Privacy Policy
Verdict · Version 2026-10-06.2
What we collect
- Identifiers: a one-way HMAC hash of your email address, a hash of your phone number, a device-fingerprint hash, your Apple sign-in identifier if you use Sign in with Apple, and your IP address. The IP address is stored on the sign-in session it was seen on (sessions expire after up to 7 days; expired session records are removed by scheduled cleanup), on the consent record made when you accept these terms, and on security and audit entries such as opt-outs, data exports, verification events and account deletion, where it is kept with that record. We also keep the state and country it resolved to, as a consistency check on your self-reported state.
- Demographics you choose to provide: age range, gender, ethnicity, state of residence, political leaning. All optional.
- Activity: the polls you view, the votes you cast, friends you add, and messages you send.
- Verification data: if you complete ID verification, the document and photograph are submitted through our identity provider. We process returned verification details, including name, document number, date of birth and address information, to determine eligibility and derive the state, country and keyed hashes of the document and of the person (see Identity verification below).
- Readable contact and verification data: your email address in readable form while email notifications are switched on, because there is no way to send you an email without it (turning notifications off deletes it), and, if you verify an ID, your date of birth. These account fields are distinct from readable details processed for delivery or present in service-provider, operational, report or safety-case records described below.
How we use it
- To operate the service: authentication, voting, and social features.
- To compute and publish aggregated poll results with statistical weighting.
- To produce aggregate statistical reports that we license to business customers. These contain only group-level counts and percentages — for example, "62% of respondents aged 25–34 selected Yes, n=430". Any group with fewer than 50 respondents is suppressed entirely, and respondents who left an attribute blank are never reported as a group. Reports cover closed polls only and are frozen when first issued; a report is re-issued only once the number of respondents it covers has changed by at least 50, to reduce the risk of identifying a respondent by comparing report versions. Statistical customers do not receive row-level records, identifiers or individual responses through these reports, and users who opt out are excluded from these reports entirely (an already-issued report drops them at its next re-issue).
- To send transactional messages: verification codes, security alerts, and result notifications if you enable them.
Advertising and licensed reports
- We do not run advertising and do not use advertising identifiers.
- Verdict does not use your data for cross-app or cross-site advertising.
- We do not license or sell individual records, identity details, contact details or individual votes to statistical customers. This does not mean that no individual data is disclosed: service providers process data to operate Verdict, information is shared through the social features you use, and records may be disclosed for safety or legal obligations.
Email-based registration requires a phone number even when the verification code is delivered by email. Email delivery does not prove phone possession; that account remains email-verified. Where Sign in with Apple is offered, its separate registration flow does not require a phone number.
Identity verification
Verifying your identity is optional. If you do, a government ID and a selfie go directly from your phone to our verification partner, Didit. Verdict processes the returned verification details to determine eligibility and derive duplicate-account checks. We keep the decision, your date of birth, the state and country on the document, and two one-way hashes: one of the document number and one of your name and date of birth. We derive matching keys for both the document and the person. These hashes are used to detect repeat verification of matching document or name-and-date-of-birth details. They help prevent duplicates but do not prove that every person has only one account. If you delete your account, the date of birth, state and country are deleted from your Verdict account record; the one-way hashes of the document and of the person are kept to detect repeat verification when document or person details match. These hashes support repeat-verification matching and are retained identifiers, not a guarantee of anonymity. The full Identity Verification Disclosure explains everything that happens. Our Didit account currently permits historical and new verification data to be used for improving Didit’s models. This is separate from checking your identity; the specific data involved depends on the verification workflow. The configured verification flow records session video, collects front and back ID images (PDF upload is also accepted), and captures a selfie for liveness and face matching. The configured Didit workflow includes ID verification, liveness detection, face matching, device and IP analysis, and anti-money-laundering (AML) screening. Our Didit application currently has session retention set to Unlimited, so no automatic session-expiry period is configured. This is separate from the retention of records in Verdict. For verification-data requests, contact Adam at adam@varrstacktech.com to coordinate with Didit. For Didit’s independent processing or an objection to model-improvement use, you may also contact privacy@didit.me. Account deletion does not automatically erase provider-held data.
Service providers and other disclosures
Current services include Vercel for hosting, Neon for the database, Resend for email delivery, Firebase Cloud Messaging for Android push notifications, and Didit for identity verification. Hosting and database services process account records and app activity; email delivery receives the destination address and message; Android push delivery receives device tokens and notification payloads. To create a Didit session, Verdict sends the selected workflow, a return URL and an internal account identifier (vendor_data); that identifier links the provider result to your Verdict account. Didit also processes the verification captures, device/IP signals and AML checks described below, and our account permits model-improvement use. Provider processing is separate from the aggregate reports licensed to statistical customers.
We also retain launch diagnostics, error descriptions, moderation reports and report details. Server request logs can include requested URLs and query text, such as a username search. These records support operation, security and moderation. The application does not currently implement a fixed cleanup period for diagnostics or moderation reports; hosting-provider log retention is managed separately. Turning off notifications deletes the readable notification-email field, not records already held in logs, reports, case evidence or provider systems.
We keep daily counts of sign-up steps: for each UTC date, a step name, an outcome, and a number. No account, email, phone, device or network identifier is stored with these counts. A scheduled cleanup removes counts older than the current UTC day and the 29 days before it.
Your choices and rights
- Opt out of licensing: in the app, Profile → Legal → "Do Not Sell or Share My Personal Information". The opt-out applies retroactively to past votes in newly computed reports as well as future votes. Previously issued reports remain until their next permitted re-issue, as described above. We also honour the Global Privacy Control signal automatically.
- Delete your account: Profile → Legal → Delete my account. We remove your contact hashes, Apple sign-in link, username, demographics, notification email, sessions, push registrations, friendships, ordinary messages (subject to the case-evidence exception below), and any document-verified date of birth, state and country. Votes remain linked to a retained account identifier so historical results remain accurate. Removing contact details does not make all retained records anonymous. If you verified an ID, the one-way hashes of the document and of the person are kept to detect repeat verification when document or person details match. See Retention for everything else that outlives a deleted account, including records that may identify you.
- Get a copy of your data: Profile → Legal → Download my data.
- Correct your information: edit your demographics at any time in your profile.
- No penalty: exercising any of these rights does not change the features available to you.
Retention
Contact hashes are kept while your account exists and replaced with random values when it is deleted. Sessions expire after up to 7 days. Scheduled cleanup removes expired session and OTP records; using a code invalidates it but does not immediately delete its record. Deletion removes contact and profile data and disables the account; the retained account identifier still links the records listed below.
The following outlive a deleted account:
- Votes remain linked to a retained account identifier, indefinitely, with the verification grade they were cast under, so published results do not change.
- The one-way hashes of the document and of the person from ID verification, to detect repeat verification when document or person details match.
- The record that the age gate was satisfied, and when.
- Consent records showing which versions of the Terms and Privacy Policy you accepted, with the IP address and browser recorded at the time.
- Security and audit history — opt-outs, data exports, verification events and the deletion itself — with the IP address recorded at the time.
- Moderation history, including reports made by or about the account and any flag placed on it.
- Any payment record for ID verification, needed to reconcile charges.
- The referral record of which account referred which, by retained account identifier.
- Your opt-out choice is kept, so an opted-out person stays out of licensed data after deletion.
Consent and audit entries currently have no fixed deletion date and are retained with the record.
For a specific child-safety case, an administrator may preserve the reported conversation, report and relevant participant identifiers in restricted records that survive account deletion. Unreported case evidence expires after 30 days. When a completed CyberTipline report is recorded, evidence is kept for at least one year from submission. A documented legal request or ongoing child-safety investigation may extend a case to an explicit later date. Expired evidence is unavailable through the case interface and is erased by scheduled cleanup; restricted case and audit metadata remain. Ordinary messages are deleted with the account.
Children
Verdict is not intended for anyone under 18. Registration is age-gated and under-age attempts are refused. Rejection records contain the reported birth year (not the exact date), an IP-address hash, browser information and a timestamp.