Verafy Privacy Policy

Effective date: 2026-10-18 App: Verafy+Anchor for Android and iOS (identifier com.dejify.verafy), MALHub for Android and iOS (identifier com.dejify.verafy.malhub), BeyondAfrica for Android and iOS (identifier com.dejify.verafy.beyondafrica), ADN Connect (identifier com.dejify.verafy.adnable), Naija Swallows (identifier com.dejify.verafy.naijaswallows) and Unilorin Connect (identifier com.dejify.verafy.unilorin), each of which runs on the Verafy platform Controller: Verafy Contact: privacy@verafy.me · support@verafy.me

This policy describes the personal information Verafy collects, why we collect it, how we share it, and the rights you have over it.

1. What Verafy is

Verafy is a Bluetooth-Low-Energy (BLE) proximity social-discovery app. Discovery, matching, and chat work primarily over BLE between phones in physical range. An internet connection is used only for account login, profile sync, support, and in-app purchases.

2. Information we collect

2.1 Information you provide

• Account identifiers: email address and/or phone number used to receive a one-time verification code (OTP).
• Profile information: display name, optional photo, age range, intent (e.g. "professional networking"), interests, energy level, and optional contextual focus tags.
• Optional contact information: email and/or phone number you explicitly choose to share with a matched user.
• Support content: messages you send through Support → Contact Us or the in-app myVera assistant. A myVera question is sent to our AI provider, without your name or account, to produce the answer. Since 14 October 2026 Verafy does not store the text of myVera questions: it keeps only whether a question was within myVera’s scope, and when.

2.2 Information collected automatically

• Device + diagnostic metadata: Android or iOS version, app version, build number, locale, and crash diagnostics (errors and warnings only - never the full console log).
• Bluetooth scanning telemetry: anonymous identifiers and signal strength used by the on-device matching engine.
• Advertising data (only when advertising is switched on): if the organisation that runs your app has advertising switched on, and a placement is served by Google, the Google Mobile Ads SDK built into the app may collect and send to Google your device’s advertising identifier, diagnostic information, how you interacted with the advert, and your IP address. Advertising, including Google-served adverts, is switched on in every Verafy app from 18 October 2026; see section 4.2, which explains who sees adverts and what happens. Before any Google advert is requested, the app contacts Google’s consent service to find out whether the law requires consent where you are and, if it does, to show Google’s consent form and keep your choice. That connection sends Google your IP address and basic device and app information, and it is not an advert request. An IP address is not your GPS location. It indicates roughly where a connection comes from - typically a city or region - and Verafy does not use it to locate you.
• Approximate / precise location: required by Android as a precondition for BLE scanning on some OS versions. Verafy does not store, transmit, or log your GPS coordinates. On iOS the app requests no location permission at all - Apple’s CoreBluetooth does not require one to scan, so the permission is not declared in the iOS build.

2.3 Information from third-party services

• Resend delivers your OTP email. Resend processes only your email address.
• Twilio Verify delivers your OTP SMS. Twilio processes only your phone number.
• Google serves adverts through the Google Mobile Ads SDK, and only when advertising is switched on for your app and the placement is a Google one. What Google receives is described in section 4.2.

3. How we use information

4. How we share information

We do not sell or rent your personal information. We do not share mobile information with third parties or affiliates for marketing or promotional purposes. Mobile numbers are used only to deliver the messages described in this policy, and are shared only with the messaging provider that delivers them on our written instructions. That protection for your mobile number is unchanged.

Separately from your mobile number, when advertising is switched on for your app, advertising data described in section 4.2 is shared with Google so that it can select and measure adverts. We do not receive payment for your personal information, and we do not share your name, email address, phone number, chat messages or profile with any advertising provider. We share information only with service providers acting on our written instructions:

• Resend - transactional email (OTP).
• Twilio - transactional SMS (one-time sign-in codes) and, where you have opted in, Verafy Announcements.
• OpenAI - myVera assistant. Prompts are sanitized and contain no account identifiers or contact details.
• Digital Ocean - hosting of the verafy.me API and database.

We may disclose information when required by law or to protect the rights, safety, or property of Verafy, its users, or the public.

4.1 Verafy Announcements messaging

Verafy Announcements are recurring informational and service-related messages about the Service. They are off by default and are sent only if you turn the Verafy announcements switch on in the app, under Profile → Notifications. Message frequency varies. Message and data rates may apply. Reply STOP to opt out and HELP for help. Consent is not a condition of purchase, and turning Verafy Announcements off does not affect any other part of Verafy. Full messaging terms are in the Terms & Conditions, section 7.

4.2 Advertising

Advertising, including Google-served adverts, is switched on from 18 October 2026 in Verafy+Anchor, MALHub, BeyondAfrica, ADN Connect, Naija Swallows and Unilorin Connect. The ability to show adverts is built into the installed app, which means it can be switched on or off without you installing an update. Google-served adverts are the exception: they are given only to app versions that apply the consent rules below, so an older installed version never receives a Google advert.

Who decides. Adverts appear only if all of the following are true:

• Verafy has not prohibited advertising across the platform;
• the organisation whose app you are using has turned Show Ads on for that app, in its own workspace;
• you do not hold an ad-free entitlement. Premium accounts are ad-free;
• you have been shown the in-app notice announcing advertising, including Google advertising. Adverts can appear as soon as you have seen it. (Until 18 October 2026 this policy promised a 30-day wait after the notice; that wait no longer applies.)

A Google-served advert is also shown only to adults (18 and over), and only where any consent the law requires has been given in Google’s consent form.

If any of those is not met, no advert is requested from any source and the space is removed rather than left blank.

Where an advert comes from. When advertising is on, the organisation’s own adverts are shown first. These are images and links the organisation uploaded to Verafy; they are served from Verafy’s own servers and no advertising provider is involved. If the organisation has none available, Verafy may show an advert of its own on the same terms. Some placements can instead be served by Google, and only those placements involve the Google Mobile Ads SDK.

What Google receives, and why. For a Google-served placement, the Google Mobile Ads SDK built into the app may collect and send to Google:

• your device’s advertising identifier - a resettable ID that Android provides for advertising, which you can reset or delete in your device settings;
• diagnostic information about the advert request;
• how you interacted with the advert;
• your IP address.

Non-personalised only. Every Google advert request from the app asks for non-personalised adverts only, with content suitable for teens and older. Verafy does not build advertising profiles, does not ask Google for personalised adverts, and does not carry out audience research. Google states that non-personalised adverts still use the advertising identifier and IP address, for example for frequency capping, aggregated reporting, fraud prevention and approximate location.

Google uses this to select and show adverts, to measure how they performed, and to detect advertising fraud. Under its own terms Google may also use it for audience research and to develop and improve its services, which are purposes listed in its consent form. Google acts as an independent controller of that data under its own privacy policy, at policies.google.com/privacy. You can control advertising personalisation, and reset or delete your advertising identifier, in your device settings; on Android these are under Settings → Privacy → Ads.

On iPhone, Google adverts only if you allow tracking. On iPhone the app shows Google adverts only if you choose Allow when it asks, through Apple’s App Tracking Transparency prompt, whether it may track you. If you allow it, the Google Mobile Ads SDK may collect the data described above, including your device’s advertising identifier, and Google may use it to measure adverts and limit how often you see them; the adverts are still never personalised. If you choose Ask App Not to Track, or have not been asked, the app does not start Google’s advertising SDK or request a Google advert, and you see only the app’s own adverts. You can change your choice at any time in Settings → [the app] → Allow Tracking. Your answer to Apple’s prompt does not replace the in-app notice, the age check or Google’s consent form described here; all of them still apply.

Google’s consent form. Before any Google advert is requested, the app contacts Google’s consent service, wherever you are, to find out whether the law requires consent there. That connection sends Google your IP address and basic device and app information, and it is not an advert request. In the European Economic Area, the United Kingdom and Switzerland, Google then shows its consent form and keeps your choice on your device; the connection happens even if you then refuse. Once you have answered the form, the Profile screen may contact the consent service again so that your choice stays available to change. The form is Google’s standard wording, the same for every app, and Verafy cannot change it. It lists every purpose Google declares, including personalised advertising, audience research and developing and improving services, and it says Google may use precise geolocation data. What this app does is narrower: it requests non-personalised adverts only, and it does not read your GPS position or send it to anyone.

Refusing and withdrawing. If you refuse, or do not finish the form, no Google advert is requested at all. You can review or withdraw your choice at any time in Profile → Advertising privacy options. Withdrawing removes a Google advert already on screen and stops further Google advert requests.

What is never sent to an advertising provider. Your name, email address, phone number, date of birth, profile, interests, chat messages and Bluetooth matching data are not shared with Google or any other advertising provider.

On location. An IP address is not your GPS location. It indicates roughly where a connection comes from, usually to the level of a city or region. Verafy does not send your GPS coordinates to anyone, and that remains true when advertising is on.

Children. Accounts aged 13 to 17 are subject to the restrictions in section 6.

5. BLE and on-device processing

Matching ("resonance") is computed entirely on your device. Profile data is never sent to a server during matching. Identifiers broadcast over Bluetooth are hashed/derived values - your name, email, and phone number are never advertised over the air.

5.1 Anchor (event mode)

Anchor lets an event organiser broadcast event information to attendees nearby. Attendees receive it over Bluetooth and can read it with no network connection; the event details and the organiser’s signature are verified on your device.

• Attendees: receiving an Anchor broadcast does not send anything about you to us. Nothing you receive over Bluetooth is reported back to our servers.
• Organisers: events and the advertisements shown inside them are stored on our servers so they can be managed and re-broadcast.
• Connections: when two people connect, we store a record of the pairing (the two account identifiers, its status, an affinity score and timestamps). We do not store where the connection happened.

6. Children

You must be at least 13 years old to use Verafy. We ask for your date of birth when you create an account, solely to apply these age rules; it is not shown to anyone and is not used for matching. We do not knowingly collect data from children under 13, and an account that gives a date of birth under 13 is refused. If you believe a child under 13 has used Verafy, contact privacy@verafy.me and we will delete the account.

Accounts aged 13 to 17 have restricted access: romantic and dating connection modes are turned off, and sharing an email address or phone number with other users is turned off.

7. Your rights

You can at any time: - Access your profile from inside the app. - Correct your profile from inside the app. - Delete your account and all associated data - see https://verafy.me/delete-account or Profile → Settings → Delete Account. - Withdraw consent to optional features by toggling them off in Settings. - Lodge a complaint with your local data-protection authority.

Requests covered by GDPR, UK GDPR, CCPA / CPRA, and similar regimes can be sent to privacy@verafy.me. We respond within 30 days.

8. Retention

Deleting your account removes profile data, chats you originated, and Vera-token balance within 30 days from our primary systems and within 90 days from encrypted off-site backups.

Advertising data sent to Google for a Google-served placement is held by Google under its own privacy policy and retention rules, not by Verafy. Verafy does not store your advertising identifier.

9. Security

• All traffic between the app and verafy.me is HTTPS (TLS 1.2+).
• The Android Network Security Config denies cleartext traffic app-wide. On iOS, App Transport Security is enforced (NSAllowsArbitraryLoads is false), which blocks cleartext connections equivalently.
• BLE bridge classes are listed in ProGuard -keep rules; the rest of the app is R8-minified.
• Passwords are never used - login is always OTP.

No system is perfectly secure. If you discover a vulnerability, please contact security@verafy.me.

10. International transfers

Verafy operates infrastructure in the United States. By using Verafy you acknowledge that your information may be processed there under appropriate safeguards.

11. Changes to this policy

Material changes will be announced in-app before they take effect. Until 18 October 2026 this section promised at least 30 days; advertising, including Google-served adverts, was switched on that day, as soon as each person had been shown the in-app notice announcing it. The "Effective date" at the top of this page always reflects the current version.

12. Contact