What we keep on your device.

You can use Open Justice without accepting any optional cookies. Nothing is stored on your device for analytics until you say yes, and no cookie-based tracking runs before then.

• Strictly necessary items always run. They keep you signed in, keep your place in an AI Lawyer conversation, and remember your cookie choice. Without them the site cannot work.
• Google Analytics only runs if you accept it. The tag is not loaded at all until you do, so on a declined visit there is nothing on the page to collect anything.
• One cookieless measurement runs regardless. Vercel Web Analytics records page views and basic technical context without setting anything on your device or identifying you. There is no cookie to consent to, so it is not part of the banner — but we would rather name it than let you find it yourself. Detail in section 3.
• We do not use advertising or cross-site tracking cookies. No ad pixels, no retargeting, no data brokers.
• You can change your mind at any time, and clearing your browser storage resets the decision entirely.

A cookie is a small file a website asks your browser to keep and send back on later visits. Two related technologies do a similar job, and we treat all three the same way in this policy because the practical effect for you is identical:

• Cookies are sent back to the server with each request. We use them for signing in, identifying an anonymous AI Lawyer conversation, and remembering your cookie decision.
• Local storage stays in your browser and is not automatically sent anywhere. We keep a backup of your cookie decision here.
• Session storage — the same, but cleared when you close the tab.

Strictly necessary — always active. These cannot be turned off, because turning them off breaks signing in or loses your conversation.

• Authentication session — set by Supabase when you sign in, and scoped so a single sign-in works across the Open Justice portals. Cleared when you sign out.
• Trusted-device token — set only if you choose to trust a device during two-factor authentication, so you are not challenged on every visit from that device.
• Anonymous chat session (oj_chat_session) — identifies an AI Lawyer conversation started before you have an account, so you can come back to it and so it can be attached to your account if you sign up. It is HttpOnly, meaning page scripts cannot read it. Deliberately not your IP address: IP addresses are shared behind home and office networks and change as you move, so they can neither grant nor deny access safely.
• Cookie decision (oj.cookie-consent) remembers whether you accepted or declined. It is stored in a cookie lasting up to 12 months, renewed when you visit, with a local storage backup. A choice saved before this change is carried over without asking you again. Clear both cookies and local storage for this site to reset it.

Analytics — only after you accept.

• Google Analytics 4 — tells us which pages people find useful and where they give up. The tag is not loaded at all unless you have accepted and the site is running in production, so on a declined visit there is nothing on the page to collect anything.

Cookieless measurement — runs on every visit, including a declined one. These set nothing on your device and are not covered by the banner, because there is no storage to consent to. We list them anyway:

• Vercel Web Analytics — records page views along with the referring site, approximate location, browser and device type. It is aggregate and cookieless: no identifier is stored on your device and visitors are not tracked between sites or across sessions. Vercel publishes what it collects in its analytics privacy documentation.
• Vercel Speed Insights — page loading and responsiveness timings only, so we can tell when a page has become slow for real users rather than only on our own machines.

Some things we rely on are run by other companies. Where they set anything on your device, it is covered by their own policies as well as this one:

• Google (Analytics and reCAPTCHA) — analytics only after you accept. reCAPTCHA runs on the sign-up form regardless, because it is what stops automated abuse of account creation; it is a security measure, not a tracking one.
• Stripe — used when you subscribe, for payment processing and fraud prevention. We never see or store your card details.
• Supabase — provides authentication, so the sign-in cookie described above originates there.
• Cal.com — powers lawyer scheduling and video consultations on the pages where you book or attend one.

Your decision is stored on the device and browser you made it on, so a choice made on your laptop does not follow you to your phone.

• To withdraw consent — clear this site's data in your browser settings. The banner will appear again on your next visit and you can decline.
• Browser controls — every major browser lets you block or delete cookies for a specific site. Blocking the strictly necessary items will stop you being able to sign in.
• Do Not Track — there is no agreed standard for how sites should respond to this signal, so we do not rely on it. Our consent banner is the control that actually works.

If we add or remove anything that stores data on your device, we will update this page and change the effective date at the top. Material changes will also reset the banner so you can make a fresh choice.

Questions about this policy can go to privacy@openjustice.au. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.