Privacy Policy

Account information

When you create an ExpeCited account, we collect your email address and a password (stored as a one-way hash, never in plain text). You may optionally provide a username, display name, bio, institutional affiliation, academic role, research interests, and a profile photo.

Submission records

When you log a law review submission, we store the journal, cycle, submission date, subject area, submission type, decision status, decision date, expedite status, offer deadline, and any anonymous comment you choose to include. Your user ID is linked to the record for your personal tracker, but is never displayed in public feeds.

Social and community data

If you use community features, we store your follow relationships, chat messages, chat room memberships, message reactions, and thread subscriptions. Direct messages are visible only to their participants.

Notification and presence data

We store journal watch preferences, in-app notifications, and presence heartbeats (last-seen timestamps) to power real-time alerts and the online indicator. Email notifications are queued only as an offline fallback when you are inactive and a direct message or reply is addressed to you.

Cycle feedback

If you submit a post-cycle reflection or advice, we store that content along with the visibility setting you choose (public or private).

Technical data

Our hosting provider automatically records standard server logs (IP address, request timestamps, user agent). This data is used solely for security, abuse prevention, and operational stability.

Core platform features

Your submission records power your personal submission tracker, the anonymized Live Data feed, journal profiles, the Analytics dashboard, and the Expedite Calculator. Aggregate statistics are derived from community submissions to show journal behavior across cycles.

Communication

We use your email address to send account-verification codes, password-reset links, welcome messages, and offline-fallback notifications for direct messages and replies when you are inactive. We do not send marketing emails.

Social features

Follow relationships, chat messages, and profile activity enable community interaction. Your username and profile information appear to other users only if you have set your profile to public.

Safety and integrity

We use technical logs and flagging mechanisms to detect abuse, prevent spam, and maintain the integrity of community-submitted data. Suspicious entries can be flagged by users and reviewed by moderators.

We do not sell, rent, or trade your personal data to any third party.

We do not use your data for targeted advertising. ExpeCited is ad-free.

We do not build behavioral profiles or sell analytics derived from individual user activity.

We do not track your activity across other websites or services.

We do not use your submission data to train machine-learning models or sell it to data brokers.

Your individual submission records are never displayed publicly with your identity. Public feeds show anonymized, aggregate data only.

Public aggregate data

Anonymized, aggregated submission statistics (counts, medians, decision timelines) are displayed publicly on Live Data, journal profiles, Analytics, and the homepage feed. No user identity is attached to these public displays.

Your public profile

If you set your profile to public, your username, display name, bio, institution, and research interests are visible to other users. Your personal submission tracker remains visible only to you unless you explicitly share your profile.

Service providers

We use third-party infrastructure providers (hosting, database, email delivery) that process data on our behalf under standard data-processing agreements. These providers do not use your data for their own purposes.

Legal obligations

We may disclose data if required by law, court order, or government regulation, or to protect the rights, property, or safety of ExpeCited and its users. We will challenge requests we believe are improper.

Your account and personal submission records are retained for as long as your account is active. You may delete your account at any time from Settings, which removes your profile, personal submissions, and associated activity within 30 days.

Anonymized, aggregated public data (community feed entries, journal statistics) is retained indefinitely because it no longer contains identifiable personal information once stripped of user attribution.

Chat messages and direct messages are retained until you delete them. Presence heartbeats are automatically purged after 30 days of inactivity.

Pending email notifications are deleted once delivered or cancelled, and are never retained beyond 72 hours.

Access and export

You can view all of your personal data by visiting your profile and submission tracker. You may request a complete export of your account data at any time.

Correction

You can edit your profile information, update submission records you created, and correct cycle feedback at any time. Imported community-archive records can be flagged for correction but cannot be edited directly.

Deletion

You can delete individual submission records, chat messages, or your entire account. Account deletion is irreversible and removes all personally identifiable data associated with your account.

Visibility control

You can toggle your profile between public and private at any time. Setting your profile to private hides your username and profile information from other users.

Notification preferences

You can manage journal watch alerts, chat notification levels, and mute specific chat rooms at any time from your settings.

Passwords are stored as one-way cryptographic hashes and are never visible to ExpeCited staff or infrastructure providers.

All data in transit is encrypted via TLS. Row-level security policies enforce that users can only access their own private data and that public feeds expose only anonymized, aggregate records.

Access to administrative tools is restricted to verified admin accounts. We do not grant broad database access to any third party.

Despite these measures, no system can guarantee absolute security. If a data breach occurs, we will notify affected users promptly and in accordance with applicable law.

ExpeCited uses essential cookies and local storage to maintain your login session and remember your preferences (such as selected cycle and theme). We do not use advertising cookies, tracking pixels, or third-party analytics trackers.

Because we do not use non-essential cookies, no cookie consent banner is required. Your browser's standard cookie controls can clear session data at any time.

ExpeCited is designed for law students and legal academics. The platform is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

ExpeCited is hosted in the United States. If you access the platform from outside the U.S., your data is transferred to and processed in the U.S. By using ExpeCited, you consent to this transfer. We aim to respect the rights of users under applicable data-protection laws, including the GDPR and CCPA, to the extent they apply.

We may update this Privacy Policy from time to time. When we do, we will revise the 'last updated' date at the bottom of this page. For material changes that affect how we handle your data, we will provide notice through the platform or via email. Continued use of ExpeCited after changes take effect constitutes acceptance of the updated policy.

You can delete your account and all associated personal data from Settings. This action is irreversible. Anonymized, aggregate data that has already been contributed to public feeds (without user attribution) will remain, but your identity and personal records will be permanently removed.

To request data export, correction, or deletion assistance, you can also use the flag mechanism on any public record or contact us through the platform.