Verafy Privacy Policy

Effective date: 2026-09-14 App: Verafy+Anchor for Android and iOS (identifier com.dejify.verafy), and BeyondAfrica for Android and iOS (identifier com.dejify.verafy.beyondafrica), which runs on the Verafy platform Controller: Verafy Contact: privacy@verafy.me · support@verafy.me

This policy describes the personal information Verafy collects, why we collect it, how we share it, and the rights you have over it.

1. What Verafy is

Verafy is a Bluetooth-Low-Energy (BLE) proximity social-discovery app. Discovery, matching, and chat work primarily over BLE between phones in physical range. An internet connection is used only for account login, profile sync, support, and in-app purchases.

2. Information we collect

2.1 Information you provide

• Account identifiers: email address and/or phone number used to receive a one-time verification code (OTP).
• Profile information: display name, optional photo, age range, intent (e.g. "professional networking"), interests, energy level, and optional contextual focus tags.
• Optional contact information: email and/or phone number you explicitly choose to share with a matched user.
• Support content: messages you send through Support → Contact Us or the in-app myVera assistant.

2.2 Information collected automatically

• Device + diagnostic metadata: Android or iOS version, app version, build number, locale, and crash diagnostics (errors and warnings only — never the full console log).
• Bluetooth scanning telemetry: anonymous identifiers and signal strength used by the on-device matching engine.
• Approximate / precise location: required by Android as a precondition for BLE scanning on some OS versions. Verafy does not store, transmit, or log your GPS coordinates. On iOS the app requests no location permission at all — Apple’s CoreBluetooth does not require one to scan, so the permission is not declared in the iOS build.

2.3 Information from third-party services

• Resend delivers your OTP email. Resend processes only your email address.
• Twilio Verify delivers your OTP SMS. Twilio processes only your phone number.

3. How we use information

4. How we share information

We do not sell or rent your personal information. We do not share mobile information with third parties or affiliates for marketing or promotional purposes. Mobile numbers are used only to deliver the messages described in this policy, and are shared only with the messaging provider that delivers them on our written instructions. We share information only with service providers acting on our written instructions:

• Resend — transactional email (OTP).
• Twilio — transactional SMS (one-time sign-in codes) and, where you have opted in, Verafy Announcements.
• OpenAI — myVera assistant. Prompts are sanitized and contain no account identifiers or contact details.
• Digital Ocean — hosting of the verafy.me API and database.

We may disclose information when required by law or to protect the rights, safety, or property of Verafy, its users, or the public.

4.1 Verafy Announcements messaging

Verafy Announcements are recurring informational and service-related messages about the Service. They are off by default and are sent only if you turn the Verafy announcements switch on in the app, under Profile → Notifications. Message frequency varies. Message and data rates may apply. Reply STOP to opt out and HELP for help. Consent is not a condition of purchase, and turning Verafy Announcements off does not affect any other part of Verafy. Full messaging terms are in the Terms & Conditions, section 7.

5. BLE and on-device processing

Matching ("resonance") is computed entirely on your device. Profile data is never sent to a server during matching. Identifiers broadcast over Bluetooth are hashed/derived values — your name, email, and phone number are never advertised over the air.

5.1 Anchor (event mode)

Anchor lets an event organiser broadcast event information to attendees nearby. Attendees receive it over Bluetooth and can read it with no network connection; the event details and the organiser’s signature are verified on your device.

• Attendees: receiving an Anchor broadcast does not send anything about you to us. Nothing you receive over Bluetooth is reported back to our servers.
• Organisers: events and the advertisements shown inside them are stored on our servers so they can be managed and re-broadcast.
• Connections: when two people connect, we store a record of the pairing (the two account identifiers, its status, an affinity score and timestamps). We do not store where the connection happened.

6. Children

You must be at least 13 years old to use Verafy. We ask for your date of birth when you create an account, solely to apply these age rules; it is not shown to anyone and is not used for matching. We do not knowingly collect data from children under 13, and an account that gives a date of birth under 13 is refused. If you believe a child under 13 has used Verafy, contact privacy@verafy.me and we will delete the account.

Accounts aged 13 to 17 have restricted access: romantic and dating connection modes are turned off, and sharing an email address or phone number with other users is turned off.

7. Your rights

You can at any time: - Access your profile from inside the app. - Correct your profile from inside the app. - Delete your account and all associated data — see https://verafy.me/delete-account or Profile → Settings → Delete Account. - Withdraw consent to optional features by toggling them off in Settings. - Lodge a complaint with your local data-protection authority.

Requests covered by GDPR, UK GDPR, CCPA / CPRA, and similar regimes can be sent to privacy@verafy.me. We respond within 30 days.

8. Retention

Deleting your account removes profile data, chats you originated, and Vera-token balance within 30 days from our primary systems and within 90 days from encrypted off-site backups.

9. Security

• All traffic between the app and verafy.me is HTTPS (TLS 1.2+).
• The Android Network Security Config denies cleartext traffic app-wide. On iOS, App Transport Security is enforced (NSAllowsArbitraryLoads is false), which blocks cleartext connections equivalently.
• BLE bridge classes are listed in ProGuard -keep rules; the rest of the app is R8-minified.
• Passwords are never used — login is always OTP.

No system is perfectly secure. If you discover a vulnerability, please contact security@verafy.me.

10. International transfers

Verafy operates infrastructure in the United States. By using Verafy you acknowledge that your information may be processed there under appropriate safeguards.

11. Changes to this policy

Material changes will be announced in-app at least 30 days before they take effect. The "Effective date" at the top of this page always reflects the current version.

12. Contact