Privacy policy
What the Verfy web app stores about you, why, and how to have it removed. Last updated 15 October 2026.
What we store
- Account
- Your email address and the sign-in data Supabase Auth keeps for it. If you sign in with Google or GitHub, Supabase also receives your name and profile picture from that provider. Passwords are handled by Supabase Auth; Verfy never sees or stores them.
- Organizations
- The organizations you create or join, your role in them, and invitations sent by email address.
- Devices
- For each enrolled device: its name, platform and public key. Device tokens are stored only as SHA-256 hashes.
- Receipts
- The receipts your devices upload: which tool was called, by which agent, when, the verdict and the rules that fired. Arguments and results are stored as hashes unless a device is configured to include redacted arguments.
- Audit log
- Who changed what in an organization and when (policies, locks, members, devices, exports).
- Rate limiting
- A salted hash of your IP address, kept briefly in counters that slow down repeated sign-in attempts and abuse. The IP address itself is not stored.
The Verfy CLI runs on your machine. It keeps its receipts and policy locally and sends nothing anywhere unless you enroll it in a team and run verfy sync.
How we use it
Only to run the service: to sign you in, to show your organization its own policies, devices and receipts, and to protect the service from abuse. We do not sell data, show ads or use analytics trackers. Cookies are limited to the sign-in session, your theme choice and the organization you last opened.
Who processes it
Supabase hosts the database, authentication and file storage. Vercel hosts the web app. If you choose to sign in with Google or GitHub, that provider confirms your identity. Each of them processes data under its own privacy terms.
Access and deletion
Write to anvarbekovjavohir277@gmail.com from the address on your account to get a copy of your data or to have your account deleted. Receipts and audit entries are append-only records that belong to the organization they were made in; an organization owner can ask for the whole organization to be deleted.