Privacy Policy

1. Information we process

We process submitted URLs/domains or pasted message text to investigate risk. Reports may contain DNS/IP information, redirect paths, certificates, page titles/text excerpts, extracted indicators, findings, sources, timestamps and AI explanations. Redaction reduces some identifiers but cannot guarantee removal of every personal detail. Remove sensitive content before submitting.

Optional accounts use Supabase authentication. Account information may include email, name, avatar and linked Google/GitHub identity metadata. Profile, investigation history and device records may include browser/user-agent labels, a generated device ID and sign-in/last-seen times. Passwords entered in account forms are handled by Supabase Auth; never paste passwords, OTPs, keys, seed phrases or confidential correspondence into investigation inputs.

2. Purpose and external requests

We use submissions to collect evidence, apply detection rules, explain risk, correlate deliberately published indicators, maintain accounts and history, and operate abuse limits. Investigating a URL contacts its destination and configured DNS/domain/certificate/intelligence services. Those services can observe the target and the scanner's network address. Do not submit confidential token-bearing links or internal addresses.

Configured intelligence providers include OpenPhish, URLhaus and Google Safe Browsing; DNS/domain registration and Certificate Transparency lookups can involve additional public services. Full target URLs may be sent for reputation matching. Availability is reported in the assessment.

3. AI processing

When AI explanation is enabled, the scanner sends selected findings, hostnames, related-indicator context and a bounded page/message excerpt to the configured provider. The Google-hosted path uses Google's generative-language API; an OpenAI-compatible endpoint may instead be operated locally or by another provider. Messages use an already-redacted excerpt, but findings or page text may still contain personal information. Provider retention, location and use of data depend on that provider and the operator's settings; Veriq does not promise zero retention or exclusion from training.

The model explains existing findings and cannot determine the system classification. You can ask the operator which provider is enabled. Do not submit sensitive content unless you understand the configured processing.

4. Storage and access

Reports are stored in the operator's configured Supabase database or a local development JSON file. Signed-in report endpoints require the owning account. Anonymous reports use an unguessable report link as access: anyone who obtains the link can read the report, export its verification bundle or request registration. Keep anonymous report links and exported bundles confidential. This is not the same as account authentication.

Signing in may synchronize profile/history/devices through Supabase. Data may be processed outside your country depending on hosting, Supabase, AI, intelligence and RPC services. Their privacy terms also apply. No sale of personal information or advertising tracker is implemented in this prototype.

5. Publication and blockchain

Registering a report publishes an opaque identifier, salted cryptographic commitment, version/parent reference, registrar address, timestamps/events and transaction metadata to the chosen chain. Raw report content and nonce stay off-chain unless you separately export or share them. Public chains are durable and their records cannot be erased by deleting your Veriq account; local development chains can reset.

Choosing repository publication exposes a projection including risk summary, domain/extracted indicator displays, your note, transaction references and validation/dispute statements. Some displays are redacted but domain indicators and notes may remain identifiable. Review them carefully. Published indicators may be correlated across incidents. Integrity verification proves correspondence with a commitment, not the truth of a verdict.

6. Browser storage and technical data

The browser uses local/session storage for Supabase sessions, theme, generated device ID, last sign-in time, up to 30 history entries and temporary report caches. Clear site data to remove this browser's copies; that does not delete server records or public-chain data. Sharing a device can expose locally cached history/reports.

Network providers can receive IP addresses and request metadata. The scanner maintains in-memory abuse counters and operational/error logs. The interface currently loads Google Fonts, which can disclose connection metadata to Google. Hosting/AI/intelligence providers may maintain their own logs; no universal retention period is enforced by this code.

7. Retention, deletion and your choices

There is currently no automatic report-expiry job. Reports remain until removed by the operator or an available deletion workflow. We do not claim the planned seven/thirty-day retention settings are implemented. Browser copies remain until cleared or expired by browser/session behavior. Backups and provider logs have separate schedules.

The profile provides export/account-deletion controls when configured. Server cleanup deletes private owned reports and detaches published reports from the account; published records, notes and related metadata may remain. Detaching ownership is not anonymization. Chain history cannot be removed. Anonymous records have no account-based deletion control; request operator assistance and provide the report ID without sending sensitive evidence.

You can use supported investigations without an account, avoid publication, choose not to register a commitment, clear browser storage, and request access/correction/deletion from Axiom. Requests may need identity/ownership verification. Available legal rights depend on applicable law and your location; this notice does not waive them.

8. Security, children and changes

Veriq uses passive bounded inspection, input validation and service-side controls, but this prototype has limitations and cannot guarantee confidentiality or security. It is not intended for children's personal data or sensitive production workloads. Do not use it to investigate material you are not entitled to submit.

We will update this page when processing changes. Check the displayed revision date. Before public launch, Axiom must confirm a contact address, actual service locations, retention settings and any additional notices required for that deployment.

Contact Axiom

Contact the Axiom team running your demonstration. For non-sensitive support you can also use the Veriq issue tracker. Issues are public: never post private reports, identifiers or credentials. A dedicated privacy email has not yet been supplied and should be configured before public launch.