LEGAL

Privacy Policy — Verifyco Web

Last updated: October 2026

The short version

Your uploaded files are processed in a per-request temporary workspace. Application cleanup removes temporary media after a completed or handled-failure request; the analysis service's ephemeral filesystem is not used as a media library. We retain the report and the minimum account, billing and operational records described below. We never train models on your uploads and never sell data.

What we store

• Account data: email, name, sign-in provider, hashed password (if set).
• Analysis reports: the JSON verdict and layer findings — never the media itself. Reports remain in your account until you delete them or delete your account.
• Billing records: plan, credits and transaction references. Payments are processed by Paddle (merchant of record) — we never see card numbers.
• Service operations: bounded delivery and error events used to diagnose reliability. These can contain internal account, analysis or transaction identifiers, but never uploaded media. Mail telemetry records delivery status without the recipient address.

What we don't do

• No application-level persistent storage of uploaded or link-fetched media; request cleanup removes temporary media on completion and handled-error paths.
• No training on user content and no sale of personal data for advertising. Limited service processors are listed below.
• No third-party advertising or cross-site tracking on this site.

Shared reports

Sharing is strictly opt-in. A share link exposes only the score, verdict and per-layer statuses of that one report; detailed findings and your identity are never included. Revoking the link (or deleting the report) blocks future access through Verifyco. Screenshots, downloaded copies and third-party cached previews may remain outside Verifyco's control.

Link analysis

When you paste a social-media URL, Verifyco sends that public URL to the services needed to build a preview and retrieve the media. We use official platform oEmbed endpoints where available; X preview metadata may use FXTwitter, Instagram extraction may use Apify, and TikTok resolution may use TikWM. The supported platform and its media CDN also receive ordinary network request information. Retrieved media follows the same temporary-processing contract as direct uploads. A preview alone does not reserve or consume an analysis credit.

Provider provenance checks

Where this check is enabled, images submitted for analysis (uploads and link-fetched images in PNG, JPEG or WebP) are sent to OpenAI's Content Provenance API, which checks them for OpenAI's own provenance signals (Content Credentials it issued and its SynthID watermark). Images whose trusted Content Credentials already declare AI generation are not sent, videos are never sent, and the file name is not sent. OpenAI states that files submitted to this API are not stored or used for training. Our server deletes the image itself right after the analysis, as for any other file; to avoid checking the same image twice, it may keep a one-way fingerprint (hash) of the image together with OpenAI's answer for up to 24 hours. OpenAI's answer is also saved in your report.

Your rights (GDPR / KVKK)

Access, correction and erasure are self-serve: change your email/password in account settings, delete individual reports, or delete your entire account — which permanently cascades to reports, purchases and the credit ledger. For anything else, contact us at support@verifyco.app.

Processors we rely on

Vercel (web hosting), Neon (database), Render (analysis compute), Paddle (payments), RevenueCat (App Store subscription status, keyed by your Apple user identifier, when you sign in with Apple), Google Workspace (transactional email), Apify (Instagram extraction when required), TikWM (TikTok resolution), FXTwitter (X preview fallback), OpenAI, L.L.C. (Content Provenance API: images submitted for analysis that do not already carry a trusted Content Credential declaring AI generation are checked for OpenAI's own provenance signals; OpenAI states that files are not stored or used for training), and supported platforms' public metadata/media endpoints. If you choose social sign-in, that provider (such as Apple, Google, GitHub or X) processes the authentication request. Each service receives only the information needed for that role.