Privacy

What we store

• Your account: your email address and name. If you sign in with Google, Google shares your name, email address and profile picture link, and our sign-in provider keeps the sign-in tokens Google returns. “Try the demo” accounts use a random, made-up email address.
• Sign-in sessions: for each session, our sign-in provider records the IP address and browser type (user agent) to keep you signed in securely.
• Your settings: language, whether Auto-pay is on, and your Auto-pay limit.
• What you check: the store links you paste, when you checked them, and the scan results with their evidence (taken from the store’s public pages).
• Sandbox payments: the amount, the store, PayPal sandbox order, authorization and capture IDs, and their status. If you use Auto-pay, the reference ID of your saved sandbox PayPal wallet (never a login, password or card number).
• PayPal notifications: from the messages PayPal’s sandbox sends us about payments, we keep only payment status details (IDs, status, amount, store reference and times), never the buyer’s name, email address, phone number or address.
• Trust Receipts: the store, verdict, evidence summary and what happened to the payment. Receipts contain no personal information.
• An audit log of every payment decision, allowed or refused. It is linked to a random account ID, not your name or email address, and entries are never edited.

Cookies

We use only the cookies VoirCheck needs to work: the sign-in session cookies set by our sign-in provider (names starting with __Secure-neon-auth), vc_lang (your language) and vc_demo (whether Demo mode is on).

No advertising, analytics or tracking cookies. The PayPal checkout window is PayPal’s own site and follows PayPal’s policies.

Who processes data for us

• Neon: our database and sign-in (Neon Auth). It stores everything listed above.
• Render: hosts the app. It keeps standard server logs (time, page requested, IP address).
• PayPal (sandbox): processes the test payments and saved test wallets.
• Resend: sends your Trust Receipt emails. It receives your account email address and the receipt content.
• KERNEL: opens the store pages you check in an isolated cloud browser. It receives store links, not your account data. The live view you watch is streamed from KERNEL to your browser.
• Google Safe Browsing: receives the store links you check, to look them up on threat lists.
• Domain registries (RDAP): receive a store’s domain name, to look up when it was registered.
• The store itself: our server connects to the store’s server to check its security certificate, and KERNEL visits its pages.
• Google: only if you choose “Continue with Google”, to sign you in.
• Channel3: will receive your product search queries once product search is switched on (not live yet).
• Anthropic: will receive the text of store pages for AI analysis once that feature is switched on (not live yet). It will not receive your account data.

Store links and public receipts

The store links you check are sent to the services above so the store can be checked. Scan results are shared between users who check the same link.

Trust Receipt pages (/r/…) are public to anyone who has the link. The links are long and random, and receipts never include your name, email address or PayPal IDs.

What we don’t do

• We don’t sell your data.
• We don’t show ads.
• We don’t use tracking cookies.
• We don’t share your data beyond the services listed above.

Google user data

If you sign in with Google, we use your Google account information only to sign you in and to show your account name and email address in VoirCheck. We don’t use it for ads, don’t sell it, don’t use it to train AI models, and don’t share it except with the services needed to run sign-in.

VoirCheck’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it

We keep data through the hackathon judging period (until 15 December 2026). After that, we will delete account data 90 days after it was created, keeping only anonymous scan statistics. You can ask us to delete your data sooner at any time.

Delete your data or ask a question

Email lawsgamer213@gmail.com. We’ll delete your account and the data linked to it. Audit log entries are kept, but they hold only a random account ID, not your name or email address.