OpenAgreements
HomePrivacy

Privacy

Last updated: September 30, 2026.

What this site does

OpenAgreements is a free, public legal reference library. We publish jurisdiction-specific practice guides. Browsing public explainers, evidence, templates, and machine-readable artifacts does not require an account. Optional accounts support private or premium product surfaces. We do not process payments or sell or share personal information for cross-context behavioral advertising.

Optional accounts

If you choose to sign in, Auth0 processes your account identity and essential session cookies for authentication and account security. We store limited security metadata, including entitlement status, grant, expiry, and revocation timestamps, and pseudonymous security-event records. Essential authentication cookies are not controlled by the analytics consent choice because they are necessary to provide a requested sign-in session.

Authentication does not change our document-retention boundary: we do not retain uploaded client documents, filenames, prompts, legal analysis, or generated legal work merely because you are signed in. Security logs do not contain those materials, access tokens, or email addresses.

Founder Legal Desk interest

If you submit the optional Founder Legal Desk interest form, we collect your name, work email, company name and optional website, incorporation and main operating countries, selected areas of interest, whether you have a live U.S. matter, timing, and an optional short description of your goal, including an optional “Other” need. We also record when you submitted the form and your permission to be contacted about that request. We use this information to assess interest and respond to you, not for marketing or automatic enrollment. Submission does not create an attorney-client relationship. Keep the goal brief; private document sharing comes later.

Steven Obiajulu, a lawyer, initially reviews these submissions. We store them in a Neon database connected to our Vercel site. Authorized site operators can administer that storage, and a matter lawyer may receive details after conflicts and engagement review. We do not send form contents to Google Analytics.

To limit repeated submissions, we derive a keyed daily identifier from the network address supplied by Vercel. We do not store the address itself in the inquiry database; the identifier and quota counter are deleted within four days.

After submission, you can optionally book an intro call through HubSpot. The booking link does not include your form answers. HubSpot processes information you choose to enter on its scheduling page under its own privacy notice.

Optional chat

On the Founder Legal Desk page, “Chat with Steven” loads Crisp only when you choose to open chat. Crisp processes messages and contact details you enter in the chat, along with technical information such as your IP address and chat-session cookies. We do not copy your interest-form answers into Crisp. Its chat content is excluded from PostHog replay; when analytics is enabled, events record only chat opening and message sending, without message text or contact details. Chat does not create an attorney-client relationship. Once opened, Crisp may remain connected while you browse until you reload or close the page.

Chat records are separate from interest submissions; the inquiry database’s 90-day deletion rule does not automatically delete Crisp conversations. Contact us to request deletion. See Crisp’s cookie policy for its chat-session practices.

Consent and cookies

We use Google Consent Mode v2 with a default-deny baseline while your saved choice or region is resolved. In the EU/EEA, United Kingdom, Switzerland, and unknown locations, analytics remains off until you accept. In other regions, analytics may be enabled after the region check without a banner choice, unless Global Privacy Control is signaled. Advertising cookies are not automatically enabled. Where a banner appears, "Accept" and "Reject" have equal weight. Everyone can open Cookie preferences from the footer to change their choice.

The consent banner and granular preferences UI are provided by c15t, running locally in your browser (no third-party hosted backend on our side). Your consent record is stored in your browser only.

Analytics

We use Google Analytics 4 (measurement ID G-2KFZ0NFKVF) to understand aggregate site usage — which pages get read, where visitors arrive from, and which content gets engaged with. When analytics consent is granted, GA4 sets the _ga family of cookies in your browser. When consent is denied, GA4 still receives cookieless modeling pings (no identifiers, no cookies) so we can size traffic in aggregate; this is the documented behavior of Consent Mode v2.

We have not enabled Google Signals, Google Ads linking, or Google Ad Manager features on this property.

Global library searches run in your browser. When analytics is enabled, we record the search terms you enter together with result counts, selected resource types, and result destinations so we can understand what visitors are trying to find.

Optional session replay and heatmaps

When enabled, PostHog Cloud in the United States receives page snapshots and interactions on public library and discovery pages so we can understand navigation. Heatmaps record click, rage-click, dead-click, and pointer-movement coordinates on those pages. PostHog also receives clicks on template and document download links and the GitHub star link. These are link-click signals; they do not establish that a file was saved or a GitHub star was created. Replay, heatmaps, and these events share the analytics setting in Cookie preferences; there is no separate replay checkbox. They default to off in the EU/EEA, United Kingdom, Switzerland, and unknown locations until analytics is accepted. In other regions they may be enabled after the region check. Rejecting analytics or signaling Global Privacy Control stops further PostHog collection.

Replay is limited to the homepage and public practice guides, checklists, surveys, templates, toolkits, editor profiles, methodology, manifesto, search, data and the Founder Legal Desk interest page. Account, authentication, private, editing and download-file routes are excluded, as are pages with URL queries. Moving to a section of the same page through a URL fragment does not stop collection. Page paths sent with heatmap and link-click events omit URL queries and fragments. Public page text and visitor-entered search terms may be included. Password fields and specifically designated page elements are masked; console logs and request bodies are not collected. The replay does not record your desktop or activity in Word. PostHog stores a random visitor identifier and a session identifier in your browser's local storage, so that pages you open in several tabs count as one visit. These identifiers are not linked to your account, and PostHog sets no cookie of its own. If local storage is unavailable, the identifiers last only for the open page. The visitor identifier stays in local storage until you clear this site's data; the session identifier is replaced after a period of inactivity. Your analytics preference is stored locally.

On forms where you ask us for a service, such as the Founder Legal Desk interest form, replay records what you type when analytics is enabled. That includes your name, work email, company name, website, matter description, any “Other” goal text, your other choices, and the submission reference shown after you submit. You are sending this information to us on purpose, so replay does not mask it. Password fields are still masked. PostHog receives that replay as a processor; Steven initially reviews the submitted inquiry. Funnel events record form start, completed field names, successful submission and error categories, with no field values in event properties. The 90-day inactivity deletion rule for the inquiry database does not automatically delete PostHog recordings.

PostHog also receives your IP address with each request and stores it with the recording and events. PostHog uses the IP address to estimate your approximate location: country, state or region, city, postal code, and approximate coordinates. We review location only in aggregate, for example to see whether readers of a state guide are in that state. The IP address and location follow the same PostHog storage duration described below.

Replay collection starts on a configured date and may have a configured end date. The collection period is not a promise that recordings or events are deleted when it ends: their storage duration is controlled by the PostHog project. Ending collection does not automatically delete existing data. Contact us using the details below with privacy questions.

Performance monitoring

We use Vercel Speed Insights to monitor Core Web Vitals (page load, input delay, layout shift). Per Vercel's documentation, this data is anonymous, aggregated, and does not use cookies or visitor identifiers.

What we do not do

  • We do not collect email addresses for marketing or send a newsletter; Auth0 may process an account email when you opt in to an account, and the optional interest form collects a work email so we can respond to that inquiry.
  • We do not run cross-context behavioral advertising.
  • We do not "sell" or "share" personal information as defined by CPRA.
  • We do not require accounts for public browsing and do not process payments.
  • We do not load social-network embed scripts that profile visitors.

California (CPRA) and Global Privacy Control

California residents have rights to know, delete, correct, and opt out of any "sale" or "sharing" of personal information. Because this site does not sell or share personal information, the practical effect is limited, but the rights still apply. Our consent manager honors the Global Privacy Control (GPC) browser signal where supported.

Retention

Aggregate GA4 data is retained per Google's default account-level retention (currently 2 months, the platform minimum we configure).

Account and entitlement metadata is retained while needed to operate or secure the account, including revocation history needed to enforce access. Session cookies expire according to the configured Auth0 session lifetime. You may contact us to request deletion, subject to security, legal, and operational retention requirements.

We delete Founder Legal Desk interest submissions after 90 days without activity. You can ask for earlier deletion at the address below, subject to specific legal or security retention obligations. If a matter is accepted, its separate engagement records are handled under the applicable engagement terms rather than kept in the interest form.

Contact

The site is maintained by UseJunior. For privacy questions or to exercise a data right, file an issue at the project's correction form (linked from the footer's feedback link), or email privacy@usejunior.com.

Reuse

Site-authored OpenAgreements text is intended for reuse under CC BY 4.0. Source excerpts and linked materials remain under their respective owners' rights.