Privacy policy

1. The short version

• We do not ask for your name, your email address, or your phone number to create an account.
• Your voice is your identity, and it is biometric information. Section 4 covers it in detail.
• We do not use your voice, or anything else you give us, to train AI models.
• Deleting your account is irreversible and is not a hidden archive — section 8.

2. What we collect

Voice recordings. Your enrollment recording, your voice introduction, and any answers, messages, or vouches you record.

A voiceprint. A mathematical representation derived from your enrollment recording, used to recognize you when you sign in. See section 4.

Transcripts. Recordings are transcribed so answers can be matched and searched. Transcripts are stored with the record they belong to.

Profile answers. Intentions, values, love languages, dealbreakers, chapter/life stage, compatibility answers, boundaries, and match preferences — all of them chosen by you from lists, or spoken by you.

Identity verification results. See section 3.

Approximate location. Only if you turn location sharing on. We store coarse, rounded coordinates — neighbourhood-level, never a precise position — and use them to show approximate distance and, if you ask for it, to apply a distance filter. You can turn this off at any time, which clears the stored coordinates.

Device and usage data. An anonymous account identifier, app version, crash and error diagnostics, and coarse activity signals (for example, when you were last active) needed to run the service.

Payment data. If you buy a subscription, the app store or payment processor handles it. We do not receive or store your card number.

A waitlist email address — only before launch, and only if you give us one. While the app is unpublished, our public pages offer to tell you when it ships. If you enter an email address there we store that address, together with the referral code you arrived with if you followed an invite link. 🔴 This is the only place Veilful stores a raw email address, and it is deliberate: an anonymous product has no other way to tell somebody the thing they asked about has launched. It is optional, it is not connected to any account, and we use it for that one announcement and nothing else — no marketing list, no profiling, no sharing. We keep it for 12 months and then delete it automatically (section 7). To have it removed sooner, write to support@veilful.ai.

3. Identity verification and safety screening

3.1 What Veilful never holds

Identity verification is performed by Didit. Didit inspects your government-issued document and returns a decision to us.

🔴 Veilful stores none of the following:

• no identity document — no passport, licence, or ID card, and no image of one;
• no selfie and no facial image;
• no full name from your identity document;
• no date of birth.

Those remain with Didit. In particular, we do not store your date of birth: we read it from Didit's decision only to compute whether you are 21 or older, and then discard it.

From their decision we retain exactly two things: your birth year, and a 21-or-older flag (alongside the issuing country and verified city). That is why any age shown in the app is approximate — "~29" — because a year is genuinely all we hold.

3.2 How screening works without storing your name

Registry screening needs a name and a date of birth. We do not keep them, so each time we screen you we request those details from Didit using the verification reference we hold, use them for that one search, and discard them. They are never written to our databases and never written to our logs.

This is deliberate, and it is stronger than the alternative. Storing your name and date of birth would make screening simpler for us to operate; it would also mean holding the two pieces of information that most directly identify you, indefinitely, on our side. We chose not to.

3.3 What we store about screening

We store the verdict only — never an offense, never a matched record, never a reason, never a jurisdiction.

We do not show the detail of a possible match to other users, and we do not show it to you. Registry matching is prone to false positives on common names, and putting an unverified accusation in front of anyone — including the person it names — is worse than withholding it.

3.4 Where we operate — and what we collect in each tier

INTERIM — PENDING LEGAL REVIEW. This subsection and 3.4a were drafted in-house on 2026-08-23 and have not been reviewed by licensed counsel.

🔴 This screening covers US registries only. A person whose records are not held in a US registry returns no result, and we treat that as not covered, never as cleared.

We verify identity worldwide but screen backgrounds only in the United States, so what we collect depends on the country that issued your identity document. We determine that ourselves, from the document — it is not something you tell us.

If your document is US-issued (FULL) — everything in sections 3.1 to 3.3 applies unchanged: Didit checks the document and the selfie, we receive a pass/fail plus a small set of fields, we hold no image and no document number, and we then run the registry screening described above.

If your document is issued elsewhere (ID_ONLY) — the identity step is identical. Didit receives your government ID and a selfie, checks that the document is genuine and that the face matches, and returns us the same narrow result: the verdict, your birth year (your full date of birth is read for the 21+ check and then discarded), and the issuing country. We hold no image of your document, no image of your face, and no document number — exactly as for a US member.

🔴 We then run no background check on you at all. No registry is queried, no vendor is sent your name, and no result about you exists — so there is nothing about a background check for us to store, share, or later disclose. Where a US member has a screening verdict and a verdict date, your record simply has neither.

If we cannot read the issuing country, or your document is from a country our identity provider does not support, your verification is held rather than passed, and no account is created.

3.4a The consent record we keep for identity-only members

Before an identity-only member can continue, we show them a plain-language statement that no criminal or sex-offender background check has been run on them. When they accept it we store:

• their user ID;
• the tier they accepted (ID_ONLY);
• a version identifier for the wording;
• a SHA-256 hash of the exact text they were shown — not the text of some later revision; and
• the date and time they accepted.

We keep the hash rather than only the version so that the record proves what was on screen, not merely which revision we believe was. It contains no personal information beyond the user ID.

This record exists so we can show, later, that the member was told. It is deleted with the rest of your data when you delete your account — we do not retain it as evidence after erasure.

3.5 What "Screened" means — and what it does not

When the app shows that a member has been screened, it means exactly this:

At the time of the check, no United States public sex-offender registry record was found matching that person's full name and exact date of birth.

It does not mean:

• that the person has no record anywhere in the world — screening uses US data only, and tells us nothing about records held outside the United States;
• that the person has no record of conduct that was never registered;
• anything at all about an identity-only member. They carry no screening badge because no screening was performed. Their badge reports only that their identity was verified, and the app states in the same breath that no background check was run;
• that the person is safe, or that we have assessed their character;
• that anything has been checked since the most recent screening. Screening repeats periodically (Terms section 6.2), but a badge reports the last completed check, not continuous monitoring.

4. Your voice as biometric information (BIPA / CCPA / similar laws)

Your voiceprint is biometric information under laws including the Illinois Biometric Information Privacy Act (BIPA), the California Consumer Privacy Act as amended (CCPA/CPRA), the Texas CUBI Act, and Washington's HB 1493. We treat it accordingly.

• Purpose. We collect and use your voiceprint for one purpose: to verify that you are you, so that your account cannot be accessed by anyone else. We do not use it for advertising, profiling, or any secondary purpose.
• Consent. We collect it only after you have given a separate, explicit written consent. The Voice and Biometric Consent notice is shown to you on its own, before Voice Hello and before any recording is accepted — accepting this Privacy Policy or the Terms of Service is not, by itself, consent to biometric processing. Your acceptance is recorded on our servers before any audio is processed, and enrollment cannot proceed without it.
• Withdrawal. You may withdraw that consent at any time by deleting your voice data in Data & Privacy settings — that deletion is how withdrawal is carried out: the recordings and the voiceprint are erased, and nothing further can be processed without a new consent. Withdrawal applies going forward; after it, voice enrollment and voice-based sign-in stop working until you consent again.
• No sale, no disclosure for value. 🔴 We do not sell, lease, trade, or otherwise profit from your voiceprint or your voice recordings, and we never will.
• No AI training. 🔴 We do not use your voice to train, fine-tune, or evaluate AI models, and our agreements with our processors prohibit them from doing so with your data.
• Who processes it. Speaker recognition is performed by our biometric processor; transcription is performed by our speech-to-text processor. They act on our instructions, for these purposes only.
• Retention. We retain your voiceprint while your account is active, and destroy it when you delete your account or when the purpose is satisfied — whichever is first — and in any event no later than the deadline set by applicable biometric law.
• Security. Recordings are encrypted in transit and at rest, and access is restricted to the systems that need it.

Rights. Depending on where you live, you may have the right to know what we hold, to obtain a copy, to correct it, to delete it, to limit use of sensitive information, and not to be discriminated against for exercising any of these. Exercise them at support@veilful.ai, or use the in-app controls, which do the same thing immediately.

5. How we use what we collect

To create and secure your account; to verify your identity and run the safety screening described above; to generate and rank matches; to transcribe your answers so they can be matched; to deliver messages and calls between matched users; to detect abuse, fraud, and misuse; to provide support; and to comply with law.

We do not sell your personal information, and we do not share it with advertisers.

6. Who we share with

Service providers only, and only what they need: identity verification (Didit), registry screening (offenders.io), speaker recognition, transcription, cloud hosting and storage, error monitoring, and payment processing (through the app store).

We may disclose information where legally required, or where we believe in good faith it is necessary to prevent imminent harm.

Other users see very little. Matches see a codename, your approximate age and area, the answers you chose to share, and voice you chose to record. They do not see your legal name, your document, your date of birth, your exact location, your contact details, or your screening detail.

7. How long we keep things

8. Deactivation and deletion

One narrow exception to deletion, stated plainly. We keep the record that you accepted our Terms of Service, Privacy Policy and Voice and Biometric Consent, because that record is the evidence that we asked before we processed anything. These records are append-only: a later acceptance never overwrites an earlier one, and we cannot rewrite what a record says. When you erase your account we strip every identifier from them — your account id and your sign-in subject are removed and cannot be recovered — leaving a dated row stating that some person accepted a specific version of a specific document. It cannot be traced back to you. Nothing else about your data is exempt.

Deactivating hides your profile and stops matching. Nothing is erased, and you can come back. 🔴 A deactivated account is permanently deleted after one year, using the same irreversible process below. Reactivating resets that clock.

Deleting is immediate and irreversible. When you delete your account we erase your voice recordings, transcripts, voiceprint, profile answers, preferences, verification and screening results, coordinates, conversations, and vouches, across every system that holds them.

🔴 There is no grace period, no hidden archive, and no way for us to restore a deleted account — not for you, and not for anyone asking on your behalf. If you want the option to return, deactivate instead.

Two deliberate exceptions, both narrow:

• The other person's history. A match record is not deleted outright; instead every piece of you in it is erased. Deleting your account cannot erase the other person's record that a connection happened.
• Published success stories. If you chose to publish a story, it and the recordings you individually consented to publish persist after you leave — that is what publishing means. You can withdraw it at any time.

The pre-launch waitlist is separate from your account. An email address you gave the waitlist is held on its own, with no link to any account — which is also the reason deleting your account cannot find it and erase it. Ask us to remove it at support@veilful.ai, and we will. It deletes itself after 12 months in any case (sections 2 and 7).

9. Children

Veilful is for adults 21 and over. We do not knowingly collect information from anyone under 21. If we learn that we have, we delete it and close the account.

10. International transfers

Veilful is offered in the United States only, and we and our providers process your data in the United States. Where you are in a jurisdiction with transfer restrictions, we rely on the European Commission's Standard Contractual Clauses — together with the UK International Data Transfer Addendum where the United Kingdom applies — which our processors have entered into, alongside the technical and organisational measures described in section 11.

11. Security

Encryption in transit and at rest, restricted internal access, and monitoring. No service can promise perfect security, and we do not.

12. Changes

We will post material changes in the app or on our website before they take effect.

Questions, requests, and complaints: support@veilful.ai