LawGraveyardPrivacy Policy
Last updated 30 July 2026
LawGraveyard is an error log for the LSAT, run by an individual in Newfoundland and Labrador, Canada. This policy explains what the site collects, why, where it goes, and how to get it back or have it deleted. It is written to be read rather than to be impressive.
What the site collects
If you use LawGraveyard as a guest, your log is stored in your own browser and never reaches the server. Nothing in this section applies to you until you create an account.
If you create an account, the site stores:
- Your email address, used to sign you in, confirm your account, and reset your password.
- Your username, which is public. It appears on every comment you post and in friend search.
- Your password, stored only as a cryptographic hash by our authentication provider. It is never visible to the site operator.
- Your error log: the PrepTest, section and question number, the answer you chose, the correct answer, question type, difficulty, and any passage text, question stem or notes you enter.
- Your practice test results: scores, dates, and any note you attach.
- Your comments, which are public and visible to any signed-in user.
- Your short description of a question (the "What was it about?" field), which is public. It is shown on the discussion card for that question so people can tell which question is being discussed. The question type and difficulty you record are shown there too, combined with everyone else's rather than attributed to you.
- Reports you file: what you reported, the reason, any note you add, and a short copy of the reported text. Only the site owner can read reports. The person you report is never told who reported them.
- Your answer choices, which are counted anonymously to produce the "what everyone picked" percentages. Other users see the totals. They cannot see which answer belongs to you.
- Your friendships: who you sent requests to and accepted.
- A last-active timestamp, used only to show how many people are studying at that moment.
- Which PrepTests you have logged, counted anonymously to rank the most-studied tests.
What the site does not do
There is no advertising, no tracking pixels, and no advertising trackers on this site. Your data is not sold, rented, or shared for marketing. There is no paid tier, so nothing here is monetised at all.
Counting page views
The site counts page views using Vercel Web Analytics. It exists for one reason: to show whether the site is reaching anybody, and which page people give up on. It is read as totals, not as a record of what any one person did.
It sets no cookies, it does not follow you to other websites, and it does not build a profile of you. What it records is the page address, the site that referred you, and coarse details such as country, browser and device type. Vercel explains the mechanism in its Web Analytics privacy documentation.
Nothing from your error log reaches it. Your logged questions, your notes, your practice test scores and your comments are never sent to it. It sees which pages were opened, and nothing that is inside them.
Who can see your log
Your error log is private to you, with one exception: if you accept a friend request, that person can read your logged errors through the Friends' logs feature. Removing the friendship ends that access. Comments are public by design. Your username and avatar are public.
Because friends can read your log, avoid putting anything in the notes field that you would not want that person to read.
Storage, and where it is
Your error log stays in Canada. The database is hosted by Supabase in the Canada Central region, physically in Montreal. Everything described in the section above, including your log, your practice tests, your comments and your account record, is stored there.
Two things do leave the country, and you should know about both:
- Account emails. Confirmation and password reset messages are sent through Resend, which delivers from infrastructure in the United States. Your email address passes through that system when one of those messages is sent.
- Site hosting. The website files are served by Vercel, a United States company, from a global network of servers. Your IP address reaches whichever server is nearest to you.
Information handled outside Canada may be subject to the laws of those countries, including lawful access requests by their authorities. By using the site you consent to that. Your log itself is not part of it.
The code libraries the site depends on are served from this domain rather than from a public content delivery network. Loading a page does not hand your IP address to any third party beyond the host named above.
Cookies and browser storage
No cookies are used for advertising, and the page view counting described above sets no cookies either. The site stores two kinds of data in your browser: an authentication token so you stay signed in, and your own error log and settings so the app works offline and loads quickly. Both are necessary for the site to function. Clearing your browser storage signs you out and removes any guest log that was never synced to an account.
Your rights
Under Canadian privacy law you can ask to see the personal information held about you, ask for corrections, withdraw consent, and ask for your data to be deleted. If you are in the United Kingdom or European Economic Area, the UK GDPR and GDPR give you equivalent rights including data portability.
- Export. The app has a backup option in the sidebar that downloads your entire log as a file, at any time, without asking anyone.
- Correction. You can edit or delete any log entry, practice test, or comment yourself. Removing a comment replaces its text with a note that it was removed and keeps the row, so that replies written underneath it are still readable. Usernames are permanent once chosen, because comment history depends on them.
- Deletion. Open the profile menu and choose Delete account. It removes your account and everything held on the server immediately: your synced log, practice tests, comments, question descriptions, friendships and answer records. You can also email the address below and it will be done for you.
You can also complain to the Office of the Privacy Commissioner of Canada if you think your information has been mishandled.
How long things are kept
Your data is kept while your account exists. When an account is deleted, the log, practice tests, comments, question descriptions, friendships and answer records are deleted with it. Reports you filed are deleted with your account too. Anonymous aggregate counts, such as how many people picked answer C on a given question, do not identify you and may remain.
One thing outlives a deleted account: if a report about your content was acted on, the record of that report is kept, including the short copy of the text that was removed. The terms of service promise that repeat infringement leads to account termination, and that promise cannot be kept if the record disappears the moment an account does. That record is readable only by the site owner.
Deleting your account does not touch the copy held in your own browser. That log stays on your device as a guest log, visible to nobody but you, and you can carry on using the site with it or export it whenever you like. Clearing your browser storage is what removes it.
The only emails sent are the ones you trigger: confirming your address, and resetting your password. There is no newsletter and no marketing email. If that ever changes, it will be opt-in, in line with Canada's anti-spam legislation, with a working unsubscribe link.
Children
LawGraveyard is not intended for anyone under 16. If you believe a child has created an account, email the address below and it will be removed.
Security
Access to the database is controlled by row level security, meaning the rules about who can read what are enforced by the database itself rather than by the website code. Passwords are hashed by the authentication provider and are never visible. No system is perfectly secure, and this one is run by one person, so please use a password you do not reuse anywhere else.
Changes
If this policy changes in a way that materially affects you, the date at the top will change and the change will be announced in the app. Continuing to use the site after that means you accept the new version.
Contact
Questions, access requests, and deletion requests all go to lawgraveyard@gmail.com.