Privacy Policy

Gavel is offered to law students in the United States. This policy covers gavelstudy.com and the app behind it.

What we collect

• Account data: your email address and a bcrypt hash of your password (never the password itself), plus an optional name and profile image. If you sign in with Google, we receive your email, name, and picture from Google, not your Google password.
• Profile details you enter: your law school (or the school name you type if yours is not listed), year of study, and, if you choose to set them, an exam date and a jurisdiction.
• Your time zone, which your browser reports on your first visit rather than being asked for. Day-based figures like streaks need it, otherwise your evening lands in the server's next day.
• Study activity: practice answers, written submissions, grading results, study plans, flashcard review history, case documents, briefs, outlines, cold-call sessions, and pasted class notes. The product is built on this data existing for you.
• Payments: handled by Stripe. Card numbers never touch Gavel's servers. We store Stripe's customer, subscription, and purchase references, your subscription status, and when the current period ends.
• Email leads: if you give us your address for updates, we store it and where you entered it.
• Institutional enquiries: if you submit the schools form, we store the institution, your name, email, role, an approximate student count, and your message.
• Measurement: we count the steps of signing up, so we can tell whether the site explains the product well enough. Each record is one step name (for example "confirmed their email"), your account id, and the time. If you reached the signup form through one of our own campaign links, the signup record also keeps which link it was: a single word such as "tiktok" and a short campaign tag, both read from the web address you arrived on. That describes the link, not you, and nothing is stored on your device to follow you between visits, so if you browse the site before signing up it is not recorded at all. Nothing about what you studied, and nothing that describes your device.
• Technical and security records: rate-limiting records that include the IP address a request came from, so that signup, login, and password-reset endpoints can be protected from abuse; server error logs, which can incidentally include account identifiers; and usage records for each AI call (feature, model, token counts, and estimated cost). Those usage records do not store the text of your request.

What we don't do

• No advertising trackers, no cross-site tracking, no analytics cookies. We count page views through Vercel Web Analytics, which is cookieless and stores no identifier for you. Nothing on Gavel follows you around the internet, which is why there is no consent banner to click past.
• We never sell your data or share it with data brokers.
• We never use your notes, briefs, or written answers to train AI models, and we never merge them into the shared question bank.

When your work is visible to someone else

By default, everything you write is private to your account. Two things you control can change that:

• Share links. If you create a share link for a note set, anyone holding that link can view it, along with the outline or study guide if you chose to include them. We record how many times the link has been viewed and when it was last opened. You can revoke a link at any time, or give it an expiry when you create it.
• Classes. If you join a class, the educator running it can see, by name, that you completed an assignment they set. They cannot see your notes, briefs, written answers, or grades.

Who processes your data

We use a small number of service providers, each for one job. They act on our instructions and are not permitted to use your data for their own purposes.

• Vercel hosts the application and serves it. Request logs pass through it, and its cookieless Web Analytics counts page views.
• Neon hosts the database where your account and study data are stored.
• Anthropic processes the text you send to an AI feature, to produce the result you asked for.
• Stripe processes payments and holds your card details.
• Resend delivers transactional email such as confirmation and password-reset links.
• Google handles sign-in, but only if you choose to use it.

AI processing

When you request an AI feature (generating questions from your notes, drafting a brief, grading a written answer, running a cold-call session), the relevant text is sent to Anthropic to produce the result you asked for, and the result is stored in your account. We record the token counts and estimated cost of each call, not its content. Your content is not used to train models.

Cookies

Gavel uses only the session cookie required to keep you signed in. There is nothing else to consent to.

Retention and deletion

Your data is retained while your account is active. To delete your account and its data, email contact@gavelstudy.com. We remove personal data within 30 days, except records we are required to keep for payment, tax, or other legal compliance. Security and rate-limiting records are short-lived by design and age out on their own.

Your choices

You can view and change your profile details in your account settings, cancel a subscription from the billing portal, revoke any share link you created, and leave a class. You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it, at the address above. We will not treat you differently for asking. Residents of states with consumer-privacy laws, including California, have these rights by statute, and we extend the same handling to everyone.

Children

Gavel is for law students and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, write to us and we will remove it.

Security

Passwords are stored as bcrypt hashes. Access to gated content and admin tools is enforced on the server, not in the browser. Payments are processed by Stripe and card details never reach us. No system is perfectly secure; report suspected issues to contact@gavelstudy.com and we will act quickly.

Related policies

This policy covers what we collect and what we do with it. Three other documents cover the rest, and all four are part of the Terms of Service:

• The Community Guidelines set out what you may and may not add to Gavel.
• The Academic Honor Code covers using Gavel alongside your school's rules, and gives faculty and administrators a direct route to raise a concern.
• The Copyright and DMCA Policy sets out how to report infringing material and how repeat infringement is handled.

Changes

Material changes to this policy will be posted here with a new date.

This document was last updated August 23, 2026.