Privacy

The short version

• Full access to search and documents is tied to an account, so we hold your email address. Your email address and the searches you run while signed in are personal information. A short guest preview is available without an account.
• We keep your search and viewing history against your account so you can see it on your History page. It is deleted after 24 months, or immediately if you delete your account.
• We use activity across many users, in aggregate, to see which legal topics people are looking for and to improve the service. We do not build advertising or marketing profiles of individual users from their search trails.
• A small number of authorised staff can view an individual account's search and viewing history to provide support, investigate abuse or security issues, and improve the service. We never sell it, share it with third parties, or use it for advertising.
• We do not sell personal information.

What we collect

Account details. Your email address, and if you provide them, your name and a password (stored only as a one-way hash). If you sign in with Google or GitHub, we receive your email address, name and profile image from that provider. We also record when your account was created, which plan it is on, and the first campaign or referring site that brought you to Legal Lookup if that information is available (UTM tags, a ref link, or the referring website).

Search and research activity while signed in. The text of your searches (shortened to 200 characters) and the filters you use, the laws, judges, courts and courthouses you view, and any bookmarks, notes, highlights, votes and study-brief requests you make. These are linked to your account. We also measure, in aggregate, whether a search led to a result click, roughly how long a document stayed visible in your browser, and whether you selected or copied legal text on that page. We store only those yes/no and duration signals — not the text you selected or copied.

Activity as a guest. You can search and read up to 10 documents without an account after passing a Cloudflare Turnstile check. We then set a guest pass cookie containing a random id and scrambled fingerprints of the documents you have opened (kept for 30 days). Your searches and the documents you view are recorded against that random id, not against a person. If you later sign up, we note that you had a guest pass, but we do not link your guest activity to your account.

Optional information.If you answer our "what best describes you?" question, or register for API access (name, organisation, intended use), we store your answers.

Payments. Legal Lookup is currently free and we do not collect payment details. If we ever introduce paid plans, we will update this policy before collecting any.

Technical information. Your IP address and browser type, used for security, rate limiting, and telling people apart from automated crawlers. Server and security logs may also be kept by our hosting providers.

Cookies, local storage and analytics

We use a session cookie to keep you signed in, a guest pass cookie that counts free document views (kept for 30 days), a first-touch cookie that remembers the campaign or referring site that brought you here (kept for 90 days, and stored on your account if you sign up), and your browser's local storage to remember your theme and whether you have answered our survey.

We run a self-hosted Umami analytics service that records page views and events such as signups, including the channel or referring site in aggregate (for example Google, a newsletter campaign, or a shared link). For a sample of visits it also records where on a page people click and how far they scroll, so we can find usability problems. We do not record sessions or what you type. We use no advertising cookies and share none of this with advertisers.

Why we use it

• To create and secure your account, and to send sign-in links and service emails.
• To provide search, your History page, bookmarks and notes.
• To respond to support requests and protect the service from abuse and scraping.
• To understand demand and improve search quality, using aggregated and de-identified information (see below).

Aggregate analysis of search activity

Search activity can reveal what people are worried about legally. We treat it accordingly. We analyse search terms, topics and trends across many users, for example which areas of law are being searched more this month. We may look at these trends by state or by broad type of organisation (government, education, or other) but only as combined counts across many accounts, never for a single account or person.

We also look at aggregated engagement: how often signed-in searches lead to a click, how long documents stay visible, and how often people select or copy legal text. Those figures are shown only as totals and rates. We do not store the contents of selections or clipboard copies for this measurement.

We do not use an individual's search history for advertising or marketing profiles, do not give individual search trails to third parties, and do not publish results small enough to identify anyone. Our search-trend tools show searches only as aggregate counts, for terms searched by at least five different signed-in users, and our general activity log is not linked to names or email addresses. We may publish or supply aggregated findings, such as an index of trending legal topics.

Separately, a small number of authorised staff can open an individual account in our admin tools and see that account's search and viewing history (searches, pages and documents viewed, result clicks, reading-time signals, bookmarks and notes activity). We do this only to provide support you ask for, to investigate abuse, scraping or security issues, and to understand how the service is used so we can improve it. Access is password-protected and limited to people who run Legal Lookup.

Please do not put names, case details or other sensitive personal information into search boxes or notes. Anything you enter is stored as described above.

Who we share information with

We share information only with providers that help us run the service, and only what they need: Elastic Email (sign-in links and service emails), Google and GitHub (if you choose to sign in with them), Cloudflare Turnstile (the bot check for guest access, which sees your IP address and browser signals), and our hosting and infrastructure providers. Our AI study briefs are generated from the text of public legal documents; we do not send your account details or searches to the AI provider.

Some of these providers store or process data outside Australia, including in the United States. We take reasonable steps to make sure they handle personal information consistently with the Australian Privacy Principles. We may also disclose information where the law requires it.

How long we keep it

We keep account information while your account is open. Search and viewing history is deleted automatically after 24 months. If you delete your account, we permanently delete your account, history, bookmarks, notes, votes, API keys and sign-in records.

Security

Passwords are hashed, access to production data is restricted, and connections use HTTPS. No system is perfectly secure. If a breach is likely to cause serious harm we will notify affected people and the Office of the Australian Information Commissioner as the law requires.

Your choices and rights

You can delete your account and all its history yourself from your Account page. You can also ask to access or correct the personal information we hold about you, or opt out of non-essential emails, by contacting hello@legallookup.com.au. We will respond within a reasonable time, usually 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If we change how we use personal information, we will update this page and its "last updated" date, and tell account holders by email where the change is significant.