Privacy Policy

1. INTRODUCTION

VOM ("we", "our", or "the platform") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect information when you use our intelligence verification platform, accessible at this domain and any associated subdomain.

By using VOM, you accept the collection and use of information in accordance with this policy. If you do not agree, please stop using the platform.

2. INFORMATION WE COLLECT

2.1 Information you provide directly:

— Email address (when you create an account) — If you continue with Google: the name, profile photo and Google account identifier Google shares (Section 7) — Password (stored encrypted via secure authentication) — Verification queries you submit to the platform — A profile photo, if you choose to upload one (optional) — A home location, if you choose to save one (optional): the city, region, and country you pick, together with their coordinates, which we use for the Local feed and the weather on your profile

2.2 Information collected automatically:

— Browser language preference (used for interface localization) — A pseudonymous visitor cookie required to enforce anonymous usage limits — IP address processed for security and usage limits; it is not stored in event records — Operational event records that do not identify you: the event type and time, the page, the language, the device category (mobile, tablet, or desktop), the approximate country, and where the visit came from, reduced to the referring site's domain (or, if you came from a VOM page, to that page and its campaign tags) — For each verification: the approximate country, region, and city our network infers, the device category, and the page it was sent from

These operational records are kept whether or not you accept analytics, without your visitor-cookie, account, or session identifier. If you choose “Accept all,” we also attach to your events the visitor-cookie identifier, your account identifier (when you are signed in), and a temporary per-tab session identifier, and we collect optional product analytics: feed interactions such as card impressions, publisher opens, source clicks, and verification requests. If you choose “Essential only” or have not chosen yet, each event is counted without any of those identifiers and without details that could identify you, such as conversation or message identifiers. Event records never hold your email address, your IP address, the full user-agent string, your region, or your city.

The questions and claims you type are recorded as service data without any visitor, account, or session identifier, whether or not you accept analytics, and they are never linked to analytics identifiers. Their text is deleted from those records within 30 days. This does not affect the history you keep in your account, described in Section 6.

2.3 Information we do NOT collect:

— Your name (unless you continue with Google; Section 7), phone number, or physical address — Payment information (processed entirely by external providers) — Advertising identifiers or cross-site tracking cookies — Social media profiles or third-party account data, other than what Google shares when you choose it (Section 7)

3. HOW WE USE YOUR INFORMATION

We use the collected information to:

— Provide and operate the verification platform — Authenticate your account and maintain session security — Enforce usage limits and prevent abuse — Store your verification history for your personal reference — Improve the accuracy and performance of our systems — Communicate service updates or security notices (by email only)

Optional analytics are used only for aggregate statistics and to improve the feed and product experience. We do not create named browsing histories, use this data for advertising, or sell it to third parties. We do not use your queries to train AI models.

4. AI PROCESSING

VOM uses external AI providers, including language model and embedding services, to analyze and verify claims. Your input text is sent to these providers exclusively to process your verification request, in accordance with our data processing agreements and applicable privacy laws.

When you chat with VOM and that conversation is saved to your account, the transmission also includes a bounded number of the earlier messages in that same conversation, so VOM can follow what you are referring to. Verifying a text or an image sends only what you just entered: no history is transmitted.

The API terms these providers operate under do not allow them to use your queries to train their models. The same terms may allow them to keep your queries for a limited time, for example to prevent abuse. Today those providers are Perplexity, whose API runs models from Anthropic and OpenAI and its own web search, and Google (Gemini) while the transition lasts; each receives only what is needed to process your request, and none receives your identity.

We do not sell your queries to AI providers or any third party. Your query is used to produce the result you requested, and that result may be reused to answer other people without identifying you, as described in Section 6.

5. STORAGE AND SECURITY

Your data is stored using Supabase, a secure cloud database platform. All data is encrypted at rest and in transit using industry-standard TLS.

Authentication is managed by Supabase Auth. Passwords are hashed with bcrypt and never stored in plain text. We do not have access to your password.

Although we implement reasonable security measures, no system is completely secure. We recommend using a unique, strong password and notifying us immediately if you suspect unauthorized access to your account.

6. DATA RETENTION

We retain your account information and verification history while your account remains active. If you create an account or sign in, in the same tab, within two hours of a result, that result is saved to your account as a conversation. Until then it stays only in that tab and is not sent to us. If you ask VOM to let you know about a page or an app, we keep your email address, what you asked to follow and, for a reminder, the date you chose, only to send those messages, which Resend delivers; we delete them when you unsubscribe, 12 months after the last message, or after 7 days if you never confirm. Your answer to "did it pay?" is kept without your email. If you have a VOM account with the same e-mail address, what you follow appears in your account (“Your radar”), and you can unfollow it there. Verification results from any user, signed in or not (the verdict, the confidence, the analysis, which may quote or paraphrase the claim checked, and the sources), form a shared cache: they may be reused to answer someone else who submits the same or a very similar claim, without revealing who asked or the text they typed. The content of results from anonymous queries is deleted, and stops being reused, within 30 days; results tied to an account may be reused while the account exists and for up to 30 days after it is deleted. Answers to general questions are also stored, together with the question and without any identifier, in a shared cache that is deleted within 30 days.

After 30 days we remove from every event record any identifier it still holds (visitor cookie, account, session, and referrer), together with free text and details that could identify you, and we delete optional product-analytics events after 90 days. Events are not linked to your email address or presented as individual browsing histories.

You can ask us to delete your account at any time from your profile or by writing to legal@vom-app.com. When we delete it, we first cancel any active subscription, then erase your account, your profile (including your photo), your saved conversations, and your sign-in. Your past verifications and your events are unlinked from you: we remove your account and anything that could identify you from them, and the content of those verifications is deleted within 30 days, so a later sign-up from the same browser cannot link them back to you. Polar keeps its own billing records as merchant of record. We keep other data only where the law requires it.

7. THIRD-PARTY INFRASTRUCTURE

VOM uses the following infrastructure providers to operate:

— Supabase — provides database and authentication services. — Vercel — hosts the platform infrastructure. — Upstash Redis — provides usage-limiting services and a short-lived pseudonymous analytics delivery queue retained for up to 7 days. IP addresses used for rate control are processed by Upstash. — Polar (Polar Software, Inc.) — merchant of record for VOM Pro; processes checkout, billing and refunds. When you start a checkout, Polar receives your email address, your VOM account identifier and your IP address. Your payment details are entered on Polar's checkout and never reach VOM. — Resend — sends your account emails, such as the account-deletion confirmation; it receives your email address. — Cloudflare (Turnstile) — checks that whoever creates an account, signs in, asks for a new code or resets a password is a person and not an automated program. It loads only when you open those forms; your browser connects to Cloudflare directly, so Cloudflare receives your IP address and technical signals from your browser and device. It is not used for advertising. — Google (sign-in) — offers “Continue with Google” in the sign-in window on Android and desktop browsers. Nothing from Google loads until you press it; your browser then connects to Google directly, so Google receives your IP address and its own cookies and learns that you are signing in to VOM. If you choose Google, it shares your name, email address, profile photo and your Google account's identifier with us. VOM uses only your email address; the rest is stored with your account and deleted with it. — OpenStreetMap (Nominatim) — turns the location you type in your profile into coordinates. Your browser sends that search directly, so Nominatim also receives your IP address. — Open-Meteo — returns the weather shown on your profile; it receives the coordinates of your saved location. Our server makes that request, not your browser, so Open-Meteo does not receive your IP address. — fal.ai — generates the images you request; it receives the text of your image description and hosts the generated image, which your conversation displays from its servers. — Third-party AI services — process verification queries as described in Section 4. They operate under data processing agreements that prohibit unauthorized retention or use.

We do not sell, rent, or share your personal data with any third party for marketing or advertising purposes.

8. REFERRAL PROGRAM DATA

If you participate in the referral program, we collect and retain your personal referral code, the relationship between the referring and referred accounts, referral qualification status, creation and qualification timestamps, and the number of rewards granted.

We use this data to attribute new registrations, display program progress, determine when a referred person completes their first verification, grant promotional Pro access, and prevent fraud or abuse. The referral dashboard displays progress and reward status; it does not display the referred person's verification content.

We retain referral program data while the related accounts remain active and as reasonably necessary to administer rewards, resolve disputes, prevent abuse, and comply with legal obligations. Requests for access, correction, or deletion are handled under the retention and rights sections of this policy.

9. YOUR RIGHTS

Depending on your location, you may have the following rights:

— Access: Request a copy of the personal data we hold about you — Correction: Request correction of inaccurate personal data — Deletion: Request deletion of your personal data — Portability: Request your data in a portable format — Objection: Object to certain types of data processing

These rights apply to users in the European Union (GDPR), California (CCPA), and other jurisdictions with applicable privacy legislation.

10. COOKIES

VOM uses the minimum cookies necessary for the platform to function, listed here, and one measurement cookie described at the end of this section:

— Authentication cookies: Necessary to keep your session active — Usage-limit cookie: Necessary to enforce anonymous usage limits — Preference cookie: Records whether you accepted or declined optional analytics

Without a choice, or with “Essential only,” the visitor cookie is used to enforce usage limits but is not attached to your events, and events are recorded without identifiers. These include an anonymous count of how far each visit to the app gets: whether the page appeared, whether the suggestions were in view, the kind of the first thing you tap (for example, the text box or a suggestion), whether you opened the form to create an account or sign in and whether you submitted it, whether you pressed “Continue with Google” and whether that sign-in worked or failed (never your email address or the error text), whether you opened a news story or the news section from the home screen, whether VOM's invitation to install it was shown and where (an Android phone or a computer, an iPhone, or an app's built-in browser), whether you accepted or declined your browser's install window, whether your browser reported VOM as installed, a rough range for how long the page stayed open, and whether you sent anything. It uses no cookies and no identifier of any kind, never includes what you type, and is deleted after 90 days. All other product and performance analytics, and linking your events to the visitor cookie, your account, and a session identifier, activate only when you choose “Accept all,” except the count of returning visitors described at the end of this section. You can withdraw or change your choice at any time through “Cookie settings.” We do not use advertising cookies or cross-site tracking.

If you use VOM without an account, a cookie records only when this browser first used VOM, so we can count, with no identifier, how many visitors come back within 14 and 41 days. It is never set if you choose “Essential only,” or in the EU, EEA, UK or Switzerland unless you choose “Accept all.” It expires 45 days after your first use, and the counts are kept as weekly totals only.

11. CHILDREN'S PRIVACY

VOM is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us immediately and we will delete it without delay.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. We will notify registered users of material changes by email. The date at the top of this page reflects when it was last updated.

13. CONTACT

For privacy-related requests, questions, or concerns, contact us at legal@vom-app.com. This is the official channel for GDPR, CCPA, and LGPD rights requests. We will respond to all legitimate requests within 30 days.