A Delithius Labs product
Deliphi Privacy Policy
Effective date: October 2, 2026 · Last updated: October 2, 2026
This policy explains what information Deliphi (deliphi.legal) collects, why, who helps us handle it, and the choices you have. Deliphi is made by Delithius Labs LLC, a North Carolina company ("we," "us"). Questions? Email admin@delithiuslabs.org.
The short version: we collect what it takes to run Deliphi for you. We do not sell your data. We do not use ad trackers or analytics scripts. Each firm sees only its own matters, and you can export your work anytime.
1. Information we collect
Account information. Your name, email address, firm name, plan, and seat details. If you set a password, we store only a secure hash of it, never the password itself.
Your content. The matters, documents, notes, questions you ask 360, messages, and signatures you add. Your firm controls this content. When it includes client information, we handle it on your behalf, to run the Service.
Billing information. Payments are handled by Stripe. Stripe collects your card or payment details directly; we do not see or store your full card number. From Stripe we keep only what it takes to manage your plan: your Stripe customer and subscription IDs, your plan, when you paid, and when your current period ends.
Deliphi for Justice applications. Organization name, EIN, website, and work email, plus the results of our eligibility checks.
Sign-in information. When you ask for a magic link, we store a hashed, single-use token that expires in 15 minutes.
Technical information. Like most websites, our web host keeps standard server logs, which include IP address, browser type, pages requested, and time. These logs are kept by our host for a limited time to keep the Service secure and running.
2. Voice and the microphone
- Deliphi uses your microphone only when you tap the ring to speak. It does not listen in the background.
- Speech-to-text uses your browser's built-in speech service. Depending on your browser, the browser maker may process the audio to turn it into text (for example, Google for Chrome or Apple for Safari) under its own privacy policy. Deliphi receives the text, not a recording, and does not store audio.
- Read-aloud answers are spoken by your browser's built-in voice on your device.
3. Cookies and browser storage
We keep this small and use no advertising or analytics cookies.
| Name | Type | What it does | How long |
|---|---|---|---|
deliphi_session |
Cookie (signed) | Keeps you signed in | 1 day |
dl_voice, dl_vname, dl_rate |
Browser storage | Remembers your voice and reading-speed choices | Until you clear it |
dl_matter |
Browser storage | Remembers the matter you last opened | Until you clear it |
| Checkout snapshot | Browser storage | Returns you to your place after checkout | Until you clear it |
When you check out, Stripe's own script loads on the checkout page and may set its own cookies for payment security and fraud prevention, under Stripe's privacy policy. Our fonts are hosted on our own server, so loading Deliphi pages does not call outside font services.
4. How we use information
- to provide, run, secure, and support Deliphi;
- to sign you in and keep your account safe;
- to bill you and manage your plan, trial, and cancellation;
- to check Deliphi for Justice eligibility;
- to send service emails, such as sign-in links, receipts, and important notices;
- to keep the hash-sealed record for each matter;
- to meet legal duties and enforce our terms.
We do not sell your personal information, share it for cross-context ads, or use Your Content to train AI models.
5. Who helps us (service providers)
We share information only with services that help run Deliphi, and only what each one requires:
| Service | What it does | What it receives |
|---|---|---|
| Stripe, Inc. | Payments, subscriptions, Customer Portal | Billing and payment details, email |
| Our web host (a US-based web hosting company; data is stored in the United States) | Hosts the app, database, and server logs | All data stored in Deliphi |
| Email (SMTP on our host) | Sends sign-in links and service emails from noreply@deliphi.legal | Your email address and the message |
| Caselaw Access Project (static.case.law, Harvard Law School Library) | Public case-law lookups to mark citations | Only the citation text, such as a case cite, with no client or account details |
| IRS, ProPublica Nonprofit Explorer, Legal Services Corporation | Public records for Deliphi for Justice checks | Organization name or EIN (Justice applicants only) |
| Public archives (for example archive.org, Library of Congress) | Optional research look-ups | The research question text, only when you run a research look-up |
| Your browser maker | Speech-to-text when you tap the mic | Your spoken audio, under the browser's policy |
AI model providers: Deliphi does not currently send your content to an outside AI model provider; 360 answers from the authorities on file in your matter. If we enable an AI model provider, we will list it here first and never train on your content.
CourtListener (Free Law Project): Deliphi supports CourtListener citation checks, but this is not turned on today. If enabled, only citation text would be sent.
We may also share information if the law requires it, to protect rights and safety, or as part of a merger or sale of the business, with notice to you.
6. Per-firm separation and security
- Each firm sees only its own matters.
- Answers, pulls, messages, and signatures are sealed into a hash chain for each matter, so changes can be detected.
- We use encrypted connections (HTTPS), security headers, signed session cookies, and hashed sign-in tokens and passwords.
- We have no SOC 2 report or other security certification yet. No system is perfectly secure.
- If a breach affects your personal information, we will notify you as the law requires, including under the North Carolina Identity Theft Protection Act.
7. How long we keep information
- Your content: while your account is open. If you close your account (or an unpaid trial has been read-only for 30 days), your export stays available for 30 days, and then we delete your content within 90 days, except sealed audit records the law requires us to keep.
- Billing records: as long as tax and accounting laws require.
- Magic-link tokens: expire after 15 minutes. Session cookies: expire after 1 day.
- Server logs: kept by our host for a limited time for security and operations.
8. Your choices and rights
- Export: one button exports your work in JSON or CSV.
- Access and correction: update your details in Settings, or email us.
- Deletion: email admin@delithiuslabs.org to ask us to delete your account. We delete your content on the schedule in section 7. Sealed audit records the law requires us to keep, and billing records, may be kept.
- Cancel: in Settings, by telling 360 "cancel my plan," or through the Stripe Customer Portal.
- Browser storage: you can clear it anytime in your browser settings.
- Your state's rights: depending on where you live, you may have more rights under your state's privacy law. Email us and we will respond within the time the law requires.
9. Client information
When your firm puts client information into Deliphi, your firm decides what goes in and is responsible for its duties to clients. We process that information only to provide the Service to your firm. If your firm requires a written data processing agreement, email us.
10. Children
Deliphi is for legal professionals. It is not meant for children under 13, and we do not knowingly collect their information. If a matter includes information about a minor as client data, your firm controls it as described in section 9.
11. Changes to this policy
If we change this policy in a meaningful way, we will tell you by email or in the app before the change takes effect, and update the date at the top.
12. Contact
Delithius Labs LLC Goldsboro, North Carolina Email: admin@delithiuslabs.org