A brief is privileged. This page says what happens to it, in the order it happens.
Your text or file is processed in memory on a machine we control, the report is returned, and the input is discarded with the request. No copy is written to disk. The log line for a request carries the kind of input, its size, the number of citations, the tier counts and the time taken. Never a citation, a party name or a word of text. When you are signed in, a keyed fingerprint of the text (not the text, and not reversible) is kept for 30 minutes, so that saving the brief you just checked does not count a second check.
Only if you ask. After a check, a signed-in user can save the brief to the account; nothing is saved otherwise. A saved brief (its title, its text, its report and up to 20 earlier versions) is encrypted with a key that belongs to your account alone, derived from a master key kept outside the database. It is used for one thing: showing it back to you. Delete it on its page and it is gone, with its versions; deleting the account deletes every saved brief. The log records that a brief was saved, re-checked or deleted, with its number and counts, never its title or text.
| when | where | what |
|---|---|---|
| a citation the local register does not resolve (optional fallback, off by default) | CourtListener's citation lookup | the citation strings only, such as "167 F.4th 123". Never prose. |
| you turn on the deep check | the judgment model provider | the cited opinion's paragraphs, the case name and citation, and the clause before the citation in your draft. |
| you search Find cases with a US sentence (beta) | the judgment model provider | your sentence, to check that it states a rule of law, and then your sentence with the paragraphs, names and citations of up to 10 candidate cases. A Swiss article search sends nothing. |
These two are the only places where words you wrote leave the machine, and only when you ask.
The PDF record and the annotated .docx are generated from the report your browser already holds and sent back to you. They are not kept.
The free tier needs no account. With an account we keep your email address, the plan, a count of checks per month, a hash of each API key and the briefs you choose to save. There are no passwords: sign-in links are sent by Resend, which sees your address and the link. Payment runs through Stripe, which sees your email address and your card; we never see the card. Delete the account on the account page, or ask at privacy@proofread.law: the account, its saved briefs, its keys and its sign-ins are deleted at once. Monthly check counts stay, tied to no address. Stripe keeps its own billing records.
One cookie, only after you sign in, holding the session. No third-party scripts. To see which pages get read, our own script sends our server three things when a page opens: its path (never what you typed or searched), the name of the site that linked to it, and a campaign tag if the link carried one. The server adds the country Cloudflare reports and counts one view for the day. We keep no IP address, cookie or other identifier for this, and your browser sends nothing if Global Privacy Control or Do Not Track is on.
For each check we keep its results as numbers, so we can see when the checker gets something wrong: how many citations it found and of what colour, and for each citation its colour, the reporter and year, and the deep check's verdict and confidence. We never keep the text, the case names or the page of a citation. These numbers are deleted with your account, and after a year in any case.
Requests pass through Cloudflare, which terminates TLS at its edge: a check is decrypted there and re-encrypted to our machine through a tunnel, so Cloudflare handles the bytes in transit. It caches the public pages only; nothing from a check is cached or stored there. If that is not acceptable for a document, the same checker is available on a private connection for firms: hello@proofread.law.
Data Alchemy Labs. privacy@proofread.law.