Privacy Policy

1. Who We Are

Veridonia is operated by Astraplex Technologies, Lda, registered in Portugal at Avenida Doutor José Grilo Evangelista, 30, 3.º Frente, 2890-007 Alcochete, Portugal. For any privacy-related questions, you can reach us at support@veridonia.com.

2. Information We Collect

2.1 Browsing Without an Account

You may browse and view content on Veridonia without creating an account. When you visit the site, our servers and firewall process your request, which includes your IP address and your browser's description of itself (its user agent). Unless you send us a bug report, we do not store personal data about visitors without an account beyond these logs, which are automatically deleted within 30 days.

2.2 Account Creation and Sign-in

You can take part in three ways:

• With an email address: we store your email address and your password in hashed form, never the password itself.
• With Google, Apple, Facebook or Reddit: we receive and store your name or display name, your email address (if the provider shares it), your profile image (if you have one, which we copy to our own storage), your ID at that provider, and the sign-in tokens it issues to us.
• As an anonymous user: we create the account without asking for an email address or password, and give it a generated username and picture.

Every account has a username and a profile picture. If you sign in with Google, Apple, Facebook or Reddit, your username starts as the name that provider shares with us, if it shares one, with a number added if another account already has it. You can change your username in Settings. Your username, picture and public contributions are visible to others.

2.3 IP Address

When you use Veridonia while signed in, we record the IP address your requests come from. Each new address is added to a list kept against your account. We also keep a separate record for each address, holding the address, its rating, and when the record was created and last changed. The rating is the lowest standing among the accounts that have used the address, deleted accounts included: when one is deleted, its standing stays on the record as a number with no link to the account. When a new account is created, we look up the address it is created from, and the rating on record sets the account's starting standing, which is never above the usual starting value. This stops someone creating many accounts from one connection and starting them all at full standing. Apart from the sessions and logs described below, we use IP addresses only for this anti-abuse purpose (see Sections 3 and 4).

2.4 Participation Data

If you participate on the platform, we store the content you submit (posts, comments, pictures) and your voting decisions, and the standing that results from them. We also store drafts of posts you have not submitted, the notifications we show you inside Veridonia, and the list of members you have blocked; these are visible only to you. If you created your account after following a link from one of our own pages, we record which page it was, so we can see which of our pages bring people in. That marker travels only in the link's address; nothing is stored on your device for it.

2.5 Sessions

Each time you sign in, including as an anonymous user, we open a session and record the IP address and the browser or device description (user agent) it was opened from. A session is renewed as you use Veridonia and stops working about a year after you last used it. Signing out deletes that session, and deleting your account deletes all of them.

2.6 Notifications

If you allow notifications in the app, the app obtains a push token for your device from Expo (an address for delivering notifications to that device) and we store it against your account, together with whether the device runs iOS or Android. The app registers a token only after you have allowed notifications. If you turn on notifications in a web browser, we store that browser's push subscription: the address of its push service and the keys used to encrypt messages to it.

2.7 Bug Reports

If you send a bug report, we store what you write, the address of the page or screen you were on, your browser or device description (user agent), your window size, the app version if you sent it from the app, and your account if you were signed in. The report is also emailed to our team, together with your username, account ID and email address (for an anonymous account, only the account ID).

2.8 Photos You Upload

Pictures you upload, whether a profile picture, a community picture or a picture in a post, are resized and re-encoded on our servers before they are stored. This removes the metadata embedded in the file, such as where the photo was taken and the camera that took it.

2.9 Technical and Security Data

Our servers and firewall log each request, including the IP address, the address requested and the browser or device description, for security, debugging and platform stability. The app also sends its version number with each request, so we can tell which versions are still in use.

3. How We Use Your Data and Legal Basis

Under the General Data Protection Regulation (GDPR), we process your data on the following legal bases:

• Account data (username, email, profile picture, password), sessions, drafts, in-app notifications and your block list: processed for contract performance (Art. 6(1)(b)) — necessary to provide you with an account and access to the platform.
• Push tokens and browser push subscriptions: processed for contract performance (Art. 6(1)(b)) — necessary to deliver the notifications you chose to allow.
• OAuth provider data: processed on the basis of your consent (Art. 6(1)(a)) — you choose to link a third-party account. You can withdraw this consent at any time by unlinking your account.
• IP address and rating inheritance: processed under legitimate interest (Art. 6(1)(f)) — anti-bot and anti-abuse protection. When you create an account, your IP address is used to assign an initial reputation rating. If previous accounts from the same IP address have low ratings, your starting rating may be lower. This is a bot-detection measure: it makes it progressively harder to create fresh accounts from the same source to manipulate the platform. Your rating immediately begins adjusting based on your own participation from your first vote onward. This mechanism is described in detail in our whitepaper.
• Participation data (posts, comments, votes): processed under legitimate interest (Art. 6(1)(f)) — necessary for the platform to function as a community-governed feed.
• Sign-up source: processed under legitimate interest (Art. 6(1)(f)) — learning which of our pages bring people in.
• Bug reports: processed under legitimate interest (Art. 6(1)(f)) — finding and fixing the problems you report.
• Technical and security data: processed under legitimate interest (Art. 6(1)(f)) — security monitoring and platform stability.

We do not sell your data, and we do not use it for advertising.

4. Automated Decision-Making

The IP-based rating inheritance described above is an automated process. It may affect your initial experience on the platform, including how frequently you can post and which voting rounds you are eligible for. Your rating adjusts based on your own actions from the first vote onward.

If you believe your initial rating was unfairly affected — for example, because you use a VPN or a shared network — you have the right to contest this. Contact us at support@veridonia.com and we will review your case.

5. Cookies and Local Storage

Veridonia uses only cookies that are strictly necessary for the platform to function:

• Session cookie: keeps you signed in on the website. It lasts up to a year and is removed when you sign out.
• Sign-in protection cookie: set for a few minutes while a sign-in with Google, Apple, Facebook or Reddit completes, to protect it against forgery.

In the app, your sign-in is kept in your device's secure storage instead of a cookie. The website also keeps a few things in your browser's local storage, such as your theme, which posts you have already opened, an unsent draft and your notification choice. They stay on your device and are not sent to us.

We do not use any analytics, tracking, or advertising cookies. Where the platform embeds third-party content (such as YouTube videos), we use privacy-enhanced modes to minimise third-party cookies.

6. Data Retention

• Account data (email, username, profile picture, password, sign-in links): retained while your account exists. Deleted at once when you delete your account in Settings, or within 7 days of a deletion request sent by email.
• Backups: data you delete, or that is deleted with your account, can remain in our encrypted backups for up to 90 days, until those backups expire, and is never restored into a live account.
• Drafts, in-app notifications, your block list and your sign-up source: deleted when your account is deleted. A picture you added to a draft you never submitted stays in our storage, but once the draft is gone nothing on Veridonia links to it.
• Sessions: deleted when you sign out on that device, and all of them when your account is deleted.
• Push tokens and browser push subscriptions: deleted when your account is deleted, and when the push service tells us the device or browser no longer accepts notifications. On the website, turning notifications off or signing out also deletes that browser's subscription.
• IP addresses: the list of addresses kept against your account is deleted when your account is deleted. The separate record for each address (the address, its rating, and when the record was created and last changed, with no link to your account) is kept, and your account's standing stays in that rating, so that deleting an account and joining again cannot reset standing. It has no fixed expiry today.
• Bug reports: kept with no fixed expiry. When your account is deleted, the link to your account is removed from the reports we store; the copy emailed to our team when you sent the report is not changed.
• Technical and security logs: retained for up to 30 days.
• Participation data (posts, comments, votes, standing history): if you delete your account, this data stays on the public record under the name "[deleted]", with no email address or name attached, to preserve the integrity of community voting records. See our Data Deletion Policy for details.

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access (Art. 15): request a copy of the personal data we hold about you.
• Rectification (Art. 16): request correction of inaccurate data.
• Erasure (Art. 17): request deletion of your data. See our Data Deletion Policy.
• Restriction (Art. 18): request that we limit how we process your data.
• Portability (Art. 20): request your data in a structured, commonly used format.
• Objection (Art. 21): object to processing based on legitimate interest, including IP-based rating inheritance. We will stop processing unless we can demonstrate compelling legitimate grounds.
• Withdrawing consent (Art. 7(3)): where we rely on your consent, you can withdraw it at any time, without affecting processing that took place before.

To exercise any of these rights, contact us at support@veridonia.com. You also have the right to lodge a complaint with the Portuguese data protection authority, the CNPD (Comissão Nacional de Proteção de Dados), at www.cnpd.pt.

8. Where Your Data Is Processed

Our servers, databases and media storage run on Amazon Web Services in Ireland (region eu-west-1), and the emails we send you go out through Amazon Web Services from the same region. Public images are delivered through Amazon CloudFront, which serves cached copies from locations nearer to you.

Some processing happens outside the European Union:

• App notifications. The text of a notification (such as a community's name and a post's title) and your device's push token pass through Expo (650 Industries, Inc., United States), which hands them to Apple Push Notification service on iPhone and iPad, or to Google's Firebase Cloud Messaging on Android.
• App updates. When the app starts, it asks Expo's update service whether a newer version of its code is available. That request carries technical details about the app, a random identifier for this installation of the app and your device's IP address, but nothing about your Veridonia account.
• Browser notifications. If you turn on notifications in a web browser, we send them through that browser's own push service (for example Google for Chrome, Mozilla for Firefox, Apple for Safari). Each notification is encrypted so that only your browser can read it.
• Social sign-in. If you sign in with Google, Apple, Facebook or Reddit, that provider processes the sign-in under its own privacy policy.
• Email. Our mailboxes, where messages you send us arrive, are hosted by Google Workspace.

Expo's terms incorporate the European Commission's Standard Contractual Clauses. Apple states that it relies on Standard Contractual Clauses, and Google's Firebase terms rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. For the other providers named above, transfers rely on each provider's standard safeguards, such as Standard Contractual Clauses.

Beyond the providers above, we disclose personal data to authorities only when the law requires it, and to report child sexual abuse material. Material we confirm as such is reported, together with the account it was posted from, to the National Center for Missing & Exploited Children (NCMEC) in the United States or the Internet Watch Foundation (IWF) in the United Kingdom, and to other authorities where the law requires, as our Child Safety Standards describe.

9. Minimum Age

Veridonia is for people aged 16 and over, and you must be at least 16 to create an account or take part. We do not knowingly collect personal data from anyone younger. If you believe someone under 16 has an account, write to support@veridonia.com and we will delete it as described in our Data Deletion Policy.

10. Changes to This Policy

This policy may be updated as Veridonia evolves. Any changes will be posted on this page with a new "Last updated" date.

11. Contact

For privacy-related questions or requests, email: support@veridonia.com