Legal
Privacy Policy
What we collect, why, and your choices. Last updated 2026-10-09.
The short version
Most of BenchPath — search, rules, judge directory, workflows, the Law Library, coverage — works with no account and collects no personal data about you. Personal data enters only when you choose to create an account, save a matter, a search or a deadline set, follow something, or submit a report. We do not sell personal data, and we do not run third-party advertising trackers.
What we collect
Account: email and authentication data when you sign up. Your work: matters you create (which may include a client name, case number, county, and case type you enter); the judges and rules you follow and your alert preferences; saved searches you keep on your account (the search terms, filters and label, and whether you turned an alert on); deadline sets you save (a label, the trigger date you entered, and the deadlines computed from it); and checklist progress (which items you marked done, and when). Contributions: the content of any correction or ruling report you submit, plus an optional email and, if you provide it, a case number or bar number. Operational: standard server logs and aggregate analytics needed to run and secure the service.
What we do not want
Do not submit privileged, sealed, confidential, juvenile, or protected-victim information through any form. Do not enter more personal data into a matter, a saved search or a deadline set than you need. For judges and judicial assistants, BenchPath stores only official professional contact information published by a court — never residential addresses, personal phone numbers, dates of birth, or family details.
How your data is protected
BenchPath's browser application holds no server secret: public pages use a publishable key, server routes use scoped server-only secrets that are never exposed under a public name, and access to your private data (matters, follows, alerts, saved searches, deadline sets, checklist progress, profile) is enforced at the database by row-level security so that you — and only you — can read your own records. Authorization attributes are server-controlled and cannot be changed by an ordinary account.
How we use it
To provide the service you asked for: authenticate you, generate and save your matters, run the searches and deadline computations you save, deliver alerts you subscribe to, triage your reports, and keep the service secure and reliable. Contributed reports may be used, in de-identified and reviewed form, to improve the accuracy of published entries; a single report is never turned into a published judicial tendency.
Retention and deletion
Account and workspace data (matters, follows, alerts, saved searches, deadline sets, checklist progress) are kept while your account is active; the retention table below states each category's period and rule. You may request deletion or export of your personal data from the requests panel on this page; we will honor it subject to any legal-hold or fraud-prevention needs. Reporter identifiers on contributions are kept separately from any published content and are not published by default.
Sharing
We share personal data only with the providers needed to run the service, each under its own terms: Vercel (hosting), Supabase (database and authentication), Square (payment processing — card details are entered on Square's own checkout and never touch BenchPath infrastructure; BenchPath keeps the order reference and your resulting access), and Resend (transactional email to your own address). When you use an AI-assisted analysis feature, the AI provider receives the court-record material and case context needed for that analysis — never your account identity. The full provider list, with the condition under which each one receives anything, is in the table below. We do not sell personal data, we do not share it with advertisers, and where the law requires disclosure we disclose only what is required.
Your choices
Use BenchPath without an account for anything public. Decline optional fields on any form. Request access, export, correction, deletion, restriction, or objection from the requests panel below (sign in first); each request carries a 30-day response deadline. Report a privacy concern — including a judicial-PII removal request — through the corrections process, which has an expedited lane.
Data inventory
The categories below are the record engineering maintains (trust registry 2026-10-09.1, reviewed 2026-10-09); the policy above describes them in plain words.
| Category | What | Why | From | Kept under |
|---|---|---|---|---|
| Account and identity | Email address, authentication records, account identifier, display name, consent state, and any professional-verification fields you choose to submit. | Sign-in, account administration, authorization, fraud prevention, and communications you request. | You, Supabase Auth, and an authorized BenchPath reviewer for professional verification. | Account and workspace content |
| Private workspace | Matter names, optional client and case identifiers, dates, notes, saved rules, follows, and alert preferences that you enter; saved searches you keep on your account (search terms, filters, label, alert choice, and an optional matter link); deadline sets you save (label, the trigger date you entered, the computed deadlines, and an optional matter link); and checklist progress on your matters (which items you marked done, and when). | Provide the private workspace, saved research, saved searches and their alerts, saved deadline computations, checklist progress, reminders, and related product functions. | You. | Account and workspace content |
| Corrections and contributions | Correction or ruling-report content, account linkage, and professional-verification evidence when a verified-attorney lane is used. | Triage, verify, correct, moderate, and document provenance. Raw reports are not automatically published. | You. | Contributor and correction records |
| Commerce and entitlements | Plan, payment and subscription status, provider transaction identifiers, amounts, currency, refunds, access grants, and idempotency records. BenchPath does not receive or store a full card number. | Complete purchases, maintain access, prevent replay and fraud, process refunds, and meet accounting obligations. | You, BenchPath, and Square when commerce is enabled. | Financial, entitlement, and fraud records |
| Security and reliability | Pseudonymous keyed account/network tokens, coarse route and provider labels, outcome and reason codes, counters, correlation identifiers, and control changes. Security events exclude raw IP addresses, prompts, webhook bodies, matter/client identifiers, and report or contribution narratives. | Prevent abuse, investigate incidents, measure reliability, and prove privileged actions. | BenchPath application and infrastructure controls. | Pseudonymous security events |
| Optional aggregate usage analytics | Only when separately enabled for the deployment and affirmatively allowed on the device: a query-free allowlisted page URL, a public route slug or redacted private-matter route shape, coarse allowlisted product-event fields, timestamp, referrer origin, and provider-derived aggregate device/browser/geography fields. BenchPath does not place an account, matter, client, email, case, search-query, or private-record identifier in an analytics event. | Measure aggregate product adoption and public-site navigation without building an account-level or cross-site browsing profile. | Your browser and Vercel Web Analytics, only after the deployment and device-policy gates both allow collection. | Optional aggregate web analytics |
| Enterprise evaluation and firm administration | Demo contact details and firm-level evaluation notes when you submit the gated form; pseudonymous SSO-attempt evidence; and minimized organization audit events for active firm administrators. Case narratives and confidential documents are prohibited from enterprise demo intake and organization audit records. | Respond to an enterprise evaluation request, protect SSO initiation from abuse, and provide authorized organization-administration accountability. | You, your configured identity provider when SSO is active, and bounded BenchPath organization controls. | Enterprise evaluation requests |
Retention periods
| Records | Period | Rule |
|---|---|---|
| Account and workspace content | While the account is active; verified deletion requests are targeted for completion within 30 days. | Live product records are deleted or de-identified after identity verification and operational review, unless a documented legal, tax/accounting, active-dispute, chargeback, court-order, or fraud/security exception applies. Provider backups age out under the provider's then-verified backup retention rather than being edited in place. |
| Contributor and correction records | Raw identity-linked records are reviewed for deletion or de-identification two years after the report is resolved. | A de-identified, independently verified public fact and its official-source provenance may remain. Legal holds, active disputes, and security/fraud investigations pause deletion only for the affected scope. |
| Financial, entitlement, and fraud records | Seven years after the transaction or account closure, whichever is later. | Only the minimum transaction, tax/accounting, chargeback, entitlement, and fraud evidence is retained. Product narratives are not copied into financial records. |
| Pseudonymous security events | 400 days from the event. | Events use keyed pseudonymous tokens and structured allowlisted fields. High-risk incident evidence may be placed on a documented legal/security hold with a review date. |
| Optional aggregate web analytics | No collection while either gate is closed. If activated, the provider reporting window and deletion behavior are plan and account-setting dependent and must be evidenced before release. | BenchPath does not copy Vercel Web Analytics events into the application database. A device choice remains in browser storage until changed or site storage is cleared; browser privacy signals take priority. Historical aggregate provider data is not represented as erased merely because future collection is disabled. |
| Reviewer, administrator, security, privacy, and control audit | Seven years from the privileged action. | The audit is append-only, payload-minimized, hash-chained by month, and subject to controlled retention receipts. It stores state hashes and reason codes instead of case, client, prompt, or report narratives. |
| Privacy-request proof | Seven years after closure. | BenchPath retains the request type, identity-verification method, status history, deadlines, exception codes, and fulfillment proof—not the confirmation email or a duplicate of the exported content. |
| Enterprise evaluation requests | 180 days after submission for raw contact and evaluation fields. | A retention job deletes expired raw contact fields. A content-free hashed acceptance and purge receipt may remain for abuse prevention and proof of deletion. Organization audit events follow the privileged-audit rule; SSO-attempt evidence is pseudonymous and contains no email address or provider password. |
Storage on your device
BenchPath sets no advertising or cross-site cookies. The browser storage it uses is listed here with what each key holds and whether anything leaves the device.
| Storage | Keys | What it holds | Lifetime | Leaves the device |
|---|---|---|---|---|
| Essential authentication session | Provider-managed Supabase auth cookies (normally sb-…-auth-token and chunk variants) | Session credentials used to keep an account signed in and refresh authorized access. They are not reused as product-analytics identifiers. | Governed by the current Supabase Auth session configuration and cleared during a successful sign-out; exact hosted settings require external release evidence. | Yes, only as required for authenticated BenchPath/Supabase requests. Do not copy or disclose these credentials. |
| Display and language preferences | bp-theme; bp-display; bp-prose-lang | The selected light/dark appearance, the Display settings choices (text size, contrast, motion, link underline, text spacing), and the pro-se plain-language display choice. | On this browser until changed or site storage is cleared. | No. |
| Device-local workflow conveniences | bp-palette-recents; bp-saved-searches; bp-onboarding; bp-watching-visit; bp-watching-prev-visit | Up to five command destinations, the device copy of saved public search URLs, onboarding selections, and local visit timestamps used for on-device UI state. A search you choose to keep on your account is stored under the Private workspace category above, not here. | On this browser until overwritten by the feature or site storage is cleared. | Only when you import a device-saved search into your account. A saved search can contain terms you entered, so do not use client or confidential facts in search text. |
| Experiments and optional analytics choice | bp-device-id; bp-experiment-exposures; bp-first-follow-tracked; bp-analytics-preference-v1 | A random device-local experiment bucket, local exposure/first-use receipts, and an allow/deny analytics choice. The random device identifier itself is not sent in BenchPath analytics events. | On this browser until site storage is cleared. Analytics stays off without an explicit allow value. | Only an allowlisted experiment name/variant or coarse first-use event may leave the device, and only after both analytics gates allow it; the stored device identifier does not. |
| Offline application shell | Browser Cache Storage entries beginning bp- | Versioned public application assets and the generic offline page. Account documents and private page responses are not eligible for offline document caching. | Old versioned caches are removed by the service worker; clearing site data removes the remainder. | No; cache entries are local copies of public assets already requested by the browser. |
| Conditional human-verification storage | Cloudflare Turnstile provider-controlled challenge storage | Browser/network challenge state used only when a separately gated Turnstile form is enabled and loaded. | Controlled by the provider under its current documented behavior; activation requires current evidence and public disclosure review. | Yes, to Cloudflare only when the gated challenge is invoked. No Turnstile request occurs merely because its component code exists. |
Providers
| Provider | Role | What it receives | When |
|---|---|---|---|
| Vercel | Application hosting, content delivery, request handling, and deployment logs. Cookie-free Web Analytics is a separately gated optional function. | Request metadata and content needed to serve the application. Optional analytics is limited by BenchPath to query-free allowlisted/redacted URLs and coarse event fields; Vercel may derive aggregate referrer-origin, device/browser, and geography fields as described in its Web Analytics documentation. | Core hosting is active. Analytics remains off unless BP_WEB_ANALYTICS_ENABLED is exact-true, the Vercel project setting is externally verified, and the device has affirmatively allowed analytics. Global Privacy Control or Do Not Track blocks collection. |
| Cloudflare Turnstile | Human-verification and automated-abuse prevention for public intake forms. | Challenge token and provider-observed request/browser/network metadata needed to verify the challenge. BenchPath replaces the raw token with a bounded HMAC receipt and does not store the raw challenge token or IP address in its application database. | Used only when a Turnstile-protected intake form is enabled and you submit that form. |
| Supabase | Database, authentication, server-side database APIs, and source-monitor Edge Functions. | Account, product, contribution, entitlement, privacy-request, and operational records described on this page. | Core database and authentication are active. |
| Resend | Transactional authentication email through Supabase SMTP. | Recipient email address, delivery metadata, and the transactional message. | Used only when custom SMTP is enabled in the Supabase project. |
| Square | Hosted checkout, payment, refund, invoice, and subscription processing. | Checkout details, contact/payment information supplied to Square, transaction identifiers, amount, currency, and subscription status. BenchPath receives status and identifiers, not a full card number. | No data is sent until the billing feature and provider credentials are activated and you start checkout. |
| Anthropic | One of the providers used by the separately gated dual-provider research-analysis feature. | Only the bounded research request and source material allowed by that feature. Policy prohibits privileged, sealed, confidential, matter/client narrative, or personal data in model prompts. | No request is sent unless the feature, schema guard, account authorization, and Anthropic provider configuration are active. |
| OpenAI | One of the providers used by the separately gated dual-provider research-analysis feature. | Only the bounded research request and source material allowed by that feature. Policy prohibits privileged, sealed, confidential, matter/client narrative, or personal data in model prompts. | No request is sent unless the feature, schema guard, account authorization, and OpenAI provider configuration are active. |
| CourtListener / Free Law Project | Case-law search for the separately gated case-law and research features. | The search terms or public case identifiers submitted to the feature and ordinary server-to-server request metadata. | Used only when a case-law feature is invoked and its provider configuration is active. |
Your data requests
File an access, export, correction, deletion, restriction, or objection request from your account. Each request carries a 30-day response deadline; the privacy team replies to your account email and never asks you for a password.
Checking your account…
Related: terms of use, security, and corrections & data requests.