Delilah Home

A private, self-hosted assistant for one household

Privacy Policy

Effective 25 September 2026

Delilah Home ("Delilah") is a private, non-commercial assistant operated by one family on a self-hosted server in a private residence. This policy explains exactly what data Delilah accesses, why, where it is stored, and how to remove it.

Who this applies to

Only members of the operating household, each of whom connects their own Google account voluntarily. Delilah is not offered to the public and has no sign-up.

Google user data we access

Delilah requests these scopes, and uses them only as described:

Scope	Why
`calendar`	Read your events to answer questions; create or change events when you ask.
`gmail.send`	Send a message only when you explicitly ask Delilah to send it. Delilah cannot read your mail.
`drive.file`	Create and modify only the files Delilah itself makes, or ones you explicitly hand it. Delilah cannot see the rest of your Drive.
`tasks`	Read and update your task lists.
`contacts.readonly`	Resolve names to addresses so "email Mom" works.

Delilah accesses this data only to fulfil a request made by the account's own owner. One household member's request never reads another member's Google data.

Scopes we deliberately do not request

Delilah does not request any of Google's restricted scopes. It cannot read your mailbox (gmail.readonly), and it cannot browse your Drive (drive.readonly). These were removed on 25 September 2026 to keep Delilah's access as narrow as the features actually require.

Limited Use disclosure

Delilah's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is never sold, never transferred to third parties, never used for advertising, and never used to train, fine-tune or evaluate any machine-learning model.

Where data is stored

OAuth tokens are encrypted with Fernet (AES) before being written, and stored in a PostgreSQL database on the household server. That database is not reachable from the internet.
Message and file contents retrieved from Google are held only in memory for the duration of the request. Delilah does not build a copy of your mailbox or Drive.
Conversation history with the assistant is stored locally so it can remember context. You can ask for it to be deleted.
The server is in a private home, protected by encrypted storage and private-network access only.

What we never do

Sell or rent your data — to anyone, ever
Share it with third parties, advertisers or brokers
Use it to train or improve any AI model
Run third-party analytics or tracking
Access an account other than in service of its own owner's request

Third parties

The language model answering your requests normally runs locally on the household server. If a request is escalated to an external model provider, only the text of that request is sent — never your credentials, tokens or bulk account data. Those providers are contractually barred from training on the content.

Your control

Revoke Delilah's access at any time at myaccount.google.com/permissions. Access stops immediately.
Ask the operator to delete your stored tokens and conversation history; this is done on request.
Tokens are deleted when access is revoked or the account is disconnected.

Children

Delilah is used within one family and may be used by minors under the supervision of their parents or guardians, who operate the system. No data is collected from children for any commercial purpose.

Changes

Material changes will be reflected here with a new effective date.

Contact

Questions or deletion requests: ryan.j.werner80@gmail.com