What we collect
- Account information — your name, email address, and a hashed password (we never store your plaintext password).
- Pasted motion text — the document text you submit to the Citation Verifier, stored on your account so you can revisit and manage it.
- Verification results — the list of citations the verifier extracted and CourtListener's response for each (case name, citation, hallucinated / verified status).
- Standard request metadata — IP address, browser user-agent, and timestamps, used only for rate-limiting and security.
Why we collect it
To provide the citation verifier and to let you revisit your past runs. That's the only purpose. We do not sell your data, share it with advertisers, or use it to train any model. We do not have an advertising network.
What we share, and what we don't
- CourtListener (Free Law Project) receives the parsed citation triples — volume, reporter, and page number — for each citation we look up on your behalf. The full text of your motion is never sent to CourtListener. Only the structured citation data goes off-platform.
- Future scoring engines (rubric scoring, technique register) are not yet wired up. When they are, prompts derived from the open rubric and your text may be sent to an external model provider. We will update this page before those features ship; you will see an explicit opt-in for any feature that transmits more than parsed citation triples.
- Operational infrastructure — our hosting provider (Hetzner) and our delivery provider for password-reset emails (Resend). These vendors handle data on our behalf and do not use it for their own purposes.
- Law enforcement — only when we receive a valid legal demand. We do not voluntarily share user data with government agencies.
Retention
We keep your data until you delete it. There is no automatic retention period; if you stop using DraftGrade and never delete your account, your data persists until you act. We may purge obviously-spam accounts (no logins for 24+ months and zero verifications) at our discretion.
Deleted runs go to Trash for a 30-day grace period before they are permanently destroyed. During that window you can restore them from the Trash page. Once the 30 days lapse, a scheduled job hard-deletes the row and the run cannot be recovered. Whole-account deletion is immediate and bypasses the Trash entirely.
Your rights
If you are in the European Union, the United Kingdom, California, or another jurisdiction that grants the rights below, you have them regardless of where DraftGrade is hosted. If you are in any other jurisdiction, we honor these rights anyway.
- Right to access — you can request a copy of your account data and your stored verification runs. Email hello@josephfus.co with the subject line "Data access request"; we'll respond within 30 days with a JSON export.
- Right to deletion — you can delete any individual verification run from its detail page, and you can delete your whole account (which removes all your runs) from your Profile page after logging in. No "talk to support" loop.
- Right to portability — full data export to a machine-readable format is on the roadmap; until it ships, email hello@josephfus.co with the subject "Data export request" and we will produce a JSON export manually.
- Right to object / restrict processing — if you want us to stop processing your data without deleting it (for example, to preserve evidence in pending litigation), email hello@josephfus.co.
- Right to correct — you can edit your name and email from your Profile page. To correct other data, email us.
How to delete your data
- Sign in at app.draftgrade.com.
- To delete a single verification run: open the run from Runs, click Delete run. The run moves to Trash. From there, you can Restore it within 30 days, or click Delete forever for immediate permanent removal.
- To delete your whole account and every run: open Profile, scroll to "Delete account," confirm. This is permanent and cannot be undone (no Trash step).
- If you can't sign in and need help deleting an account, email hello@josephfus.co from the email address on the account.
Children
DraftGrade is not directed to children under 13 and we do not knowingly collect data from children under 13. If you believe a child has created an account, email us and we will delete it.
Changes to this policy
If we change this policy in a way that materially affects how we handle your data, we will surface the change on the site and (if you have an account) by email before the change takes effect. The Last updated date at the top of this page always reflects the current version.
Contact
Questions about this policy, requests to exercise your rights, or anything else: hello@josephfus.co. We respond within 30 days, usually within 48 hours.