Draft. This page may change before it is final. Version 2026-10-draft1.
Law enforcement requests
Carnival hosts small websites. On the free plan a site is live for 7 days, unless its owner restarts the clock from their dashboard or we restore it after an appeal. We answer valid legal process, and we keep little for long: the data you ask for is often already gone.
How to send a request
Email legal process to legal@carnival.dev, addressed to [LEGAL ENTITY NAME]. Include:
- your name, agency and contact details;
- the legal authority for the request;
- the site's address (Carnival sites end in .carnival-staging.page) or the account's email address;
- the dates you need, and any deadline.
We need the process that the law requires for what you ask for:
- Subpoena: subscriber information, such as the account's email address and when it signed up.
- Court order under 18 U.S.C. § 2703(d): other records, such as a site's deploy history and the IP addresses it was published from.
- Search warrant: content, such as a site's files.
From outside the US, send requests through a Mutual Legal Assistance Treaty (MLAT) request or, where one applies, an agreement under the CLOUD Act.
Emergencies
If someone is in danger of death or serious physical injury, email legal@carnival.dev with "Emergency" at the start of the subject. We watch it around the clock, on a best-effort basis. Say what the emergency is, which site or account it involves, and why it can't wait for legal process. We may disclose information without legal process when we believe in good faith that the emergency requires it.
Preservation
On a request under 18 U.S.C. § 2703(f), we preserve what we still hold about the site or account for 90 days, and for 90 more if you renew the request. A preserved site's files and records are kept until the hold ends, even after the site itself has ended.
Telling the account holder
We tell the account holder about a request for their data, unless the law or a court order bars us. We never tell an account holder about a report of child sexual abuse material: we report it to NCMEC, and keep the evidence as the law requires.
What we keep, and for how long
A "shortened IP address" is the first three parts of an IPv4 address or the first 48 bits of an IPv6 one, not the full address.
| Data | Kept |
|---|---|
| A site's files | Until the site ends (on the free plan, 7 days after it first went live or its owner last restarted the clock with Redeploy; a site restored after an appeal gets back the time it had left), then deleted within an hour |
| Files of a site we took down | 180 days as evidence; child sexual abuse material at least 1 year |
| Deploy records: when each version was published, the IP address and user agent it came from, its file list, the site's title | 90 days after the site ends, or longer while a report about it is open; longer for a site we took down or acted on for child sexual abuse material |
| Account: email address, how it signs in, and its shortened IP address at sign-up | While the account exists; erased within 24 hours after it is deleted, unless a legal hold, an open appeal or a child-safety case defers it |
| Account: when it signed up, confirmed its age and last signed in, the app and the country and network it signed up from, and its standing (reputation, any suspension); for a banned account, a keyed hash of its email address | Kept with the account's ID after it is deleted |
| Agent connections: the app's name, when it was approved, and the approving browser's country, network, shortened IP address and user agent | While the account exists; 90 days after a connection is revoked or expires |
| Web sign-in sessions: shortened IP address and user agent | Until they expire (at most 90 days) |
| Audit log of account and admin actions | 13 months |
| Reports and takedowns | 3 years |
| Operator logs (may hold visitors' IP addresses) | 7 days |
| Traffic and server metrics (no IP addresses) | 3 months |
| Daily traffic totals for each site (no IP addresses) | 13 months |
| Database backups | 30 days |
Anything under a preservation request or other legal hold is kept until the hold ends.
We never receive the conversations or prompts behind an agent's requests. There are no passwords (people sign in with a code sent by email) and no payment details (Carnival is free).