Privacy notice
Lex.NY is a public research tool. This page explains what the site logs, what it doesn’t, and which third parties see your queries.
What we log
On every request to /api/ask and related endpoints, the server records:
- The IP address of the requester, for rate limiting (10 req/min on /api/ask, 5 req/min on /api/ask/stream).
- The question text and the answer text, in standard application logs.
- Timing and token-count metrics for each LLM call (see /stats and
/api/llm-stats).
These logs are kept on the workstation hosting Lex.NY for operational purposes (debugging, abuse mitigation, performance analysis). They are not sold, shared, or used for advertising.
What we don’t collect
- No user accounts. There is no signup, no login, no password.
- No cookies for tracking. The site does not set any non-essential cookies.
- No advertising network integrations. No Google Analytics, no Facebook pixel, no third-party trackers.
- No personal information beyond IP + queries. The site does not request your name, email, or any other identifying field.
Third parties that see your queries
Producing an answer involves calls to a few external services. Each of these third parties may receive part of your query as part of normal operation:
- AWS (Aurora PostgreSQL) - stores and queries the NY corpus. Receives the IDs of retrieved opinions and statutes for pgvector semantic search, Postgres full-text search, and the citation graph (recursive CTEs over CITES / APPLIES edges). Retrieval is corpus-only.
- The embedding model (mxbai-embed-large, 1024-d) - receives your question text to compute the query vector used for semantic retrieval.
- The hosted drafting model - a fast hosted model that receives the embedded question plus the retrieval context block as the prompt, under a strict-citation system prompt. Used to draft the answer.
- Voice input - if you use the microphone button on /ask, transcription runs in your browser using its native speech-recognition. No audio is sent to Lex.NY.
- Vercel - hosts the Next.js app (us-east-1). Sees request metadata (IP, user-agent, URL) at the edge. Their privacy policy applies to that layer.
The full list of third-party services is also documented in the open source repository under the project README.
Retention
Application logs are rotated daily and the on-disk usage tracker files keep the most recent ~5,000 entries per endpoint. There is no long-term archival of queries. The system was built to answer questions, not to build a corpus of what people ask.
Confidentiality - don’t share what you can’t share
Lex.NY is a public tool. Anything you type into /ask is sent to several third-party services as listed above. Do not paste client-confidential information, attorney work product, privileged communications, or anything else you would not want a third-party API to see. If you need an air-gapped or fully self-hosted setup, fork the repository and run it on your own infrastructure - the entire stack (Postgres with pgvector for the corpus, citation graph, and full-text search) can run on your own hardware without any outbound API calls.
Children
Lex.NY is not directed at children under 13. The site does not knowingly collect information from minors. If you are under 13, do not use this site.
Changes
This privacy notice may be updated. The “last updated” date at the top of this page reflects the most recent revision. Version history is in the public repository.
Contact
Questions about this notice or about how Lex.NY handles your data can be directed via the contact methods listed at nota.lawyer or by opening an issue on the public repository.