GrapeVine · Trust and policies
Law-Enforcement Request Protocols
Updated October 28, 2026 · GrapeVine is a product of FOAF
These protocols describe how GrapeVine, a product of FOAF, receives and evaluates requests from law enforcement. They do not create a right to obtain data, waive legal requirements or guarantee that any particular record exists.
Download plain-text copy1. Where to send requests
Authorized officials should email contact@foafapp.com from an official agency email address with the subject “Law enforcement request”. Include your agency, official name and title, official contact details, case reference, jurisdiction and the legal process or authority relied on. We may independently verify the requester and contact the agency through published channels.
This published intake address is not a waiver of formal service requirements and email alone does not make a request legally valid. Members and private parties should use ordinary support or safety-report channels, not represent themselves as law enforcement.
2. Identify the account and limit the scope
Provide the specific GrapeVine username, profile URL or account identifier, relevant date range and time zone, records sought, investigation purpose and legal basis. Attach complete, readable legal process issued by an authority with appropriate jurisdiction. Identify any nondisclosure order and its duration. Requests must be targeted and proportionate; broad or unclear requests may require clarification.
3. Legal review and disclosure
We assess the requester’s authority, the validity and scope of the process, applicable law and the information actually available. Account, connection, message and transaction-related records may have different legal protections. We may seek clarification, narrow or challenge a request, or decline requests that lack an adequate legal basis.
We disclose information only when required or otherwise permitted by applicable law, and limit disclosure to information responsive to the valid request. A request does not give direct access to our systems. Payment processors and app stores control some payment records and may need separate legal process. We cannot provide records we do not hold.
4. Preservation requests
For preservation, use the subject “Preservation request” and identify the accounts, record categories, relevant time period and applicable legal authority. Where legally required or appropriate, we preserve available responsive records pending valid legal process for the period applicable law requires. A preservation request is not a disclosure request and does not restore records already deleted. Include the original request reference in any extension or follow-up.
5. Emergency disclosure requests
If there is an imminent risk of death or serious physical injury, contact local emergency services first. An authorized official may send a request with the subject “EMERGENCY: imminent risk” to contact@foafapp.com. Include the nature and immediacy of the danger, who is at risk, relevant account identifiers, the specific data needed, why ordinary legal process cannot be obtained in time, and an official callback number.
We evaluate emergency requests case by case under applicable law. We do not guarantee that the inbox is monitored continuously, that a request will be answered within a particular time, or that disclosure is permissible. This channel is not a replacement for emergency services.
6. User notice, confidentiality and child safety
Where appropriate and legally permitted, we may notify a member about a request affecting their information. Notice may be delayed or withheld when prohibited by law or when disclosure could create a serious safety risk, compromise an investigation or involve child exploitation. We handle preserved and disclosed information with access restrictions appropriate to its sensitivity.
We prohibit human trafficking and child sexual exploitation. When we become aware of apparent child sexual exploitation, we follow applicable reporting and preservation obligations, including reporting to NCMEC’s CyberTipline or the appropriate regional authority where required. Do not send suspected CSAM through ordinary email; identify the account and location of material instead.