Privacy policy
Vouch is a payment layer that converts token creator fees to USDC and delivers them to fundraisers, publishing a receipt for every delivery. This policy describes what we store, why, and who can see it.
What we collect
- Google sign-in. When you sign in we receive your Google account id, email address, name and profile picture from Google. We use these to create your account and show who you are. We do not receive your Google password.
- Custodial wallet. At first sign-in we generate a Solana wallet for you and store its private key encrypted (AES-256-GCM) on our servers. Its public address, balances and transfers are visible to you in your dashboard.
- Operator Gmail access (operators only). Operators who choose “Connect Gmail” grant read access to their mailbox and permission to send mail. We use read access only to locate donation confirmation emails that match a delivery, and send access only to notify operators about deliveries awaiting them. We store an encrypted refresh token; we do not store mailbox contents beyond the specific confirmation email attached as receipt evidence.
- Ledger data. Fundraisers, vaults, tokens, on-chain fee events, deliveries and receipts. Most of this is public by design: it is the product.
- Evidence files. Screenshots, confirmation emails and card statement lines attached to deliveries. Their SHA-256 hashes are public; files are served publicly from receipt pages.
- Session and request data. Session identifiers (cookies), IP address and user agent for security.
What we do not do
- We do not sell personal data.
- We do not use Gmail data for advertising or for anything other than receipts and operator notifications.
- We do not share your Google data with third parties except the infrastructure providers that run the service (hosting, Solana RPC), under their own data processing terms.
Google API Services
Vouch’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Retention and deletion
Ledger data and receipts are permanent by design; they are the public record of where money went. Account data, sessions and Gmail tokens are deleted on request. Custodial wallets are not deleted while they hold funds; withdraw first. Email hello@vouch.fun to request deletion.
Cookies
One session cookie (`vouch_session`) and two ten-minute cookies used during Google sign-in. No advertising or analytics cookies.
Contact
hello@vouch.fun