Privacy Policy

1. Who this applies to

This policy covers the Philippine Laws platform at phlaws.cloud and the Philippine Laws mobile app. It is written to meet the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

The platform is run by an individual, not a company, and the contact address in section 10 reaches that person directly. Under the Act they are the personal information controller for everything described here.

2. What is collected, and when

Nothing in this section is collected speculatively. Each item exists because a feature needs it, and the feature is named.

If you never sign in

You can read every statute and decision, run the calculators, play the myth deck and open any scenario page without an account, and none of it is tied to your name.

• Search terms. The words typed into the search box are logged with the index searched and the number of results, so that editorial effort goes to the laws people are actually looking for. Each entry carries a salted SHA-256 hash of your IP address and browser string that includes the current date in Philippine time. That groups one visitor’s searches within a day and cannot link them across days. The raw IP address and browser string are never written to the search log.
• Visit log. Each page view is recorded with the page, how long you actively read it and how far you scrolled, the site that linked you here (its name only, not the full address) and any campaign tag on the link, your screen size, browser, time zone, a random identifier your browser keeps in local storage, and your IP address and browser string. Some actions are logged the same way — starting or finishing a quiz, opening a lesson, saving a bookmark, using a calculator — so we can see which features help. While a page is open, your browser also checks in once a minute so we can tell how many people are reading right now. The IP address is there to tell real readers apart from bots and to stop anyone copying the site wholesale; it is deleted after 30 days. The rest has no name attached and is kept to see which pages are used.
• Things kept in your own browser. Your theme, your answer to the cookie banner, your acknowledgement of the AI notice on the Bar pages, and — if you drill flashcards signed out — the review schedule for those cards. This lives in your browser’s local storage. It never reaches the server, it does not follow you to another device, and clearing site data erases it.
• Analytics, only if you accept. See section 4.

If you sign in

Sign-in is through Google. There is no password to set, and none is stored.

• Your Google profile: name, email address and profile picture URL, plus the tokens Google issues so the session can be kept open.
• What you make while reading: highlights, notes, saved documents, bookmark folders and any case digests you write.
• Your drill history: which questions and flashcards you answered, what you answered, when each card is next due, the questions you flagged, and your per-subject progress.
• Daily counters for reporting questions, so a fair-use limit can be applied. These count reports; the report itself is stored with the flag.
• Purchase records, if you subscribe: the platform, product id, order id and purchase token issued by the app store. No card number or billing address ever reaches this platform — the store handles payment and never passes those on.

On the mobile app

A device identifier is stored so that a free trial can be offered once per device. It is not linked to an account unless you sign in.

What is never collected

No card or bank details. No contacts, photos, microphone or precise location. No advertising identifiers, and no data is sold, rented or shared with advertisers or data brokers. There are no third-party advertising or tracking scripts on the site.

3. Why, and on what legal basis

Under section 12 of the Data Privacy Act, personal data may be processed on a number of grounds. These are the ones relied on, and for what:

• Your consent — analytics. Given by accepting the cookie banner, and withdrawable at any time.
• Performing a service you asked for — keeping you signed in, storing your highlights, digests and drill progress, and honouring a subscription you bought.
• Legitimate interests — the search log, the visit log, the report counters and the trial device identifier. Respectively: deciding which laws get a plain-language layer, keeping bots and scrapers off the site, preventing one account from flooding the report queue, and stopping the same device from taking the free trial repeatedly. These interests are weighed against your rights, which is why the search log stores a daily hash instead of your IP address.
• Legal obligation — where a law or a lawful order requires disclosure or retention.

4. Cookies and analytics

The platform sets no cookies of its own for tracking. Signing in sets a session cookie, which is what keeps you signed in; it is strictly necessary and is not subject to the banner.

Google Analytics is the only third-party analytics on the site, and it is loaded only after you accept on the cookie banner. If you choose “Essential Only”, or simply never answer, the Google Analytics script is never requested and no Google Analytics cookie is set. Your choice is stored in your browser, not on the server, so it is per-browser and per-device.

Where Google Analytics is running, it collects the pages you visit, rough location derived from your IP address, and device and browser type. Google processes that as an independent controller under its own privacy policy.

5. Who else sees it

Personal data is shared only with the providers the platform runs on, and only to the extent each needs:

• Google — sign-in, and analytics if you accepted it.
• Google Play — subscription purchases and their validation.
• The hosting provider running the server and database, which are located outside the Philippines. Any transfer abroad is covered by that provider’s contractual commitments, and the platform remains accountable for the data under section 21 of the Act.

Nothing is sold. Nothing is shared for advertising. Data is disclosed to anyone else only where a law or a valid legal order requires it.

6. How long it is kept

• Your account and everything attached to it — until you delete the account. Deleting it removes your profile, highlights, notes, saved documents, digests and drill history.
• Search log entries — the daily session hash stops being useful after its day, and the entries are retained in aggregate for editorial planning.
• Visit log — IP addresses are erased after 30 days; the remaining anonymous page-view records are kept to track which pages are used.
• Purchase records — kept while a subscription is live, and afterwards for as long as tax and accounting rules require.
• Anything in your own browser — until you clear it. Nobody else can reach it, including us.

7. Your rights

Chapter IV of the Data Privacy Act gives you the following rights over your own data. To exercise any of them, write to the address in section 10; a response will follow within a reasonable period, and in any event within the time the National Privacy Commission requires.

• To be informed that your data is being processed — this page.
• To access a copy of what is held about you.
• To correct anything inaccurate or out of date.
• To erasure or blocking — you may have your data removed where it is incomplete, outdated, false, unlawfully obtained, or no longer necessary for the purpose it was collected for.
• To object to processing, including withdrawing consent to analytics at any time.
• To data portability — to obtain your data in a structured, commonly used, machine-readable form.
• To damages for a violation of your rights under the Act.
• To complain to the National Privacy Commission. You do not have to come to us first, though it is usually quicker. The Commission is at privacy.gov.ph.

8. Security

Traffic is served over HTTPS. Sign-in is delegated to Google, so no password is held here to be stolen. Administrative functions are behind a role check, and database access is restricted to the application. The search log is designed so that the identifying part — your IP address and browser string — is discarded at the point of collection rather than protected after it.

No system is perfectly secure. If a breach occurs that is likely to put you at real risk, you and the National Privacy Commission will be notified as the Act requires.

9. Children

This platform is built for law students, Bar candidates and adults looking up their own legal position. It is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child’s data has been collected, write to the address below and it will be deleted.

10. Contact, and changes to this policy

For any question about this policy, any request under section 7, or any privacy concern:

If this policy changes in a way that affects what is collected or who sees it, the date at the top of this page changes with it and the change is described here. Continuing to use the platform after that date means the revised policy applies. See also the Terms of Service.