VOUCH Privacy Notice

1. Who is responsible for your data

The data controller is Luca Pace, a private individual established in Italy ("we", "us"). Write to slope.kauri8537@eagereverest.com for anything in this notice. VOUCH is run by one person and no Data Protection Officer is appointed. We answer within one month.

This notice is given under article 13 of Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003). The Terms explain how VOUCH works; this notice explains what happens to your data. If we publish an Italian version, it prevails for users in Italy.

2. In short

• Chats are deleted shortly after their drop ends. They are not archived and cannot be recovered.
• Proofs are kept in the drop's album, with no expiry date, and only people who earned that album can see them.
• Your live position stays on your phone. The place where you take a proof is stored with it.
• No advertising, no tracking, no analytics. We never sell your data.

3. What we process, why, and on what legal basis

The app collects no email address, no contacts and no advertising identifier. The table lists everything we process.

Your phone number, name, nickname and date of birth are needed to create an account. Without them you cannot use VOUCH.

We do not use your data for advertising or profiling, and we take no automated decision that has legal or similarly significant effects on you. We may also process any of the above where necessary to comply with the law or to establish, exercise or defend legal claims (art. 6.1.c and 6.1.f).

4. Photos of you

A proof is two photos taken in sequence, one with each camera, with the place and time of capture. It is the most personal thing VOUCH holds.

• Nothing is captured until you press the shutter. You decide whether to take a proof at all.
• Who sees it. While confirmations are open, the other participants of that drop. After that, only holders of that drop's album, and only if the proof was confirmed. Proofs are never public and never shown to people who were not in the drop.
• How it is stored. In private storage with our hosting provider in the European Union, reachable only through time-limited links issued to people entitled to see it.
• How long. For as long as the album exists, which has no end date, unless the proof is removed.
• Your control. You can ask us to remove your own proof at any time, by writing to us or from the app where it offers it. It then disappears from the album for everyone. Deleting your account removes every proof photo you took.
• If you appear in someone else's proof and want it removed, write to us. We weigh your request against the interest of the other participants in their shared album and will normally remove it.
• No face recognition. We do not analyse, match or tag faces and extract no biometric data from your photos.
• Other people in your photo are your responsibility. Do not photograph someone who does not want to be in the album.
• What other users do with what they are entitled to see, such as taking a screenshot, is outside our control. The Terms prohibit sharing another person's proof outside the app, and you can report a violation (section 8).

5. Location

• Your live position stays on your phone. The app reads it only while it is open on screen, to place you on the map and to check that you are inside a drop's area before you take a proof. You are not tracked in the background.
• The map area on your screen is sent to our server to find the drops inside it, and to our map provider to draw the map. Neither receives your position. We do not keep the area, apart from technical logs (section 10).
• The point where you took a proof is stored with the proof and visible to whoever can see the proof (section 4).
• The area of a drop you create is drawn by you and visible as described in section 3.

You can refuse location permission. You will not be able to take a proof.

6. Chat

Each drop has one chat, visible only to its participants.

• The chat is deleted from our servers automatically, shortly after the drop ends, or when a drop expires without enough people. There is no export, no archive and no recovery.
• Copies may remain in our hosting provider's encrypted routine backups until the backup cycle overwrites them, within a few weeks at most. Backups are never used to restore a chat.
• If you delete your account while a chat is live, your messages remain until that chat is deleted, attributed to a deleted user.
• Notifications about new messages name the drop, not the message or the sender.
• Chats are not monitored. Use the report function for abuse.

7. Notifications

Notifications are optional and need your permission on the device. With it, we notify you about the drops you are in, your albums and new chat messages. To do this we store a push token that identifies your app installation. It is removed when you sign out, when it stops working or when you delete your account. Delivery goes through the providers in section 9.

You can turn notifications off at any time in your device settings.

8. Safety reports

You can report a drop, or a person within a drop, from the app, or anyone can report by email (Terms, section 10).

• A report records who filed it, what or whom it concerns, a reason and any text you add. Nothing automatic follows: no one is notified, hidden or blocked by the act of reporting.
• A person reads reports and may act on them, including by restricting or closing accounts and by cooperating with the authorities.
• Reports are visible to no user, including the person who filed them. They are kept for as long as needed for safety and the defence of legal claims, and they survive the deletion of the accounts involved, with the account identifiers removed.
• If you delete your account while a report concerns you or a drop you created, we keep your phone number together with those reports for a limited period, which the app states before you confirm the deletion, in a store no user can reach. This prevents a report from being erased by deleting the account (art. 17.3.e GDPR). Nothing else about you, and no photo, is kept. The hold is deleted automatically when the period ends.
• Text you write in a report may describe other people. Write only what is needed.

9. Who else handles your data

We use the following categories of provider as data processors, under data processing agreements. They may not use your data for their own purposes. Where a provider is outside the European Economic Area, transfers rely on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses.

Our email provider handles the messages you send us. We may replace a provider with another in the same category offering equivalent safeguards, and update this notice when that happens. We disclose data to public authorities only where the law requires it.

10. How long we keep it

We may keep data longer where the law requires it or where it is needed to establish, exercise or defend legal claims. Deleting your account is immediate and removes your profile, phone number, photos, confirmations, keys and push token, except for the hold in section 8 and for chat messages until their chat is deleted.

11. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to it.

Right to object. Where we process your data on the basis of our legitimate interest (section 3), you can object at any time, on grounds relating to your particular situation, by writing to us. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data for legal claims.

You can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it, or with the authority of the EU country where you live.

One limit, stated plainly: a report filed about you is not deleted on request, and a confirmation you gave to someone else's proof cannot be withdrawn while your account exists, because both exist to protect other people.

12. Age

VOUCH is for people aged 18 or over. You declare your date of birth when you set up your profile; a date under 18 is refused by our server and the account cannot proceed. The date of birth is thereafter readable by no one. If we learn that a user is under 18, we delete the account, subject to section 8.

13. Security

• Access to data on our servers is enforced per user by database access rules: the app cannot read another user's data beyond what this notice describes as shared, and cannot act as anyone but you.
• Data is encrypted in transit and at rest by our hosting provider.
• Photos are held in private storage and served only through time-limited links.
• Your phone number is stored apart from your profile so that no other user can read it.
• If a breach is likely to put your rights at risk, we will inform you and the Garante as the GDPR requires.

No system is perfectly secure. Keep your device and your sign-in code safe, and tell us at once if you believe your account has been misused.

14. Changes to this notice

When this notice changes in a way that extends what we do with your data, the app shows the new version and asks you to read it before continuing. Other changes, such as wording, contact details, the replacement of a provider with one offering equivalent safeguards, or a change that reduces what we process or who can see it, take effect when published at https://vouch-app.io/privacy. Previous versions are available on request. This is version 1.0, dated 3 November 2026.

15. Test phase

This section applies while VOUCH is in closed testing and is removed at public release.

• Access is by invitation only. We keep a list of invited testers, outside the app, for the duration of the test, and delete it at the end.
• At the end of the test we delete test data, unless we have asked you beforehand whether you want your account carried into the public release and you said yes.
• No crash reporting or analytics is active in the test build.
• The Terms govern confidentiality and conduct during the test. This notice is not a consent form.