Privacy Policy

Introduction

Verity ("we," "us," "our," or the "Company") operates a mobile application and related services (collectively, the "Service") that enables users to stream video recordings to their own cloud storage destinations. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your privacy. Our Service is designed with a privacy-first architecture that minimizes data collection and ensures you maintain control over your recordings and personal information.

Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy.

Our Privacy Principles

Before detailing our practices, we want to be clear about our core privacy commitments:

1. We never store your video recordings. Your video content is streamed directly to storage destinations that you own and control. Video data passes through our relay infrastructure in RAM only—never written to disk, swap files, or cache. A physical seizure of our servers would yield zero video data.
2. We never store your storage credentials. Your cloud storage credentials are encrypted in transit and held only in RAM (volatile memory) during active upload sessions. They are never written to any database, log file, disk cache, or persistent storage medium.
3. We collect minimal data. We collect only what is necessary to provide the Service, maintain security, and improve functionality.
4. You own your data. Your recordings belong to you. We have no access to, ownership of, or rights to your video content.

Information We Collect

Information You Provide

Session Metadata

When you initiate a recording session, we collect:

• Session start time and end time
• Number of video chunks transmitted
• Destination types used (e.g., "S3," "B2," "GCS," "Google Drive," "Dropbox"—but not bucket names, folder paths, or credentials)
• Session status (active, completed, incomplete)

Attestation Data

To provide chain of custody verification, we collect and store:

• Cryptographic hashes (SHA-256) of video chunks
• Hash chain linkages (each chunk's hash linked to the previous)
• Timestamps of when chunks were received by our relay
• Sequence numbers
• Relay digital signatures

Important: Attestation data contains only cryptographic hashes, not video content. A hash is a one-way mathematical fingerprint—it is impossible to reconstruct video content from a hash.

Information We Do NOT Collect

We want to be explicit about what we do not collect or store:

• Video content — Your recordings never touch our persistent storage
• Audio content — Same as above
• Storage credentials — Your AWS keys, Backblaze keys, OAuth tokens, etc. are never stored on our servers
• Storage bucket names or paths — We don't record where your videos are stored
• GPS/location data — If you enable location tagging, this data goes only to your storage, not ours
• Contacts or address book
• Photos or camera roll (beyond active recording sessions)
• Email addresses — We don't collect them
• Names — We don't collect them

Information Collected Automatically

Device and Usage Information

When you use the Service, we may automatically collect:

• Device type and operating system version
• App version
• General usage statistics (using our own first-party telemetry, not third-party analytics)
• Crash reports and error logs (processed through Sentry for stability analysis)

Network Information

• IP address (hashed with a daily-rotating salt and retained for up to 24 hours for rate limiting, then permanently deleted—we cannot "un-hash" these to identify you later)
• General geographic region derived from IP (country/state level, not precise location)

We do NOT use this information for advertising, profiling, or tracking across other services.

Sub-processors

We believe in transparency about who handles your data:

• Cloudflare — Edge network, relay hosting, database
• Sentry — Error monitoring and crash reporting
• Stripe, Inc. — Payment processing for donations (card details are processed directly by Stripe, never stored by Verity)

We do not use third-party analytics services (such as Google Analytics or Mixpanel). Our usage telemetry is collected using first-party infrastructure only.

How We Use Your Information

We use the limited information we collect for:

To Provide the Service

• Route your video streams to your designated storage destinations
• Generate attestation records for chain of custody verification
• Provide session history and status information

To Maintain Security

• Detect and prevent fraud, abuse, and unauthorized access
• Monitor for service disruptions and attacks
• Enforce our Terms of Service

We will never use your information to:

• Sell to third parties
• Build advertising profiles
• Target you with ads
• Share with data brokers

Data Retention

Video content and storage credentials are never retained as they are never stored.

Data Sharing and Disclosure

We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We have never done so and never will.

Legal Requirements

We may disclose your information if required to do so by law. However, because we do not store video content or storage credentials, we cannot produce these items in response to legal requests. We can only provide:

• Session metadata (timestamps, chunk counts)
• Attestation records (hashes, not content)

Data Security

We implement appropriate technical and organizational measures:

• Encryption in Transit: All data transmitted uses TLS 1.3
• Credential Encryption: API credentials are encrypted using AES-256-GCM
• OAuth Security: For Google Drive and Dropbox, we use OAuth 2.0 with PKCE—your password is never shared with us
• No Persistent Storage of Sensitive Data: Video content and credentials are never written to disk
• Secure Key Management: Encryption keys are stored securely

OAuth Transparency

When you connect Google Drive or Dropbox, we request only the minimum permissions needed:

• Google Drive: drive.file (access only files we create) and drive.metadata.readonly (browse folders for selection)
• Dropbox: files.content.write, files.content.read, and files.metadata.read

We cannot access your other files, delete files, or share files. You can revoke access at any time through your Google or Dropbox account settings.

Your Rights

Because we collect minimal data, many traditional privacy rights are already satisfied by our architecture:

• Right to access: You can view your session history in the app
• Right to deletion: Rate limit data auto-deletes after 24 hours. For attestation records (which contain no PII), contact us
• Right to portability: Attestation records can be exported as JSON

Children's Privacy

The Service is not intended for children under the age of 18. We do not knowingly collect personal information from children under 18.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

Transparency and Security

No Backdoors

We have not built any backdoors into the Service. Our relay architecture processes video data in RAM only—there is no mechanism to intercept, copy, or store video streams.

Warrant Canary

As of this policy's last update:

• We have not received any National Security Letters or FISA orders
• We have not been subject to any gag order
• We have not been required to build any backdoors or surveillance capabilities

If this section is removed in future versions, users should draw their own conclusions.

Legal Basis for Processing (GDPR)

For users in the EU, UK, or Switzerland:

• Service provision: Performance of contract (Terms of Service)
• Attestation/chain of custody: Legitimate interests (evidence integrity)
• Rate limiting: Legitimate interests (abuse prevention)
• Crash reporting: Legitimate interests (stability)

International Data Transfers

Our servers are located in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we protect your data during international transfers through:

• Standard Contractual Clauses (SCCs): We have executed SCCs approved by the European Commission with our sub-processors (Cloudflare, Sentry)
• Data Processing Agreements: All sub-processors are bound by contractual obligations to maintain confidentiality and implement appropriate security measures

You may request a copy of the transfer safeguards we use by contacting dpo@myverity.app.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, our business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (such as legal retention requirements).
• Right to Opt-Out of Sale: We do not sell personal information. We have never sold personal information and never will.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California privacy rights, contact us at privacy@myverity.app.

Data Deletion Requests

You may request deletion of your data through the following methods:

• In-app: Use the "Delete My Data" feature in the app settings
• Email: Send a request to privacy@myverity.app with your session IDs

What Gets Deleted

• Session metadata (timestamps, chunk counts, status)
• Attestation records associated with your sessions
• Rate limiting data (hashed IPs, device IDs) — auto-deletes within 24 hours regardless

What We Cannot Delete

• Your video recordings: We do not have them. Videos are stored in your own cloud storage, which only you control.
• Your storage credentials: We never store them, so there is nothing to delete.

Verification Process

For email requests, we will verify your identity by asking you to provide session IDs from your app. Because we do not collect email addresses or personal information, session IDs are the only way to identify which data belongs to you. Deletion requests are processed within 30 days.

Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Verity
A Texas Limited Liability Company
Email: privacy@myverity.app
GDPR inquiries: dpo@myverity.app

Summary of Key Points