Privacy Policy

Last updated: September 2026

Verikey helps you share a small amount of information, such as a photo and your general area, with people you choose, for a limited time. This policy explains what we collect, who else handles it, and how long we keep it.

What we collect

• Account details: your email, username, name, date of birth and password (stored only as a secure hash). Your email and personal details are encrypted in our database.
• What you choose to share: photos you take with the camera in Verikey, your first or full name, your age, your general area, and any label or note you write. Names and ages always come from your account.
• Location: when you choose to share your location, your device's GPS is used once. Our servers turn it into a 10-mile circle around the centre of a fixed map square (about 10 by 10 miles) that you're in, labelled with the town nearest that centre. Everyone in the same square gets the same circle and label. Your exact coordinates are never stored or shared. To preview your area before you send, your phone's own map service (Apple, on iPhone) looks up the coordinates on the device.
• Device and usage data: a push-notification token if you allow notifications, and security records (sign-ins, password and email changes, reports and similar events) that store a keyed hash of your IP address rather than the address itself.
• People you send to by email: the address you enter, encrypted, so the key can reach them. If they ask us to stop, we keep only a hash of their address so we never email it on anyone's behalf again. An address receives at most three such emails a day.

How sharing works

A verikey is visible only to the person or link you send it to, only for the number of views you set, and only until it ends or you revoke it. When you revoke a key, its photos are deleted. Photos are stored privately and are only shown through links that expire within minutes, while someone is allowed to view them. Requests go only between members and are answered in the app.

Reports and safety

If someone reports a key or request, we keep a copy of what was reported (including its photos) so our team can review it, even if it's revoked or deleted afterwards. That copy is deleted 30 days after a report is dismissed, 180 days after we act on it, or 90 days after it was filed if it hasn't been resolved by then. If you delete your account, copies from dismissed reports about you are deleted straight away. If we suspend an account, the keys it shared stop working and their photos are deleted.

What we don't do

• We don't sell your data or share it with advertisers.
• We don't show your email address to other users.
• We don't verify identity documents. Names and ages are labelled as self-reported, and we can't independently confirm when or where a photo was taken.

Service providers

These companies process data only to provide their service to us:

• Amazon Web Services: photo storage and email delivery.
• Render: our servers and database.
• Expo: push notification delivery.
• Sentry: error reports, with request contents, tokens and personal details removed before they're sent.
• Map providers: to draw the shared area on a map, the viewer's device fetches map images for that area from Apple Maps (in the app) or our map tile provider (on the web page). They see the viewer's IP address and the area being viewed, never your exact location.

Retention and deletion

• Photos from a key are deleted when it's revoked, or 30 days after it stops being viewable.
• The rest of what a key shared (name, age, area and note) is deleted 180 days after it stops being viewable. The key's label and dates stay in both people's history until they delete it.
• Notes on requests are deleted 180 days after the request closes.
• Accounts whose email was never confirmed are deleted after 7 days.
• Security records are kept for one year.
• You can delete your account in the app under Profile. That revokes your active keys, deletes your photos and the contents of every key you sent, and removes your personal details. Report copies are handled as described above.

Age

Verikey is only for people aged 18 and over.

Contact

Questions or requests: hello@verikey.app