Privacy Policy

When you message someone anonymously, they never see your name, your handle, your avatar or your contact details. That stays true until you choose to reveal yourself in that conversation, and revealing in one conversation does not reveal you in any other.

Messages are encrypted in transit and stored encrypted at rest, but they are not end-to-end encrypted: our systems can read message content, and do, for the safety screening described in section 4.

• Account details. Your email address, and any phone number or additional email you verify as a contact method. If you sign in with Google we receive your Google account identifier and email — not your password. If you use a passkey we store its public key and a counter, which cannot be used to sign in as you anywhere.
• Profile. Your handle, display name, avatar and bio. These are public: anyone with your profile link can see them.
• Messages and conversations. The content of what you send and receive, who the participants are, timestamps, read and delivery state, and the outcome of the safety check on each message.
• Groups and organizations. Membership, invitations you send, and the contact details you supply to invite someone.
• Credits. A ledger of credits granted, spent and refunded, and what each entry was for.
• Safety signals. Reports you file or that are filed about you, blocks, and moderator decisions.
• Technical data. IP address, device and browser information, push notification tokens, and server logs — used to keep the service running, rate-limited and free of abuse.

We do not run advertising trackers, and we do not sell personal data to anyone.

• To deliver messages, run conversations, and notify you about them by email, SMS or push.
• To create and secure your account, and to verify that a contact method is yours.
• To screen messages for safety, and to act on reports and blocks.
• To meter and settle credits.
• To debug, measure and improve the product, using the least identifying data that answers the question.
• To comply with the law, and to protect users from harm.

Where the law requires a legal basis, ours is performance of our contract with you (delivering the service), our legitimate interests (safety, abuse prevention, product improvement), your consent where you gave it (push notifications), and legal obligation.

Every message is checked by an automated safety model before it is delivered. The message text is sent to our AI provider for that check and is not used by them to train models. A message that fails is held back, and you are told why and offered a suggested edit. Held messages, and the reason they were held, are retained so that repeated abuse can be acted on.

You can ask a human to look at any decision that affected you by writing to support@veilled.com.

Only with the providers that make the service work, each processing data on our instructions:

• Cloud hosting and database providers, which store the data described above.
• Our email provider, for verification codes, message notifications and claim links.
• Our SMS provider, for verification codes and messages delivered to a phone number.
• Google, for Firebase push notifications and for Google sign-in if you use it.
• Our AI provider, for the safety check in section 4.

We also disclose data when the law compels it, and when it is necessary to investigate abuse or protect someone's safety. If we ever receive a valid legal demand to identify an anonymous sender, we may have to comply — see the callout in section 1.

These providers operate in several countries, so your data may be processed outside the country you live in, under contractual safeguards.

Sending to someone who isn't on Veilled means we deliver a claim link to the email address or phone number you supply. We store that contact detail so the recipient can claim the message, and the link expires after 14 days. The recipient still doesn't learn who you are. Only supply contact details you are entitled to use.

Messages and conversations are kept while your account exists, because both sides of a conversation have a claim on it — deleting your copy does not remove it from the other participant's inbox. Unclaimed outbound deliveries expire after 14 days. Blocks and reports are kept for as long as they serve a safety purpose. Logs are kept for a short period and then rotated out.

When you delete your account we remove your profile, contact details and credentials. Message content already delivered to another person is retained in their conversation, detached from your identity, and we keep the minimum record needed for safety and legal obligations.

• See and correct your profile and contact methods in Settings.
• Block anyone, including someone you can't name. They aren't told.
• Turn off push, email or SMS notifications in Settings; verification and safety messages still get sent.
• Request a copy of your data, or its deletion, by writing to us.
• Object to or restrict certain processing, and complain to your local data protection authority.

Account deletion is handled by request at support@veilled.com while Veilled is in its pilot release. We answer within 30 days.

We support passkeys and one-time codes rather than passwords, encrypt data in transit and at rest, and limit internal access to the people who need it for support and moderation. No service is perfectly secure, and we'll tell you promptly if a breach affects you.

Veilled is not for anyone under 16. We don't knowingly collect data from children, and we delete accounts we learn belong to one.

We'll update this page when the product changes, and change the date at the top. If a change materially affects your rights we'll tell you in the app or by email before it takes effect. Continuing to use Veilled after that means you accept the updated policy.

Your use of the service is also governed by our Terms of Service.