What we hold, and what we never see.

We store your email address, a daily count of how many checks you have run, and a record of your payments. We do not store the contact lists you check, and the self-hosted engine never sends them to us at all.

Your email address. Given when you sign in, join the waitlist, or ask for an audit report by email. It identifies your account and is how we contact you.

Usage counts. A number per day, per account, so plan limits can be enforced. We record how many checks you ran, not what you checked.

Billing records. When you pay, Dodo Payments sends us your email address and the event that occurred, which we store to know which plan you are on. Card details are handled by Dodo and never reach our servers.

If you sign in with Google, we receive your email address and whether Google has verified it. Nothing else. We do not request access to your Google account, contacts, or mail, and no token is retained after sign-in.

Your contact lists. Addresses you paste into the web checker are processed to produce a result and are not written to our database. The open-source engine runs on your own machine, so a list checked that way never leaves it.

Passwords. There are none. Sign-in is a one-time link or Google, so there is nothing to leak.

No advertising identifiers, no third-party analytics, no tracking pixels.

Domain audit pages are public. Checking a domain at /audit creates a shareable page at /audit/<domain> showing that domain's public DNS records. It contains nothing that is not already published in DNS, and no personal data, but it is reachable by anyone with the link.

Results are cached briefly. To avoid repeating the same lookup, the engine keeps a verification result in memory for up to a few hours. It is not written to disk and is lost when the service restarts.

Verification contacts the recipient's mail server. Checking whether a mailbox exists means asking the server that holds it. That server sees the address being checked and the address doing the checking. No message is ever sent.

Vercel hosts the website. Render hosts the verification API. Supabase stores accounts, usage counts and billing records. Resend delivers our email. Dodo Payments processes payments and holds card details. Google handles sign-in if you choose it.

Each receives only what it needs to do its job. We do not sell personal data, and we do not share it for advertising.

Account details and usage counts are kept while your account exists. Sign-in links expire after fifteen minutes and are single-use. Billing records are kept as long as required for accounting. Ask us to delete your account and we will remove your profile, usage history and API keys.

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email hello@tryverdict.org and we will action it. If you are in the UK or EU, you also have the right to complain to your data protection authority.

One cookie holds your sign-in session, and a second short-lived one protects the Google sign-in flow against forgery. Both are strictly necessary and neither is used for tracking. There are no analytics or advertising cookies.

If this policy changes materially we will say so on this page and update the date above. Continued use after a change means you accept the revised policy.