Cite11

← Cite11

Privacy

Last updated: 26 September 2026

Your filing

Your filing is not retained by Cite11. A document you upload or paste is held in memory while it is checked. It is not written to disk, and Cite11 does not log its text, its quotations or its file name. The report is not stored either: it exists only on the page returned to you, so copy or print it before you leave. Only the records listed under “What is kept” below remain.

What is sent to CourtListener

Cite11 checks citations against the public record kept by CourtListener, a Free Law Project service.

  • Only the citations found in your document are sent to CourtListener’s citation-lookup service, and only the citations Cite11’s own copy of the record does not already answer: the volume, reporter and page, such as “174 F.3d 366”. The text of your document, its sentences and its quotations are never sent. A single citation you paste into the lookup, at no charge, is treated the same way. If Cite11’s own copy of the record is unavailable, checks are unavailable; your text is not sent instead.
  • For a citation that needs a search, the case name, the citation or docket number, the court and the year are sent as search terms; opinion text is fetched from CourtListener so that quotations can be compared with it here.

What CourtListener keeps is governed by its own policies.

What is kept

  • Usage records, deleted after 90 days. One record for each lookup and each report: the time; the IP address (for a report, unless it was run through an invited guest link); for a report, its report id; the invited guest link’s token, if one was used; and, for a single-citation lookup, the citation you pasted together with the result category and whether its name, address and court/year matched, and, if you gave an email to keep checking past the no-cost daily allowance, that email address. Never the opinion text. The IP address enforces the first 2 no-cost lookups each day and is also used for abuse prevention; it is visible only to the operator. If you give an email to keep checking, it — not your IP address — enforces the remaining daily allowance, up to 5 total. Before a record is deleted it is counted by type and day into a file of anonymous daily totals, which holds no IP address, email or citation and is kept.
  • For a full-document check signed in by email: the time, the email, whether the check was within the 3-a-day no-cost allowance or spent a purchased credit, and the report id if one was issued. The document’s own text is never kept, same as any other check. A sign-in link is single-use and expires quickly; it is not logged anywhere it could be replayed.
  • For a full-document check with no email yet: a one-way hash of your IP address, derived using a server-only secret that cannot be reversed back to the address, and the time. This limits a visitor with no email on file to two full checks in a rolling 30 days before asking for one; the address itself is never stored for this purpose.
  • Purchase records: Stripe, not Cite11, holds your payment details. Cite11 keeps only the email, the credits purchased, their expiry, and Stripe’s own transaction id — never a card number.
  • Email addresses you give, with the record of what you opted into (newsletter, launch notice, signing in to check a document, or continuing to check single citations past the no-cost daily allowance) and when, until you ask for them to be deleted. That record holds no IP address.
  • Messages you send us through “Report a problem” or “Flag this result”: your text, your email if you add one, and for a flagged row the citation, the answer shown, the report id and the name of your guest link. No expiry date.
  • Result caches, so that the same lookup is not repeated. One is keyed by the citation as written (for a Westlaw or Lexis citation or a docket number, by the court, number, date and case name as your document wrote them) and holds the public-record result; an entry is deleted when it expires, after 7 or 30 days. The other holds quotation-check results, keyed by a one-way hash of the case and the quotation; the quotation itself is not stored. It has no expiry date.
  • A log of requests to CourtListener: time, request type, status and report id, never a citation, a name or any text. Entries older than 7 days are deleted, checked hourly.
  • A record of visits to the home, pricing, sample report and benchmark pages, kept 35 days: the page, the approximate city and state derived from the visitor’s IP address, whether the visit looks automated (a known crawler or a cloud-hosting address), and a one-way, daily-rotating code derived from the IP address together with a server-only secret, used only to avoid double-counting the same visitor on the same day. The IP address itself is never stored.
  • Daily request counts, for capacity limits and the daily allowances.
  • Daily check-attempt counts, so the site can cap how many full-document checks run in one day during a traffic surge: just a date and a number, no IP address, email or citation.

Server logs

Cite11’s application logs are kept by its host, Railway. Each request made to CourtListener is logged by its type (for example “docket search”), status and duration, with an internal reference that ties it to a report id — not the search values, the text of your document, its quotations or its file name. Logs written before 26 September 2026 recorded the full web address of each request, which can contain the case-name words, citations or docket numbers searched, the court, and opinion ids. Railway also keeps HTTP request logs (time, page requested, status) and can see the IP addresses of connections. How long Railway keeps logs is set by Railway, not by Cite11.

No AI

No AI service is used. No part of your document or of a report is sent to an AI provider, and no AI is used to produce a report: every result and the Summary come from fixed rules and record matching.

Cookies

A single-citation lookup needs no account and no password. The first 2 lookups each day, at no charge, set no cookie: that allowance is counted server-side, by IP address. If you give an email to keep checking past that, Cite11 sets one cookie remembering it, for up to a year, so the remaining daily allowance (up to 5 total) follows that email instead of your IP address. A full-document check needs sign-in by email; the sign-in cookie this sets expires after a short session and only ever identifies that email, never a payment method. The other first-party cookie Cite11 sets is, for invited guests only, the invite’s own token, for its lifetime. Google Analytics, which runs on Cite11’s public pages; it does not run on the report or on administrative pages. It sets its own cookies for aggregate statistics.

Third parties

  • CourtListener (Free Law Project) performs the public-record check, as described above.
  • Beehiiv processes newsletter subscriptions made through the subscribe form.
  • Resend delivers the one-time sign-in link email for a full-document check; it is sign-in only, never marketing, and never a newsletter opt-in.
  • Stripe processes payment for purchased credits and holds your payment details; Cite11 never sees or stores a card number.
  • Google Analytics collects aggregate usage statistics for the site.
  • Railway hosts the service and keeps its logs.

What is not done

Personal information is not sold. Email addresses are not shared with anyone for marketing. Guest-link activity is never joined to any email address.

Removal

To have your email address, your messages or the usage records tied to you deleted before their time, write to contact from the address in question, giving the report id if you have it. Records kept by CourtListener or Railway are theirs to delete.