Privacy Policy

Effective date: April 9, 2026

TheVouch is built on the principle that your data belongs to you. We do not sell your data, serve ads, or use algorithms to manipulate your attention. This policy explains exactly what we collect, why, and how we protect it.

1. Who We Are

TheVouch ("TheVouch", "we", "us", "our") operates the social networking platform available at thevouch.io and through our mobile applications. TheVouch is a verified-identity social network where every member is authenticated through government-issued identification.

For questions about this policy or your data, contact us at legal@thevouch.io.

2. Identity Verification

TheVouch requires every member to verify their identity through government-issued identification. This is the architectural foundation of the platform and cannot be bypassed.

How Verification Works

Identity verification is performed by our third-party partner, Sumsub, a regulated Know Your Customer (KYC) provider. During verification, you will be asked to:

• Present a government-issued identification document (passport, national ID, or driver's license)
• Complete a biometric face match (a selfie compared against the ID photo)

What We Store From Verification

We do not store your identity documents or selfie images. Sumsub processes and retains those materials according to their own privacy policy and applicable regulatory requirements. From the verification result, TheVouch stores only:

• Full name as it appears on the identity document
• Date of birth to confirm age eligibility (18+)
• Country of issue the country that issued the identity document
• Verification status whether verification was approved, pending, or rejected
• Identity hash a one-way cryptographic hash (SHA-256) of your normalized name and date of birth, used to enforce the one-person-one-account rule; this hash cannot be reversed to recover your information

One Person, One Account

The identity hash ensures that a single individual cannot create multiple accounts. If an account is terminated for policy violations, the individual behind that account cannot create a new one under any identity, because we verify the person, not the account.

3. Data We Collect

Account Information

• Name your real name as verified through KYC
• Email address used for account recovery and transactional notifications
• Phone number used for registration, OTP verification, and SMS recovery
• Date of birth verified through KYC to enforce the age requirement
• Country derived from your identity document
• Username your chosen unique identifier on the platform
• Password stored using bcrypt hashing with a cost factor of 12; we never store or have access to your plaintext password

Profile Information

• Bio a short description you write about yourself
• Profile photo and banner image photos you upload to personalize your profile
• Work experience job titles, companies, and time periods you add to your profile
• Privacy mode your chosen visibility tier (Spotlight, Exclusive, or Incognito)

Content You Create

• Posts text and photo content you publish
• Direct messages conversations with other members (end-to-end encrypted; see Section 5)
• Reactions hearts you give to posts
• Reposts posts you share with your followers
• Polls polls you create and votes you cast
• Bookmarks posts you save privately
• Channel participation channels you create, join, or post in
• Waves messaging consent requests you send or receive

Social Connections

• Follows and followers your network connections
• Follow requests pending requests for Exclusive and Incognito accounts
• Blocked and muted accounts members you have blocked or muted
• Muted words keywords you have chosen to filter from your feed
• Private list the curated list of followers you grant access to private-visibility posts

Company Information (Business Tier)

• Company profile company name, industry, headquarters location, founding year, website, and logo
• Employee records job titles, departments, and employment status for employees linked through the Business account
• Vacancies job listings published through the company profile
• Applications HR pipeline records for applicants to company vacancies

Automatically Collected Data

• Device token Apple Push Notification service (APNs) tokens for delivering push notifications to your device
• Profile views a record of which members viewed your profile (visible to you)
• Search queries what you search for on the platform, used to provide search results
• Post view counts aggregate counts of how many members viewed a post
• Online status whether you are currently active on the platform
• App version and device information used for crash diagnostics and compatibility checks

4. Data We Do Not Collect

TheVouch is deliberately designed to minimize data collection. We do not collect:

• Location data we do not track your GPS, IP-based location, or movement
• Contacts we never access your phone's contact list
• Advertising identifiers we do not collect IDFA, GAID, or any ad tracking IDs
• Browsing history we do not track your activity outside the platform
• Cookies TheVouch is a mobile application and does not use web cookies for tracking
• Analytics or tracking SDKs we do not embed third-party analytics, tracking pixels, or behavioral profiling tools

5. End-to-End Encrypted Messaging

All direct messages and group conversations on TheVouch are end-to-end encrypted using X25519 key exchange and AES-256-GCM encryption, the same cryptographic standard used by Signal.

• We cannot read your messages. Message content is encrypted on your device before it leaves and can only be decrypted by the intended recipients. This is enforced by mathematics, not by policy.
• Media in conversations is encrypted. Photos and other media shared in direct messages are encrypted before upload.
• Metadata is minimal. We store conversation participant lists, timestamps, and message delivery status, but never the plaintext content of messages.
• We cannot comply with requests to disclose message content because we do not possess the ability to decrypt it.
• If you lose access to your encryption keys, message history cannot be recovered by TheVouch.

6. Media Storage

User-uploaded media (profile photos, banner images, and post photos) is stored on Cloudflare R2, a globally distributed object storage service.

• Profile photos for Exclusive and Incognito members are served through signed URLs, time-limited and non-shareable links that expire to prevent unauthorized redistribution.
• Post media follows the visibility rules of the post itself. If a post is visible only to followers, the media is accessible only to followers.
• Direct message media is end-to-end encrypted before upload and stored in encrypted form. Even Cloudflare cannot read it.
• All photos appear in black and white on the platform. Color data is not stripped from uploads; the monochrome presentation is applied at the display layer.

7. How We Use Your Data

We use your data exclusively to operate the platform:

• To provide the service displaying your posts, delivering messages, showing your profile to other members according to your privacy settings
• To enforce identity verification ensuring one person per account and that all members are 18+
• To deliver notifications push notifications for new messages, waves, reactions, follows, and other relevant events
• To send transactional emails account recovery, password resets, and security alerts via Resend
• To manage subscriptions processing payments through Apple In-App Purchase and verifying subscription status
• To enforce platform rules investigating reports, moderating content, and banning users who violate our Terms of Service
• To maintain platform stability crash reporting, error diagnostics, and performance monitoring

What We Never Do With Your Data

• We never sell your data to anyone, for any reason, under any circumstance.
• We never serve ads. There is no advertising system. There are no advertisers.
• We never use algorithms to manipulate your feed. Your feed is chronological.
• We never share your data with third parties for marketing, profiling, or targeting purposes.
• We never build behavioral profiles or track engagement patterns for optimization.

8. Third-Party Services

TheVouch uses a limited number of third-party services, each for a specific, disclosed purpose:

• Sumsub Identity verification (KYC). Processes your ID documents and biometric face match. Sumsub operates under its own privacy policy and regulatory framework. We receive only the verification outcome and basic identity data.
• Cloudflare Content delivery network (CDN) and object storage (R2) for media files. Encrypted DM media remains encrypted even in Cloudflare's storage.
• Apple In-App Purchase (IAP) for Personal subscription payments and Sign in with Apple for authentication. Apple processes your payment; we never see your credit card or payment details.
• Google Sign in with Google for authentication. Google provides us with your name and email for account creation; no other Google data is accessed.
• Resend Transactional email delivery for account recovery, password resets, and security notifications.
• Apple Push Notification service (APNs) Delivers push notifications to your iOS device using your device token.

We do not use any analytics services, advertising networks, social media tracking pixels, or behavioral profiling tools.

9. Data Retention

• Posts retained until you delete them or until your account is deleted
• Direct messages retained until the conversation is deleted by a participant; because messages are end-to-end encrypted, we cannot access their content regardless of retention
• Profile information retained while your account is active
• Account data retained until account deletion, plus a 30-day grace period
• Company content company posts, vacancies, and channels survive the departure or account deletion of individual employees
• Identity hash retained indefinitely to enforce the one-person-one-account rule, even after account deletion
• Crash reports retained for diagnostic purposes and deleted after 90 days
• Payment records retained as required by applicable financial regulations and tax laws

10. Account Deletion

You can delete your account at any time through the app settings. When you request deletion:

• 30-day grace period your account is deactivated but not destroyed. You can cancel the deletion and restore your account at any time during this period by signing back in.
• After 30 days, the deletion becomes permanent and irreversible:
  • Your personal posts are deleted
  • Your profile information is anonymized
  • Your direct message conversations are fully deleted
  • Your follows, followers, bookmarks, reactions, and notifications are removed
  • Your waves and private list entries are deleted
• Company content survives if you were an employee of a Business account, posts you authored on behalf of the company are reassigned to the company and preserved. Vacancies you created remain open. This is because company content is a business asset that outlives personnel changes.
• Identity hash retained your identity hash remains in our system to prevent the creation of a new account by the same individual. No personal information can be derived from this hash.

11. Privacy Modes

TheVouch offers three structural privacy tiers that control your visibility on the platform:

• Spotlight your profile, posts, and content are visible to all members. You appear in search results, explore, and trending. Anyone can follow you instantly and send you a Wave.
• Exclusive your profile appears in search but your content is locked behind your approval. New followers must request access. Your posts are excluded from explore, trending, and hashtag surfaces. Reposts and shares of your content are blocked.
• Incognito you are invisible. Your profile does not appear in search, suggestions, or any discovery surface. The only way someone can find you is through your personal one-time invite link. All follows are bidirectional connections. You can only view profiles of your own connections. Profile views are not recorded when you visit others.

Post visibility is always capped by your profile mode. If you are in Exclusive mode, no individual post can exceed the visibility of your profile, regardless of the visibility you select on that post.

12. Children's Privacy

TheVouch is strictly for adults aged 18 and over. This is not a policy enforced by self-declared age; it is enforced by government-issued identity verification. No individual under 18 can present a valid government ID and pass a biometric face match. Children are structurally excluded from the platform.

If we become aware that a member is under 18, their account will be immediately terminated and all associated data deleted.

13. Data Security

We implement the following security measures to protect your data:

• Encryption in transit all communication between your device and our servers uses TLS (HTTPS)
• Encryption at rest direct messages use E2E encryption (X25519 + AES-256-GCM)
• Password hashing bcrypt with cost factor 12
• Token-based authentication RS256 JWT with short-lived access tokens (30 minutes) and longer refresh tokens (30 days)
• Two-factor authentication optional TOTP 2FA (RFC 6238) with 8 backup codes and SMS recovery
• Rate limiting per-user and per-IP rate limits to prevent abuse
• Security headers X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and strict Referrer-Policy
• Session management active device list with the ability to revoke individual sessions
• Account freeze after a password reset, configurable security cooldown (0, 24, or 72 hours)

14. Your Rights

For All Members

• Right to access you can request a copy of all data we hold about you
• Right to correction you can update your profile information at any time through the app
• Right to deletion you can delete your account at any time, subject to the 30-day grace period described in Section 10
• Right to data portability you can request an export of your data in a machine-readable format
• Right to restrict processing you can request that we limit how we use your data

GDPR (European Economic Area)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation:

• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time
• Right to lodge a complaint with your local data protection authority

Our legal basis for processing your data is: (a) contractual necessity, to provide the service you subscribed to; (b) legitimate interest, to maintain platform security and enforce community standards; and (c) legal obligation, to comply with applicable laws.

CCPA (California)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know what personal information we collect and how it is used
• Right to request deletion of your personal information
• Right to opt-out of the sale of personal information. We do not sell personal information, so there is nothing to opt out of.
• Right to non-discrimination for exercising your CCPA rights

To exercise any of these rights, contact us at legal@thevouch.io. We will respond within 30 days.

15. International Data Transfers

TheVouch operates globally. Your data may be processed in jurisdictions outside your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses where required by applicable law.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email before the changes take effect. Your continued use of TheVouch after changes take effect constitutes acceptance of the updated policy.

17. Contact

For any questions, concerns, or requests related to this Privacy Policy or your personal data:

• Email: legal@thevouch.io
• Web: thevouch.io

For GDPR-related inquiries, you may also contact our Data Protection Officer at the same email address.