Privacy
loupe.legal · last changed 5 November 2026
A filing is a client's confidence before it is a document, so the short version matters more than the long one.
We do not keep the documents you check. A document is checked and the report is returned to you. Larger multipart uploads may be buffered briefly on ephemeral disk while the request is processed; that temporary data is discarded with the request. Our application does not write document bodies to its database or logs. Cloudflare may retain operational request metadata under its platform settings. The one exception is yours to make: signed in to an account with a plan, which every account has free while Loupe is in testing, you can keep a check in your account, and then its record is kept until you delete it. The document's full text is kept with it only if you tick the box that asks.
Optional feedback and requests for access
Feedback is separate from checking a document. If you choose to send it, we keep the reason you select, which screen it concerns, your optional message and reply address, and a submission identifier to prevent duplicate messages on retry. A selected finding is included only if you tick its box; the preview shows exactly what will be sent. No document, filename, account identifier or surrounding draft is attached automatically. Please leave out confidential material.
Feedback is stored in Loupe's application database for up to 90 days, then removed by the daily cleanup. It is also included in the founder's email summary so it can be read and answered. Email copies and any follow-up correspondence are retained while needed to handle the issue; write to privacy@loupe.legal to request their removal. Anonymous feedback can be identified by its submission identifier.
A request for access, or for a word when paid plans open, made while those forms were offered, stores your email, the role or task you described, when you asked, and where from. It is included in the founder's email summary. The database removes request details after one year; you can ask us to remove them earlier. Sending a request does not create a subscription, activate access or start billing.
To limit repeated submissions, we keep daily counters using a keyed digest of your network address, separately from these messages. They expire within 48 hours and are not joined to your document or message.
What happens to a document you check
It goes from Cloudflare, over an encrypted tunnel, to our checking server, which Amazon Web Services runs for us in Oregon, USA. There it is parsed, the citations in it are found, and each is checked against the sources named below. Then the report goes back to you and the request buffers are discarded. We keep no application copy of the document, its text, its filename, or the report, unless you press “Keep in account” on the report (see below). Its text is kept only if you also tick “Keep the document’s full text too”.
What leaves our service, and what does not
Checking a citation means asking somebody who publishes the law. What we send is the citation, not the document.
| Sent | To whom | Why |
|---|---|---|
| Statute, regulation and rule numbers | eCFR, govinfo, Congress.gov, the House’s Office of the Law Revision Counsel, and two state legislatures | Whether the provision exists and is still in force |
| Executive order numbers | the Federal Register | Whether the order exists, and its title and date |
| DOIs | Crossref, DataCite and the DOI resolver | Whether the work exists |
| Reporter, volume and page of a cited case: when you open its printed page, when a quotation attributed to it is checked, and when you download a matter's cases | Harvard's Caselaw Access Project (static.case.law) | To show the scanned page, with the quoted words marked; to read the case's text so the quoted words can be looked for in it; and to hand you the case itself. The quotation is not sent, and nothing fetched for a download is kept. |
| URLs written in your document | the sites themselves, and the Internet Archive | Whether the link still reaches what was cited. The target site receives its full URL; the archive receives the URL without userinfo, query or fragment. |
Whether a cited case exists is answered from our own copy of American case law, built from public-domain court data, and reaches nobody at all. Checking a quotation asks Harvard's archive for the case by reporter, volume and page, as in the table above, and so does downloading a matter's cases.
The check does not generate anything. Each citation is looked up and compared with its source. A scanned PDF is read by a character-recognition model that runs on our own server. We send neither your document nor anything from it to an outside AI service, and nothing you send is used to train any model.
What we keep
| What | Why | For how long |
|---|---|---|
| A count of documents checked, per day | To apply the free tier's daily limit, and to apply the limit a paid licence was sold with | 48 hours |
| A keyed one-way digest of each IP address a licence has been used from, per day | A licence is sold with a number of seats. Counting the addresses it is used from is how we notice one being shared far beyond them. | 48 hours |
| A keyed one-way digest of the anonymous identifier ChatGPT sends with a check made there without a Loupe account, per day | To give each person who checks in ChatGPT without an account their own free daily checks | 48 hours |
| A keyed one-way digest of the IP address an assistant registers itself from, per hour | Any assistant may register itself with us without an account, and this is what limits how often | 1 hour |
An IP address is personal data, so we say plainly where we use one and why. Usage and registration counters store a keyed digest rather than the address itself and expire within two days. None is joined to a document. One raw address is joined to something else: a sign-in link records the address that asked for it beside the email address it went to, described below.
Your account
An account is optional. Checking a filing on this site needs none. Connecting an assistant does, because somebody has to be able to say yes to it. You sign in with a short code or one-use link sent to your email address; there is no password.
| What | Why | For how long |
|---|---|---|
| Your email address, when the account was made and last signed in to, and your licence if you hold one | So that you can sign in, and so that your plan goes with you | Until you delete the account on your account page, or ask us to |
| Each sign-in code and link we send, held only as one-way hashes, with the email address they went to, failed code-attempt count and the network that asked (an IPv4 address, or the first half of an IPv6 one); and a count of the letters sent to each address that day, under a keyed hash of it | So that each proof works once, a guessed code stops after five tries, and nobody can use us to flood an inbox | About a day; the day’s count, two days |
| Your signed-in session, held only as a one-way hash, with what the browser is in a few words (such as “Chrome on Windows”) and roughly where it signed in: the city and country the connection came from. Never the browser’s own long description of itself, and never the address | To keep you signed in, and so that you can see every browser signed in to your account and sign any of them out | 30 days, or until you sign out |
| Each passkey you add: its public key, the kind of device it was added on, and when it was added and last used. Its private half never leaves your device, so we hold nothing that could sign in as you | So that a passkey can sign you in without an emailed code | Until you remove it on your account page, or delete the account |
| Which assistants you have allowed, and their access tokens, held only as one-way hashes | So that an assistant can check citations as you, and so that you can see it and take it back | About 30 days after it was last used, or until you remove it on your account page. A removed one's tokens are deleted a week later. |
| Metadata an assistant supplies when it registers: its claimed name, software identifier and redirect addresses | To complete the authorization flow and show where it will return you | 30 days unless it remains connected to an account |
| If you join the waitlist or request a demo: email, request, role, note, seats and source page | To answer the request you made | 12 months, or sooner if you ask us to delete it or delete your account |
| A check you chose to keep: its record (the result, the passage around each citation, your own checks and the seal on them), the document's name and the matter you filed it under; and the document's full text, only if you ticked “Keep the document’s full text too” | So that you can come back to a check by matter, read the document with its citations marked, and show the check was done | Until you delete it on your account page, and then for 30 days in Recently deleted, where whoever deleted it can bring it back; or until you delete the account |
| Your matters: each matter’s name, the reference you gave it (a court, a docket number, a client), its colour, who opened it, when, and whether you put it away | To keep your checks in folders | Until you close the matter on your account page, and then for 30 days in Recently deleted; or until you delete the account |
| Your name, title and bar admission, if you give them | So that colleagues see who did what, and a certificate can be signed with them | Until you change them, or delete the account |
| Your photo, if you upload one: cut square and made small in your browser before it is sent | So that colleagues recognise you beside what you did. Only you and the people in your firm are shown it. | Until you remove it on your account page, or delete the account |
Working in a firm
On the Firm plan, the account that holds the plan can set up a firm and invite colleagues by email. What the firm keeps is the firm’s: everyone in it sees its matters and the checks kept in them, except a matter walled off to named people, which only those people see, down to its name. A colleague who leaves takes none of it.
| What | Why | For how long |
|---|---|---|
| The firm’s name; who is in it, in which role, and since when | So that colleagues work on the firm’s matters on its plan, within the seats it was sold with | While they are in the firm; the firm is closed with us, by writing |
| An invitation: the address it went to, its role, who sent it, and the link held only as a one-way hash | So that only that address can join by it, once | Until it is used or taken back, or for 14 days |
| Working together on a kept check: which citations each person marked checked, the notes they wrote, what they asked of whom, and a matter’s history of these | So that a firm can see, and show, who checked each citation | Until the check or its matter is deleted, and for 30 days after, in Recently deleted with it. When a person deletes their account, their notes and open asks go with it; the marks of what they checked stay in the firm’s record, no longer naming anyone. |
Two things are emailed to colleagues, through the same Cloudflare mail service as a sign-in message: an invitation (the firm’s name and who sent it), and an ask to check (the citation, the document’s name, the matter, and the line the asker wrote). Nothing else about a document is emailed.
A one-way hash is a fingerprint: enough to recognise a link or a token when it is presented, and not enough to use one. A copy of our records would not let anybody sign in as you or act as an assistant you allowed. The one credential kept whole is a licence, because the service has to read it; the account page deliberately does not reveal that reusable credential to a 30-day browser session. All of it is held by Cloudflare, which runs this service, in the United States, and the sign-in message is sent through Cloudflare's mail service. No one else receives it.
We never see your card. When paid tiers open, the merchant of record named at checkout will be the seller for the transaction and will hold the billing details; we will receive the fact that a payment succeeded and for which plan.
Copies kept to undo a mistake
Accounts, and everything kept under them, are held in one database at Cloudflare. Cloudflare can put it back as it was at any minute of the last 30 days, so that a mistake of ours can be undone. Each night an encrypted copy of it is also made and kept at Amazon Web Services in Oregon, USA, for at most 35 days; it opens only with a key the founder holds. Something deleted from the database stays in these copies until they expire.
Counting visits
We count visits in two ways. Cloudflare Web Analytics runs on the public pages, except
the page where you check a filing. It sets no cookie and does not identify you; it gives us
totals, such as page views and the countries they came from. Google Analytics runs only on the front page and the page for
students, and only if you allow it. It never runs on the page where you check a filing:
that page does not allow it to load. It sets cookies whose names begin with _ga, and sends Google the
pages you open, your approximate location, your device and your browser, under Google's
terms; its advertising features are switched off, and Google keeps this for two months.
What you paste or upload is never sent to either.
If you allow analytics, this tab also remembers fixed milestones: a completed check, sign-in, a new matter and a saved check. It stores only the milestone names and a broad landing-page group, such as guides or integrations. On the next front-page or student-page visit in that tab, those milestones can be sent to Google. No account identifier, document text, matter name, citation, search term or link parameter is included. The milestone queue is cleared when consent is absent, expired or withdrawn; closing the tab ends its session storage.
You can change your answer at any time with "Cookie settings" at the foot of the front page, and saying no removes Google's cookies. Neither counter runs on the page where you check a filing, on your account page or on the sign-in pages.
A record you publish
Only if you choose to, you can publish the record of a check you keep in your account, so that a court can check it by a code or a QR code on your certificate. Its page is open to anyone who has the code, and search engines are asked not to index it. It shows your name and, for a firm, the firm’s; when the check was made and what Loupe found, taken from the record Loupe signed when it made the check; that record’s fingerprint; and how many citations people marked as read. Only if you tick them when you publish, it also shows the document’s name, each authority with what the check found, and that you read citations, with how many colleagues did. Colleagues are counted and never named. It never shows the document’s text, the passages around its citations, its matter, notes or anyone’s address.
What the page shows is fixed when you publish it, and your name is looked up each time it is shown, so if you close your account you are no longer named. You can withdraw it at any time: what it showed is then deleted, and the code answers only that the record was withdrawn. Deleting the check withdraws it too, and closing your account deletes its codes entirely.
If you check by e-mail
Only if you make one, your account has a checking address of its own. A message sent to it from the address your account is under is checked like a document from the page: the attached filing, or the message’s own text, is checked in memory and not kept, and the report comes back as a reply in the same thread with the record of the check attached. The message itself passes through Cloudflare’s mail service, which runs the address, and is not kept either. A message from any other address is refused, and nothing in it is checked. The reply is sent from the checking address to the address that wrote. You can change the address or turn it off on your account page; the old one then stops answering at once.
What your browser keeps
A few choices are remembered in your own browser, so you need not make them again: light or dark, how a report is shown, your answer about counting visits, and, when you draft a certificate, the court you last started from, the AI tool you named, and any words of your own you wrote for it. They stay in that browser and are never sent to us; clearing the site’s data in your browser removes them.
If you check in Word
The Loupe add-in for Microsoft Word sends the text of the document, or of your selection, to loupe.legal when you press Check, and that text is treated exactly like a document: checked in memory, answered, and not kept. The add-in changes nothing in the document; it selects a citation when you click a finding. Removing it from Word removes it entirely.
If you check through an assistant
Claude, ChatGPT or another assistant you have allowed sends us the text it wants checked, and that text is treated exactly like a document: checked in memory, answered, and not kept. What you write to the assistant, and what it does with our answer, is held by the company that runs it, under its terms rather than ours.
In ChatGPT you can also check without a Loupe account. ChatGPT then sends, with each check, an anonymous identifier it provides for limiting how often a service is asked, and we keep it only as the keyed digest in the table above, to count your free checks, for two days. A quotation compared with the opinion, and a signed record, are made for an account, so ChatGPT asks you to sign in for those.
When you ask an assistant for a signed record, we keep that record in your account, as if you had pressed “Keep in account”, and give the assistant its address rather than the record. The record holds what the check found and the words around each citation; your text in full is not kept. You can delete it on your account page like any kept check.
What we will not do
- Sell what we hold, or share it beyond the services named on this page. There is no advertising here and nothing to advertise with.
- Train anything on your filings.
- Use your documents for anything beyond the check you requested. No copy is kept, except a check you keep in your account, with the document's text if you ticked the box for it, which is used for nothing but showing it back to you.
Your rights
Ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted, at privacy@loupe.legal. Because the answer is usually "an email address", these requests are quick. Most of it you can do yourself. Your account page downloads a copy of what we hold under your account, including your profile and the notes you wrote (each matter downloads its own records and documents), signs you out of every browser, takes back any assistant you allowed, and deletes the account with everything held under it. An account holding a paid licence is closed with us instead, because it has billing records to settle. If you are in the EU or the UK you have these rights under the GDPR. Our legal basis for the counters above is our legitimate interest in enforcing the terms a licence was sold on; for your account, it is providing the service you signed in to use; for Cloudflare's count of visits, our legitimate interest in knowing how the site is used; and for Google Analytics, your consent, which you can withdraw as easily as you gave it.