Last updated October 2026 (v9)
This Privacy Policy is issued by BluePath Software Inc. ("we," "us," or "our"), the operator of Peppercorn.
Peppercorn is a study and preparation platform for prospective and current law students, as well as bar and law society candidates. This policy explains what personal information we collect when you use Peppercorn or sign up for our marketing emails, why we collect it, how it is processed, and who receives it.
Account Information: your email address and a salted, hashed version of your password (we never view or store plain-text passwords). If you voluntarily complete optional profile fields, such as a phone number or mailing address, we store that information as well.
Study Progress & Activity: your topic history, practice mode accuracy, review schedules, subject preferences, and study activity logs (including timestamps, scores, and specific submission attempts such as essays or outlines). This data allows your progress to sync seamlessly across devices.
Security & Access Logs: sign-in and registration attempt records (including IP addresses, timestamps, and success/failure status) and active session data. We use these logs to monitor platform security, prevent unauthorized access, and enable you to review or terminate active sessions across your devices.
Service Usage Metrics: daily counts of your requests and approximate model output volumes. We monitor aggregate usage to maintain infrastructure performance and prevent platform abuse. We do not inspect or review the contents of your generated prompts or outputs for this purpose.
Marketing Email Preferences: if you choose to receive marketing emails — at signup, in your profile settings, or through the subscribe form on trypeppercorn.com — your email address and a record of that choice: the date and time, your IP address, how you opted in or out, and the exact wording you agreed to. You don't need an account to subscribe, and opting in is never required to use Peppercorn.
AI Request Records: the material you submit for AI generation and the response you receive, kept for as long as your account remains active — see "What we keep, and for how long" below for why and for how long.
When you paste material into Peppercorn to generate study materials — such as notes, a syllabus, or a fact pattern — we transmit that text to our AI service provider to fulfill your specific request. We also keep a record of that request (the material you submitted and the response you received) for as long as your account remains active, so that a disputed grade, a scoring-pattern question, or a support issue can be resolved against exactly what you were given and what you submitted, not just a summary. This record is deleted when your account is deleted (see "Your Rights" below), and access to it is limited to the purposes described here — investigating a reported problem, a security concern, or a valid legal request.
If you save or log a generated response to your account (such as a practice essay answer, outline, or activity log entry), that output also appears in your visible study history, separately from the request record described above.
All payment transactions are securely processed by our third-party payment provider, Stripe. When subscribing or making a purchase, you interact directly with Stripe's secure hosted checkout components.
To complete transactions, Stripe collects payment details (e.g., credit or debit card numbers), billing addresses, email addresses, and transaction history. Stripe may also collect technical metadata, such as device identifiers and IP addresses, for fraud prevention and checkout optimization.
We never collect, transmit, or store raw payment credentials on our servers. Stripe manages payment security in compliance with the Payment Card Industry Data Security Standard (PCI-DSS). Our access is strictly limited to a non-sensitive Stripe customer identifier and your subscription status (e.g., active, trialing, or past due) to manage account permissions. For further details, please review Stripe's Privacy Policy.
We retain account information, study progress, security logs, and the AI request records described above for as long as your account remains active — to maintain your progress history and spaced-repetition scheduling, and so a support or dispute question can be resolved against your actual activity.
When you request account deletion, we permanently delete your account details, study progress, and AI request records. If you were subscribed to marketing emails, we record that you've opted out and keep that record, so we never email you again. Limited security logs (such as account creation records) may be retained for a temporary, defined period to fulfill legal obligations or investigate suspected security breaches.
We maintain technical and organizational safeguards to protect your personal information:
When you accept the Terms of Service, Privacy Policy, or the terms of a specific purchase (a Bar Prep Pass, Baby Bar Pass, or Core-to-prep add-on), we log the date, time, your IP address, and what you agreed to, and email you a copy.
Our public marketing pages (distinct from the main Peppercorn web application) use a lightweight, privacy-focused analytics script to gather aggregate metrics on website usage, such as general geographic region (city-level, based on IP address), page views, and session duration.
This first-party tracking is non-identifiable and uses temporary browser sessionStorage (which resets when you close your browser tab) rather than cookies. It is not connected to user accounts.
We advertise Peppercorn on Google and Reddit. Unless you have opted out (see below), our marketing pages also load:
pc_attr), set by us on trypeppercorn.com and readable only by us. It records the advertising click identifiers and campaign parameters from the link you arrived on, so we can tell which ad brought you here. It lasts 90 days.When you start a trial or make a purchase, we report that conversion back to Google and Reddit, both from your browser and from our own servers. Server-side reports include the click identifier and, for Reddit, a one-way hashed version of your email address — used only to match your conversion to the ad you clicked, never to build a profile of you.
How to opt out. Use the "Your Privacy Choices" link in the footer of any page. We also honour the Global Privacy Control browser signal automatically: if your browser sends it, we do not load advertising tags or record click identifiers at all, and you do not need to do anything else.
Our no-signup "try it free" demo works the same way as the paste-in feature described above, with one difference: since there's no account to tie a record to, we keep the text you paste and the response you receive, tied to your IP address and a temporary browser identifier (not your identity), for up to 30 days — solely to review the endpoint for abuse or misuse — and then delete it automatically.
We send marketing emails — product updates, promotions, discount codes, study tips, and other resources to help you prep — only if you've opted in. When you subscribe through trypeppercorn.com, we first email you a link to confirm, and you aren't subscribed until you use it.
You can unsubscribe at any time, without logging in: use the link in any marketing email, your email app's unsubscribe button, or your profile settings, or contact us. Unsubscribing takes effect immediately and doesn't affect emails about your account, such as password resets, receipts, and security alerts.
Every marketing email identifies BluePath Software Inc. as the sender and includes our mailing address.
Regardless of your jurisdiction, you may submit the following requests regarding your personal data:
Some records are retained for a defined period even after a deletion request:
If we can't act on part of your request because it falls under one of these categories, we'll tell you specifically what we're retaining and why. If you're a California resident, you have the right to appeal that decision by contacting us at privacy@trypeppercorn.com. If you're in a jurisdiction with its own data protection authority — for example, Canada's Office of the Privacy Commissioner — you may also bring a complaint there.
To exercise these rights, please contact us at privacy@trypeppercorn.com from your registered account email, or from the email address you subscribed with if you don't have an account. We review and fulfill verified requests in accordance with applicable legal timeframes.
BluePath Software Inc. is responsible for personal information under its control in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
We collect, use, and disclose personal information solely for the purposes identified in this policy. Continued use of Peppercorn constitutes consent to the collection and handling of your data as described herein. Marketing emails are the exception: we send them only with your separate, express opt-in, which you can withdraw at any time.
Advertising cookies and pixels. The advertising and conversion measurement described above is not necessary to provide Peppercorn, and we do not treat your continued use of the site as consent to it. You may withdraw consent at any time through the "Your Privacy Choices" link in the footer, and we honour the Global Privacy Control signal automatically. Withdrawing consent does not affect your account or your access to anything you have paid for.
If you have unresolved concerns regarding our privacy practices, you may contact our privacy officer or lodge a formal complaint with the Office of the Privacy Commissioner of Canada.
Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have specific statutory rights regarding their personal information.
We do not sell personal information. We do share personal information for cross-context behavioral advertising, as "share" is defined by the CPRA. The categories shared are Identifiers (advertising click identifiers, and a one-way hashed email address used solely to match a conversion) and Internet or Network Activity (pages viewed on our marketing site, and the fact that you started a trial or made a purchase). The recipients are Google and Reddit. We do not use or disclose sensitive personal information for purposes other than providing the requested services, and we do not knowingly share the personal information of consumers under 16.
You may opt out of this sharing at any time using the "Your Privacy Choices" link in the footer of any page. We also treat the Global Privacy Control (GPC) signal as a valid opt-out request and honour it automatically, without requiring you to do anything further.
Subject to legal limitations, California residents have the right to request access to, correction of, or deletion of their personal information, as well as the right to equal service without discrimination for exercising privacy rights.
To submit a request, email privacy@trypeppercorn.com. Authorized agents submitting requests must provide written authorization from the consumer.
We may update this Privacy Policy periodically to reflect operational, legal, or regulatory changes. Whenever this policy or the Terms of Service changes, we'll ask you to review and affirmatively accept the updated version the next time you log in before you can keep using your account — see the Terms of Service's "Changes to Terms" section for how that works.
For privacy inquiries or to exercise your privacy rights, please contact:
BluePath Software Inc.
20 Bay Street, Suite 1100
Toronto, Ontario M5J 2N8
Canada
Email: privacy@trypeppercorn.com