Privacy Policy

Effective date: [EFFECTIVE DATE]

1. Who We Are

Verney is provided by [COMPANY LEGAL NAME], a company registered in Romania (registration number [COMPANY REGISTRATION NUMBER]; VAT ID [VAT ID]) with its registered office at [REGISTERED ADDRESS] ("Verney," "we," "us," or "our"). We are the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) and Romanian data protection law.

If you have any questions about this Privacy Policy or how we handle your information, you can reach us at privacy@verney.app.

2. What This Policy Covers

This Privacy Policy explains what information Verney collects when you use our mobile app, why we collect it, how we use and protect it, who we share it with, and what choices and rights you have.

Verney is designed to be a thinking partner for your relationships — it holds conversations with you, remembers what matters, and helps you think through what's happening in your relationships over time. Because of what Verney does, this policy pays particular attention to how we handle sensitive personal information, including the kind you might choose to share in conversation.

This policy applies to the Verney mobile app and its related backend services. It does not cover third-party services you may separately interact with, such as the Apple App Store or Google Play, which have their own privacy policies.

3. Information We Collect

3.1 Information you provide directly

Account information: your email address and password (we never store your password itself — only a securely hashed version that cannot be reversed).
Conversations with Verney: the messages you send and the replies Verney gives, in full.
Anything you voluntarily share in conversation, including, potentially, sensitive information such as your health, your sex life or sexual orientation, your racial or ethnic origin, your political opinions, or your religious or philosophical beliefs — or any other information GDPR treats as a "special category" of personal data. We treat this category of information with additional care — see Section 5.

3.2 Information Verney generates from your conversations

What Verney remembers about you: as you talk with Verney, it builds an evolving understanding of your relationships — established facts, patterns it has noticed, working hypotheses, and open questions — so it can pick up where you left off rather than starting over each time.
Persistent memories: specific, individually useful things Verney has learned about you over time, kept separately so they can inform future conversations.

3.3 Account and subscription information

Subscription details: which plan you're on (Free, Standard, or Pro), your usage within the current billing period, and your renewal date.
Payment: Verney does not directly collect or store your payment card details. Subscriptions are purchased through the Apple App Store or Google Play, and payment information is handled entirely by Apple or Google under their own privacy policies. We receive only confirmation of your subscription status from our payment infrastructure provider, RevenueCat (see Section 6).

3.4 Information collected automatically

Usage and reliability information: which subscription tier a given interaction used, an internal cost/processing classification, and a safety-relevant risk classification for that interaction. This information never includes the content of your messages — only metadata about how the interaction was processed.
Error reports: if part of Verney's backend service fails unexpectedly, a technical error report is sent to our error-monitoring provider (see Section 6). It describes the technical failure — such as the type of error, where in our code it occurred, and which kind of request was being handled — and is deliberately configured to exclude the content of your messages, your email address, your password, your IP address, and any identifier linking the report to your account.
We do not use any third-party analytics or advertising tracking.

4. How We Use Your Information, and Our Legal Basis for Doing So

Under GDPR, we must have a valid legal basis for each way we use your personal data. Here is how that applies to Verney:

Creating and maintaining your account (email, password, session log-in) — performance of our contract with you.
Having a conversation with you and remembering it (messages, what Verney remembers, persistent memories) — performance of our contract with you.
Generating Verney's replies, including sending your conversation to our AI providers (conversation content sent to Anthropic and OpenAI) — performance of our contract with you.
Administering your subscription (plan, usage, renewal) — performance of our contract with you.
Recovering access to your account (password reset codes, delivery via email) — performance of our contract with you.
Understanding usage, reliability, and cost, and monitoring for safety-relevant signals (usage/reliability metadata, no message content) — our legitimate interest in operating and improving Verney responsibly.
Detecting and fixing technical failures (error reports, with no message content or account identifiers) — our legitimate interest in keeping Verney reliable and secure.
Processing sensitive ("special category") information you voluntarily disclose — such as health, sex life/sexual orientation, racial/ethnic origin, political opinions, or religious/philosophical beliefs, among other categories GDPR treats the same way — your explicit, separate consent (see Section 5).

We do not use your information for advertising, and we do not sell your information to anyone.

5. Sensitive Information and Your Explicit Consent

Because Verney is built around open, free-form conversation that it follows over time, you may sometimes choose to share information that GDPR treats as a "special category" of personal data — for example, details about your health, your sex life or sexual orientation, your racial or ethnic origin, your political opinions, or your religious or philosophical beliefs, among other categories GDPR treats the same way. This list is illustrative, not exhaustive — it covers whatever you choose to share that falls into any of these special categories, not only the examples named here.

We only process this kind of information with your explicit, informed consent, obtained separately from your general acceptance of our Terms of Service. The first time you would otherwise reach the main conversation screen, Verney shows you a dedicated "Before We Start" screen explaining exactly this, before you can continue. You must take a clear, deliberate action to agree — nothing is assumed or pre-selected on your behalf.

If you share this kind of information, Verney handles it exactly as it handles the rest of your conversation: it becomes part of your conversation history, may shape what Verney remembers about you, and is sent to the AI providers described in Section 6. It is kept for as long as you have a Verney account and have not withdrawn this consent — whichever comes first.

You can withdraw this consent at any time, from Settings, without needing to re-enter your password. Because Verney cannot reliably separate sensitive information from the rest of a conversation once it has been shared, withdrawing this consent permanently deletes your entire conversation history, everything Verney remembers about you, and your persistent memories. Your account and subscription are not affected, and you can keep using Verney afterward — you will simply be asked to agree again before your next conversation, starting fresh.

6. Who We Share Your Information With

We do not sell your personal data. We share information only with the service providers who help us run Verney, each acting on our instructions and bound by a data processing agreement:

Anthropic and OpenAI — the AI providers that generate Verney's responses. Your conversation content is sent to whichever of these is handling a given reply. Under the specific business/API terms that apply to Verney's use of these providers, this data is not used to train their models — a different practice than these providers may apply to their own separate consumer-facing products, which is not what Verney uses.
Resend — sends the emailed 6-digit code if you request a password reset. It receives your email address and the code, and nothing else.
RevenueCat — manages subscription status on our behalf once in-app purchases are live, based on information provided by the Apple App Store or Google Play. It does not receive your conversation content.
Railway — hosts the servers that run Verney's backend service. The information described in this policy is processed on its infrastructure.
Supabase — hosts the database where your account, conversation history, what Verney remembers about you, and the other information described in this policy are stored.
Sentry — receives technical error reports when part of Verney's backend service fails (Section 3.4), stored in its EU (Germany) data region. These reports are configured to exclude your message content, email address, password, IP address, and any account identifier.

We may also disclose information if required to do so by Romanian or EU law, or to protect the rights, safety, or property of Verney or our users.

7. International Data Transfers

Some of the service providers listed in Section 6 are based outside the European Economic Area (EEA), principally in the United States. When your information is transferred to them, we require appropriate safeguards to be in place under their respective data processing agreements — such as the European Commission's Standard Contractual Clauses, or reliance on an applicable adequacy mechanism — so that your information continues to be protected to a standard equivalent to the GDPR, wherever it is processed.

8. How Long We Keep Your Information

Your conversation history, what Verney remembers about you, and your persistent memories are kept for as long as you have a Verney account, because remembering you over time is central to what Verney does. They are permanently deleted when you delete your account, or when you withdraw your consent to sensitive-information processing (see Section 5).
Usage and reliability metadata (Section 3.4) is kept on the same basis and is likewise deleted when you delete your account.
Password reset codes are deleted within 24 hours of expiring (they are valid for 15 minutes).
Session log-ins are deleted within 24 hours of expiring (sessions last 30 days).
Account information is kept until you delete your account, at which point it, and everything listed above, is permanently and irreversibly deleted.
Error reports (Section 3.4) are kept by our error-monitoring provider for up to 90 days and then deleted automatically. Because they contain no account identifier, they cannot be linked back to you or your account.

9. Your Rights

Under GDPR, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate personal data.
Erase your personal data.
Restrict or object to certain processing.
Data portability, where applicable.
Withdraw consent at any time for anything we process on the basis of your consent (see Section 5), without affecting the lawfulness of processing before your withdrawal.

Deleting your account is available directly in the app, at any time, under Settings → Delete Account. This permanently deletes your account and all associated data.

For all other requests — access, rectification, restriction, objection, or portability — please contact us at privacy@verney.app. We will respond within one month, as required by GDPR.

You also have the right to lodge a complaint with Romania's data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), or with the supervisory authority in your own EU member state.

10. Data Security

We take reasonable technical and organizational measures to protect your information, including:

Passwords and password-reset codes are stored as salted cryptographic hashes, never in plain text.
Session credentials are stored as hashed values, never in their original form.
Data is encrypted in transit between the app and our servers.

No system can be guaranteed perfectly secure, but we are committed to protecting your information and to responding promptly if anything ever goes wrong.

11. Age Requirement

Verney is intended for adults. You must be 18 years of age or older to create a Verney account. We do not knowingly collect personal data from anyone under 18.

12. Changes to This Policy

We may update this Privacy Policy from time to time, for example as Verney's features evolve or as required by law. If we make material changes, we will provide reasonable notice before they take effect, using an appropriate means available to us at the time (such as within the app or by email), and we will seek your affirmative consent first wherever applicable law requires it for the change to take effect. The "Effective date" at the top of this policy always reflects the version currently in force.

13. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or your personal data, contact us at:

privacy@verney.app

[COMPANY LEGAL NAME] [REGISTERED ADDRESS] [COMPANY REGISTRATION NUMBER] · VAT [VAT ID]