Privacy Policy

Your facts stay yours

Fact patterns, uploaded documents, notes, and every piece of work product Starry generates for you are visible only to your account. Starry does not publish account content. We do not sell your data or run advertising trackers.

Privacy-limited usage analytics

When configured, Starry uses Amplitude to understand which product areas and matter tabs signed-in users visit. Those events use an opaque internal account identifier. On the public marketing page, Starry records aggregate page-view, traffic-category, device-category, and call-to-action counts through its own server. Public-page analytics use no browser analytics SDK, cookie, browser storage, visitor identifier, fingerprint, raw user agent, full referrer, or visitor IP. Starry does not send Amplitude matter names, facts, uploaded documents, notes, search text, case text, generated work product, page titles, or full URLs. Automatic interaction capture and marketing attribution remain disabled.

Where your data lives

Matters, searches, and analysis are stored in Starry's own database. Uploaded documents are stored in private cloud storage and are never publicly addressable. Deleting a matter permanently deletes its searches, analysis, and documents.

On-device identifier protection

When identifier redaction is on, Starry checks names, email addresses, phone numbers, Social Security numbers, and similar identifiers and replaces what it detects with anonymous placeholders in your browser. Automated detection reduces exposure but may miss sensitive details, so review them before submitting. Starry stores an encrypted lookup on its servers so your browsers can display those placeholders as the original values after you unlock them. The server copy is encrypted with a random key that is itself protected by a key derived from your password; Starry receives neither key and cannot read that copy.

After you unlock the lookup, Starry also saves a plaintext copy of its token-to-identifier mappings in this browser's local storage. This lets later visits in the same browser display private names without asking for your password again. The local copy is available to software and scripts with access to your browser profile or to starry.law, and it remains until you lock private names, sign out, clear the site's browser data, or the vault is replaced. Do not unlock private names on a shared or untrusted device.

A normal password change re-protects the same lookup with the new password. If you reset a forgotten password, the old key cannot be recovered, so Starry deletes the encrypted lookup. Your matter and research remain available with anonymous placeholders.

Case-law research never transmits your facts to a search service

Starry searches a complete local copy of the public case-law corpus. Your fact pattern is not sent to a third-party legal search API — retrieval happens on our own infrastructure against public court opinions.

What is sent to AI models

Analysis — issue spotting, case relevance, rule synthesis, and drafting — may use paid business/API services from Anthropic, Google, OpenAI, or xAI, depending on configuration. Your fact pattern, relevant passages from public court opinions, and text extracted from documents you upload are sent to the selected provider over encrypted API connections. When identifier protection is on, protected identifiers have already been replaced with anonymous placeholders.

Under the providers' current commercial terms, your inputs and outputs are not used to train their models. Providers may retain content temporarily to operate their services, detect abuse, maintain security, or comply with law; retention periods and feature-specific exceptions vary. Treat anything you enter as transmitted to the selected provider — if a matter is too sensitive for third-party processing, do not enter it.

Citations you can verify

Every case citation in Starry's output is resolved against the actual case-law corpus before it reaches you — a case name that does not exist in the corpus cannot appear in your work product. Characterizations of cases are checked against the opinion text in a separate verification pass, and each citation links to the underlying passage so you can confirm it yourself. Treatment checks flag cases that later opinions have overruled, reversed, or questioned.

Access & security

Accounts use passkeys or passwords stored as bcrypt hashes. Session tokens are stored only as digests and rotate on every sign-in; repeated failed logins lock the account. Connections are encrypted in transit.

Professional responsibility

Starry is a research and drafting aid, not a lawyer. It does not provide legal advice, and no attorney-client relationship is created by its use. You remain responsible for verifying every authority before filing — the verification affordances throughout the product exist to make that diligence fast, not optional.

Questions or deletion requests

For data questions, export requests, or account deletion, email hello@starry.law.