Verify privacy policy

Updated 03/10/2026.

Controller and contact

Data controller: Andi Arapi, P.IVA 04801720279. Contact for privacy matters: andi.arapi@devox.it. Verify helps you check phone numbers, emails and links against community reports and public sources, analyse voice messages on your phone and read the declared provenance of images.

What you check

The number, email or link you check is sent to our server to produce the result. It is compared as a keyed fingerprint (HMAC) with reports, public lists and official alerts, it is not stored and it is never written to logs.

Your number

If you add your phone number, it stays on your phone and is checked like any other check once a day (or when you tap “Check now”) (on Android you pick it from your SIM, no permission needed). It is not stored on our server.

Reports

If you report something, we keep the reported value and your description encrypted (AES-256), with a random identifier of the app, which the server keeps only in pseudonymised form (HMAC), to protect other people. To limit abuse the app may attach a device attestation (Apple App Attest or Google Play Integrity): it says the request comes from a genuine copy of the app, not who you are. Reports are moderated; the description stays encrypted, only moderators read it and it is never shown in the app. Anyone concerned can object at /opposizione.

Audio

Audio is analysed only on your phone and is never sent to our server: we neither receive nor keep it. To look for phrases typical of scams the audio is transcribed on your phone; if your phone has no built-in speech recognition, no transcription is made: the audio goes through no external service. No third-party artificial intelligence service receives the audio or what you check. Only the numbers and links found in what is said reach our server, like any other check.

Images

When you check where an image comes from, the image and its content credentials (C2PA) are read and verified on your phone: they never leave it and the result is not kept.

Optional account

Verify is used without an account: accounts are not active today and we collect no email or sign-in credentials. If they are turned on, this policy will first say which data they keep and with which provider.

Usage statistics

Only if you allow it (in Settings, or in your account): the type and outcome of a check, never what you checked, with an identifier that changes every day. We also record how long ago you installed the app (in ranges: same day, next day, 2-7 days, 8-30 days, later) and, at the first opening, where the installation came from (store, campaign): never who you are. Kept 13 months, then only daily totals.

On your phone only

Your check history, your training progress and your preferences stay on your phone. For training we only receive anonymous counters (exercise and whether the answer was right), without any identifier. Training notifications are local: no push token is sent to us.

Advertising

The free version shows ads from Google AdMob, only after your choice in Google's consent form (User Messaging Platform, EU/UK). If you refuse personalisation you see non-personalised ads; on iPhone tracking is used only if you allow it. Google may process device identifiers, IP address and ad interactions, also in the United States: for these transfers Google participates in the EU-U.S. Data Privacy Framework and uses the European Commission's standard contractual clauses. See how Google uses information from sites or apps. Premium removes all ads; payments and subscriptions are handled by Apple or Google, we receive no payment data.

Calls (Android)

If you enable call protection, the number of an incoming call is sent to our server only to show the result; it is not stored.

Caller identification (iPhone)

If you turn it on in iPhone settings, the app downloads once a day a list of numbers reported by several people or listed in our Alerts, and iPhone shows a label when one of them calls. We never receive or see your calls.

Providers and transfers

We don't store your IP address as such: to limit abuse we keep a non-reversible fingerprint of it (HMAC) for 2 days, with reports for 90 days and, for staff logins, for 24 months. The server runs on Vercel (Frankfurt region, EU) and the database is Neon PostgreSQL in Frankfurt (EU). Vercel and Neon are US-based companies: any access from outside the EU is covered by appropriate safeguards (the EU-U.S. Data Privacy Framework where the provider participates, or standard contractual clauses). Other recipients: Google (ads and consent), Apple and Google (purchases and device attestation). Providers process data on our behalf under a data processing agreement (DPA) or as independent controllers under their own policies.

Checks and reports: providing the service you request and our legitimate interest in protecting people from scams. Account: the service you request. Personalised ads, usage statistics and emails with news: your consent, which you can withdraw at any time. Reports are kept while relevant; technical errors 90 days; the security log of operations 24 months; everything else as described above.

Your rights

You can ask for access, rectification, erasure, restriction, portability and objection by writing to andi.arapi@devox.it, and lodge a complaint with the Italian Garante per la protezione dei dati personali or the data protection authority of your country. With an account you can download or delete your data directly from the app. We answer within one month.

Minimum age

Verify is not intended for children under 14. If a child under 14 has sent us data, write to us and we will delete it.