Privacy Policy

1. The short version

We keep what we need to run your account and show you your own history, and nothing else. Documents you upload are deleted as soon as they are processed. They are never used to train any model and never shared. The only thing that leaves our servers during a verification is the citation string itself, sent to CourtListener.

2. What we collect, feature by feature

Your account

Your email address, your name, and a bcrypt hash of your password — never the password itself. If you register as a student, your .edu address and expected graduation date. Optionally a ZIP code; if you do not give one we derive an approximate city and state from your IP address at signup, for aggregate analytics only. We also store when the account was created, when you last signed in, your plan, and which version of the Terms you accepted and when.

Documents you upload

The file is written to temporary storage, processed, and deleted before the request finishes — on success and on failure alike. The text of your document is never written to our database.

What persists is the report: a generated report file, and a row in our reports table holding the original filename, the report's filename and URL, a content hash, the citation counts, and the timestamp. The report contains the citations found and the case details they resolved to, not the surrounding text of your document.

Our usage analytics never record the filename. They record the file extension (.pdf, .docx), the file type and the size — a document's name is routinely the confidential part, and nothing in our analytics needs it. The original filename is kept only on the report row described above, so you can recognise your own report, and it is deleted with the report.

Citations you verify

Citation strings are cached so a repeat lookup is instant. Only verified citations are ever cached, and the cache is shared across all users rather than attached to your account — it holds the citation and what it resolved to, not who asked.

API, MCP and agent use

Each request writes a row to our api_usage_log table: the endpoint, HTTP method, response status, response time, the number of citations in the request, your IP address, and your user-agent string. The citations themselves are not recorded there. Agents paying per call over x402 have no account; we record the settlement (timestamp, route, network, payer wallet, amount, transaction hash) and nothing about the caller's identity.

Product analytics

We record events such as sign-ups, uploads, and which features are used, in an analytics_events table and in daily log files on our server. Events are tied to your user ID.

3. Cookies and sessions

Signing in sets one HTTP-only session cookie holding your access token, and stores the same token in your browser's local storage so the web app can call our API. That is the whole of it: we set no advertising cookies, no third-party trackers, and no cross-site analytics tags. Clearing your browser storage signs you out.

4. How long we keep things

Plainly: we do not currently expire data automatically. Account records, reports, usage logs and analytics events are kept until you ask us to delete them or you close your account. Uploaded document files are the exception — those are deleted within the request that created them, always.

We would rather say that than quote a retention period we do not enforce. If a defined retention window matters to you, write to us.

5. Who we share with

Stripe — our payment processor, acting on our behalf. It receives your email address and the billing details you give it. We never receive or store your card number.

CourtListener, operated by the Free Law Project — queried when a citation is not already in our cache or local corpus. Only the citation string is sent. Not your document, not your identity, not your account.

Our hosting provider (DigitalOcean), which stores our servers and database.

Nobody else. We do not sell personal information, we do not share it with advertisers, and we do not use your documents or citations to train any model — ours or anyone else's.

We may disclose information if required by law, court order or governmental regulation, and we may publish anonymised aggregate statistics that cannot identify any individual.

6. Third-party platforms

If you reach Veridictum through ChatGPT, Claude, Copilot or another AI platform, your conversation passes through that platform first and its own privacy policy governs what it does with it. We receive only the request it forwards to us.

7. Your rights

Access. Email us and we will tell you what we hold about you and send you a copy.

Deletion. Email us and we will delete your account, your reports, and the usage and analytics records attached to it. We handle this by hand — there is no self-service delete button yet, so please write from the address on the account and allow a few days. Anonymous aggregates and the shared citation cache, which contain nothing identifying, are not affected.

Correction. You can change your name and location details from your dashboard, or ask us.

Depending on where you live you may have further rights over your personal data. Ask us and we will honour them.

8. Security

Traffic is encrypted in transit with TLS. Passwords are stored as bcrypt hashes. API keys are stored as hashes, not in plaintext, and are shown once at creation. Access to the production database is limited to the operator.

9. Children

The Service is for legal professionals and law students and requires you to be at least 18. We do not knowingly collect information from children.

10. Changes

Each version of this policy carries an effective date, shown at the top. When it changes materially you will be asked to accept the new version the next time you sign in.

11. Contact

Public Square LLC
275 5th Avenue, Suite 704-3071
New York, NY 10001
support@veridictum.legal