The short version
“We’re only checking that your license is legitimate and that’s it.”
That is all the app’s one connection is for. Buying a license also goes through Stripe and our key email, and every record our license server keeps is listed below.
SupraDraft runs on your computer. Your documents stay on your computer; Rabbit Hole Technologies never receives them. There is no SupraDraft account, no telemetry, no crash reporting, no analytics and no AI model, local or remote. The one thing SupraDraft sends over the internet is the license check described next.
The license check
- When. The first time SupraDraft starts (to begin your free trial), when you enter a license key, when you ask SupraDraft to check now, when you choose Remove this computer or Remove other computers, and about once a week while a paid license is in use, or during the free trial if its license pass runs out before the trial ends. While SupraDraft has no usable license (for example on a first start without internet) it tries again every few minutes, and after a weekly check fails it tries again hourly. Between checks SupraDraft works offline for up to 30 days.
- Where to. Our license server, license.rabbitholetechnologies.ai, over an encrypted (HTTPS) connection. The server runs in Microsoft’s Azure cloud, which hosts it and stores its records for us.
- What it sends. The product name (SupraDraft), the app version, a one-way code for this computer, and — only after you enter one — your license key, marked when you have just typed it. Remove this computer and Remove other computers send the product name, the key, the computer code and which of the two you chose. The computer code is a scrambled fingerprint of an identifier Windows provides; it cannot be turned back into that identifier, though our records link it to your key and, through Stripe, to your purchase. Nothing else is sent: no document, no file name, no case, no firm, client or party name, and no record of how you use SupraDraft. Like any internet request, the check also reveals your internet (IP) address to the server; the server uses it only in memory, for about ten minutes, to limit abuse, and never stores or logs it.
- What the server keeps. For a free trial: the product, the computer’s one-way code and the date the trial started, so each computer gets one trial. For each license key sold: a one-way fingerprint of the key; the product; whether it was sold in Stripe’s live or test mode; how the key was made (from the payment, or from the checkout for a $0 purchase) and the key format’s version; Stripe’s reference numbers for the purchase (its payment and its checkout, and any dispute about it), which carry no name or email address themselves but point to the purchase record in our Stripe account; whether the payment was returned to you in full or disputed; and any hold or computer limit we set on that key. For each computer the key is or was used on: the computer’s one-way code, the product, whether the computer is active or removed, the date its latest license pass runs out and, once it is removed, the date it was removed and whether its place was freed at once; and, per key, the times removing a computer used up one of its three yearly moves. That is what lets a key work on two computers at a time, be moved between them, and stop a removed computer from quietly taking its place back. Removing a computer frees its place at once, using up one of those moves, for up to three computers a year (a computer whose latest license pass has already run out is freed at once without using one); after that a removed computer keeps its place until its latest license pass runs out (at most 30 days). The server never stores your key itself: when Stripe reports that a payment was returned or disputed, it works the key out again from that payment’s reference, and if you lose your key we can work it out the same way to send it to you again. Azure, which stores these records for us, also notes on each one the time it was last changed. The server keeps no other record apart from a short operations log that notes only the kind of each outcome (for example “trial started”, “key refused” or “key sent”). It runs no analytics, and it never logs your key, its fingerprint, a computer code, your internet address, a payment reference, or your name, email address or billing address. In memory only, it holds what limits abuse — your internet address and the computer code, to count how often each asks, and the fingerprint of a key it never sold, to refuse it again for ten minutes without looking it up — and it never writes any of that anywhere.
- Buying, and who else. Rabbit Hole Technologies, LLC sells SupraDraft. Buy opens the SupraDraft store page — our checkout — in your web browser, and Stripe processes the payment there and works out any sales tax from your billing address; your card number goes to Stripe and never reaches the license server. When a purchase goes through, Stripe sends the license server a signed notice of it. The notice carries your name, email address and billing address (and sometimes a phone number); the server uses only the email address, only to send you your license key, and stores and logs none of them. The key email is sent through Resend, an email delivery service: Resend receives your email address and the message itself, which carries your key, and keeps its own delivery records. Stripe’s own privacy policy covers what you give it at checkout. Checking a license involves no other company: the server answers from its own records.
- On your computer. The license pass the server returns, and your key (protected with Windows’ own data protection for your Windows account), are kept in SupraDraft’s private app-data folder.
What SupraDraft keeps, and where
Two folders on your computer.
Your SupraDraft folder — Documents\SupraDraft
- your firm details (firm name, address, attorneys, bar numbers) and each case’s details, as plain files;
- copies of the documents you give SupraDraft (a served discovery set, a complaint, a paper your firm filed before), so it works from a stable copy and never changes your original;
- the working files it makes while it builds a document, and the finished documents, one folder per case;
- the sample documents, if you choose Samples.
This folder is yours. Back it up, move files out of it or delete it whenever you like; uninstalling SupraDraft leaves it in place. If you set an output folder in SupraDraft, each finished document is also copied there. If Windows backs up your Documents folder to OneDrive, or another backup or sync service copies it, that service copies these files as it does any other document in the folder; SupraDraft itself uploads nothing.
SupraDraft’s private app-data folder
Windows removes this folder when you uninstall the app. It holds the embedded browser component’s profile, the number of the local port the app window uses, the license file described above, and a log of the program’s own actions for troubleshooting: when it started and stopped, the folders it uses, errors, the names of files it could not read, and whether a license check succeeded. The log can contain file and folder names, which may include a client’s or a case’s name. It does not record what your documents say, and it never records your license key or the computer code.
Network connections
Apart from the license check, SupraDraft makes no internet connections of its own. In detail:
- Its window is an embedded Microsoft Edge WebView2 control that shows only SupraDraft’s own page. That page is served by SupraDraft’s own process over 127.0.0.1, a loopback address that never leaves your computer, and SupraDraft refuses requests to it from any other web page.
- A link to any other address — including Buy, which opens our checkout — opens in your own web browser, not inside SupraDraft.
- Scanned PDFs are read with the text recognition (OCR) built into Windows, on your computer. Nothing is sent to an online OCR service.
- Opening a finished document hands it to the app Windows uses for .docx files, usually Microsoft Word; that app’s own terms govern what it does.
- If the WebView2 runtime is missing, SupraDraft shows the address of Microsoft’s download page and exits. It downloads nothing itself.
Microsoft components
Two parts of the experience belong to Microsoft, and the Microsoft Privacy Statement covers what they do:
- The Microsoft Store delivers SupraDraft and its updates. SupraDraft is not bought through the Store, and the Store plays no part in the license check.
- The Microsoft Edge WebView2 runtime, which draws SupraDraft’s window, is a Windows component that Microsoft maintains and updates.
What SupraDraft does not do
- It does not send any file, field, name or usage information to Rabbit Hole Technologies or to anyone else. The license check sends only what is listed above.
- It does not use a language model or any AI service, and it does not write legal substance.
- It reads only the files you give it and its own folders.
- It does not connect to court websites or e-filing systems.
- It does not collect your location or your contacts. The one-way computer code is the only thing about your computer it sends (the internet address every connection carries aside, which the server never stores).
Your choices and requests
Everything SupraDraft stores about your work is in the two folders above, on your computer, under your control. Rabbit Hole Technologies holds no copy of your documents, your firm details or your cases. The license server holds only the records described above, and nothing on it deletes them by itself: they are kept until you ask us to delete them. The one exception is the time a removal used up one of the key’s yearly moves: once it is a year old, it is dropped the next time removing a computer uses up one of that key’s moves. To have your computers’ records removed, write to [email protected]: we delete the record of each computer on your key (a removed computer’s included), the key’s list of the times a removal used up one of its moves, and those computers’ free-trial records. A computer that goes on using SupraDraft afterwards is simply recorded again at its next license check. The key’s own record (described above; no name, no email address) is not deleted, on such a request or later, because the key cannot work without it. Your purchase record — your name, email address, billing address and the payment — is kept in our account with Stripe, which processes our payments.
Children
SupraDraft is a tool for legal professionals and is not directed to children.
Changes
If this policy changes, the new version will be posted at this address with a new effective date.
Not legal advice
SupraDraft is a document-assembly tool for legal professionals. It does not provide legal advice, and nothing it produces is ready to file until a licensed attorney has reviewed it.
See also the website privacy notice and the SupraDraft license agreement.