Privacy policy
The short version: Verifyd checks the pictures and pages you look at so it can badge them. It sends those pictures and page addresses to our servers, keeps a fingerprint of each picture and the public page it appeared on, and nothing else about you. We never sell data, never use it for advertising, and never build a profile of you.
Who we are
Verifyd ("Verifyd") is run by Planckchron Inc., a Delaware corporation based in Los Angeles, California ("we", "us"). Contact us about privacy at privacy@planckchron.com.
What the browser extension sends
Nothing is sent until you agree on the welcome screen after installing. After that:
| Data | When | Why |
|---|---|---|
| Videos on the pages you view: the page address and the video's address, to match them against checked speeches | As a video scrolls into view | To show the speech's stamp, and change it as checked claims are spoken |
| Pictures on the pages you view (larger than an icon), or their web address if the picture is too large to send | As each picture scrolls into view | To read its Content Credentials and metadata, fingerprint it, and optionally run an AI-image detector |
| The address of the page the picture is on | With each picture | To tell whether the same picture appeared earlier on another site |
| The address of a news article. If the site turns our server away, the article's text, title, date and section as your browser shows them | When you open a page that looks like an article | To check whether the site imitates a known outlet, to look up published fact-checks of its headline and of the claims the article states, and to label it (old story, opinion, government-owned outlet, corrected). Text you send is used only for your answer and is kept up to 12 hours in the check cache, never shown to anyone else |
| Text you select and choose to fact-check | Only when you ask | To look up fact-checks and sources |
| In the Verifyd app for iPhone, iPad and Mac: a link, headline, post or claim you paste, a photo you choose or take, or anything you share to Verifyd from another app or hand to "Check with Verifyd" in Siri or Shortcuts | Only when you tap Check, choose or take a photo, share something to Verifyd, or run the shortcut | To look up fact-checks, check the site and read the photo's credentials and history. A photo is fingerprinted like any other picture; the photo itself is not kept. The app notices whether something is on your clipboard but reads it only when you tap Paste or Check it. Your last six checks are kept on your device only, and you can clear them |
| The text of public posts in social feeds (X, Facebook, Threads, Reddit, LinkedIn, Bluesky), never messages or private pages | As a post scrolls into view, if "Check posts in social feeds" is on (you can turn it off in Settings) | To look up published fact-checks of the same claim; only rated posts get a stamp. The text is not stored beyond a 30-day cache of the result |
| On YouTube, the caption text shown on your screen and the video's address, only while you watch with captions (CC) on | In pieces, at most every 30 seconds, if "Check what is said in videos" is on | To decide whether the video is a speech, interview, debate or news segment and, if so, to look up published fact-checks of what is said. Captions of videos that are not speeches are deleted within 7 days. A caption line is used only once two different viewers have seen it; to tell viewers apart we keep a short one-way code made from a salted hash of the IP address, deleted 7 days after the video was last watched. Captions of speeches are published with the checked speech, without any record of who watched |
| If you turn on Family Shield and enter a family code: the name of a site Verifyd warned you about (FAKE SITE or LOOK-ALIKE), the warning, and the device name you chose | Only when such a warning is shown, at most once a day per site | So your family sees the warning on its family page (and by email, if the family set one). Nothing else you browse is sent. Kept 30 days on the family page; remove the code in Settings to stop |
| The address of a transcript page you open (remarks, floor speeches, press conferences, interviews) | When a page looks like a transcript | Verifyd reads the public page itself and checks what was said. If the site turns our server away, the page's text as your browser shows it is sent instead, and is used only when another viewer sent exactly the same text. The checked speech is published without any record of who opened it |
The extension does not run, and sends nothing, on webmail, chat, document, cloud-storage, account, checkout and dashboard pages, or on any page with a password or card-number field. You can pause it on any other site from the toolbar button, or turn it off entirely in Settings.
The extension does not read or send your browsing history, cookies, form contents, or anything that identifies you. It keeps your settings in your browser's synced extension storage.
What we keep
- Picture fingerprints and sightings. A 64-bit perceptual fingerprint of each picture, plus the public web address of the page (and of the picture) where it was seen, without query strings or fragments, and when it was first and last seen. Addresses of private pages, as described above, are never stored. We do not keep the pictures themselves. Sightings are shown to other people as "first appeared on…", which is why only public pages are kept. Kept until a picture has not been seen for 24 months.
- Verdict cache. The result of each check, so the same picture or link is not checked twice. Deleted after 30 days.
- Rate-limit counters. A salted one-way hash of your IP address and a count, per minute, to stop abuse. We never store the IP address itself. Deleted after one day.
- API keys (businesses only). A one-way hash of the key, the name and email it was issued to, and daily usage counts. For paid plans, also the Stripe customer and subscription references and the plan, so a key can be turned off when its subscription ends.
- Reports of a wrong result. What was checked, the word Verifyd gave, what you wrote, and your email only if you chose to give it. Read by a person; a confirmed mistake becomes a test case (without your email). Kept up to 24 months.
- Business history (API keys only). Each check made with a business's key: when, which kind of check, what was checked (a link or the claim's words) and the word given, shown only to that business in its account. Kept 365 days. Checks by readers without a key are not kept this way.
- Brand watches (businesses only). The domains and names a business asks Verifyd to watch, where to send alerts, and the alerts found (look-alike domains and published fact-checks). Kept while the watch is active and 12 months after.
- Evidence reports. When you share a result or ask for its evidence report, the result, its reasons and sources, the method version and a fingerprint are kept at a public address so the record can be checked later. A shared picture is kept as a small preview. Kept until you ask us to remove it.
- Free domain scans. The domain scanned and its result (the look-alikes found), kept 24 hours so a repeat scan is instant. Nothing about who scanned it.
- Family Shield. A family's name, code, optional email, and its warnings from the last 30 days.
- Ask Verifyd conversations. Not kept. Your questions and the answers stay in your browser tab and are sent to our servers only to answer the next question; closing the tab or starting a new chat forgets them. Checks the assistant runs are cached like any other check (above). A picture you attach is checked by Verifyd and, if it is a JPEG, PNG, WebP or GIF, also shown to the AI so it can describe it or read text in it; it is not stored. Pages the assistant reads for you are fetched by Verifyd's servers, and web searches are run by Anthropic. Two things are kept only if you choose them: Share saves that question and answer at a link anyone with the link can open (ask us to remove one), and a thumbs-down report sends that question and answer, with any note or email you add, to a person at Verifyd who reviews mistakes. A thumbs-up, and how many questions are asked each day, are counted without any content.
- Server logs. Our hosting provider keeps standard request logs for a short period for security and debugging.
Who else processes data
We use these service providers, only to provide Verifyd:
| Provider | What they receive | When |
|---|---|---|
| Vercel (hosting) | All requests to our servers | Always |
| Supabase (database) | The data we keep, listed above | Always |
| Stripe (payments) | Name, email and card details you enter on Stripe's checkout page; we never see card details | Only when a business buys a paid API plan |
| Google Cloud Vision | A picture | Only when you click "Find the original" on a picture with no known source |
| An AI-image detection service (Sightengine) | A picture | Only if enabled on our servers, for pictures with no Content Credentials |
| Google Fact Check Tools | The text of a claim, a headline, or a claim extracted from a speech | When a claim, article or speech is checked |
| Deepgram (speech to text) | A recording uploaded to the speech desk | Only when a speech is added without captions, and only if transcription is enabled on our servers |
| Anthropic (Claude) | The transcript or captions of a speech, to tell whether it is spoken remarks and to list the checkable factual claims in it; it does not judge them | When a speech is added, or captions or a transcript page arrive from the extension |
| Anthropic (Claude) | Your questions in Ask Verifyd, the earlier messages of that conversation, an attached picture, the text of pages it reads for you, and the results of the checks it runs; its web searches | When you use Ask Verifyd |
| Anthropic (Claude, including its web search) and Brave Search | The text of a claim or headline, the fact-checks found for it, and public pages found for it | When a claim is matched to fact-checks, when no fact-check exists and established sources are searched, or when the real version of an impostor article is looked up |
We do not sell or rent data, share it for advertising, or allow it to be used to determine creditworthiness or for lending. We may disclose information if the law requires it.
Speeches and videos
Campaigns, newsrooms and platforms with an API key can add a public speech or video. We keep the recording (if uploaded to us), its transcript, the claims found in it with the published fact-checks that match, and the addresses where the speech is posted, and we publish these on a public page. Verifyd does not rate political claims itself: TRUTH and FALSE come only from the published ratings of named fact-checkers, linked on every stamp, and the same rules apply to every speaker. A video the extension meets on a page is matched against checked speeches by address or by frame fingerprints; the video itself is only sent to us when it is a direct media file, and is never kept.
Chrome Web Store limited use
The use of information received from Google APIs and from the Chrome extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide and improve Verifyd's single purpose: showing authenticity badges and taking you to original sources.
The website and API
The website uses no analytics, advertising or tracking cookies. When you check something on the website, the same processing described above applies. Businesses using the API send pictures, links and claims under their own privacy terms with their users; we process them as described here.
Your choices and rights
- Withdraw consent: untick it in the extension's Settings, or uninstall the extension. Nothing more is sent.
- Ask us to delete sightings of a picture or page: email us with the page address.
- Depending on where you live (for example California, the EU or the UK), you may have rights to access, correct, delete or object to processing of personal data, and to complain to a regulator. We do not knowingly hold data that identifies you, but we will answer any request at the address above.
Security
All traffic is encrypted with HTTPS. Servers refuse to fetch addresses on private networks. API keys are stored only as hashes.
Children
Verifyd is not directed at children under 13, and we do not knowingly collect personal information from them.
Changes
If we change what is collected, we will update this page and the effective date, and ask for consent again in the extension before sending anything new.