies. this website never receives or stores images, prompts, or account data from any provider. Each review page records the provider’s published legal or abuse contact as of the test date, which is the fastest starting point; misdirected requests to this site are logged in the Transparency report.