Privacy Policy

Effective date: 2026-07-31

This policy explains what personal information Soval ("we", "us") collects through the website at sovalsocial.com, the Soval web application, and the Soval browser extension (the "Service"), why we collect it, who we share it with, and the rights you have. We have written it in plain language on purpose.

1. Who is responsible

The person in charge of the protection of personal information at Soval is the Founder, reachable at info [at] sovalsocial [dot] com.

2. Who this policy covers

Two groups, and they are different:

People who use Soval — you have an account, or you use the extension. Most of this policy is about you.

People mentioned in claims — Soval assesses claims submitted by users and drawn from public reporting, and those claims can name people and businesses who have never used Soval. If that is you, §12 is written for you.

3. What we collect

Information you provide:

Account: email address, username, and a password (stored only as a cryptographic hash — we cannot read it), or a Google or Apple sign-in identifier if you choose those instead; your notification and message-privacy preferences.
Optional profile details: bio, profile photo, and location (country, province, city) if you choose to add them.
Content you submit: claims (text, images and screenshots, links), comments, direct messages, community signals (boosts, verdict reactions, comment votes, bookmarks, hidden posts), reports, flags, and disputes.

Information generated when the Service runs:

From images you submit: text extracted from the image (OCR) and reverse-image lookup results, used to research the claim. Screenshots often contain information about other people; §12 applies to that information.
Verification records: the evidence assessment produced for each claim, its sources, and its history.
Activity records: your reputation points, badges, and notifications; and an internal per-request cost record that links your account to each paid verification call (it contains no content — we use it to control service costs and detect abuse).

Technical information:

Your IP address is used transiently for security and rate limiting. We do not store it in our database. Standard infrastructure logs at our hosting providers (Railway, Vercel) may retain server logs for a limited period as part of normal operations.
Your browser's local storage holds your session token and display preferences (for example, dark mode). See §9.

4. What we do not do

We do not sell personal information.
We use no advertising trackers and no cross-site or profiling technologies on the Service.
We use one third-party analytics tool, Google Analytics, on our website only, and only for visitors who consent. It is off by default: nothing is collected until you accept, you can decline with equal ease, and you can change your choice at any time. See §9 for how this works and §7 for what Google receives. Our browser extension contains no analytics of any kind.
The extension performs no passive reading of the pages you visit and contains no telemetry — it transmits only what you explicitly select or submit, and extension checks are private by default.
We never display the internal confidence scores our systems produce.

5. Why we use your information

To operate the Service — accounts, feeds, profiles, messages, notifications.
To produce Evidence Checks — researching the claims you submit against published sources through the providers in §7.
To moderate and keep the Service safe — reviewing flags, disputes, and reports; enforcing our Terms of Service; preventing abuse and manipulation.
To communicate with you — transactional email only (account verification, password reset, and service notices). We will not send marketing email without a separate consent.
To improve the Service — understanding failures and quality issues, and, for website visitors who consent, measuring how the website is used through Google Analytics (see §9).
To comply with legal obligations.
To build research and commercial datasets. Verification records that contain no personal information — the claim, its evidence assessment, its sources, and how that assessment evolved, with all information identifying you as the submitter removed — are not personal information, and we may retain and use them, including in datasets we license commercially. Our dataset exports exclude personal information by construction. Records that do contain personal information are excluded from these datasets; records that could identify you as the submitter are included only with your separate, optional consent, which you can give or withdraw at any time in your settings.

6. Consent

Where our use of your information rests on consent, that consent is requested in clear language, separately for each purpose. Examples include website analytics (§9) and inclusion of submitter-identifying records in our datasets (§5.7). You may withdraw a consent at any time in your settings or by contacting info [at] sovalsocial [dot] com. Withdrawal does not affect processing that already lawfully occurred, and some withdrawals may mean parts of the Service will no longer work (we will tell you which).

7. Service providers — who receives what

We use a small number of service providers to run Soval. Verification providers never receive your identity — research requests carry the claim content, not your name, email, username, or account ID.

Provider	Where	What they receive	Why
Perplexity AI	United States	The claim text being checked, contextual provenance (e.g., "submitted with a screenshot"), and up to approximately 2,000 characters of text extracted from a submitted image	Researching the claim against published sources
OpenAI	United States	Passages of text you selected or a fetched article body (up to approximately 8,000 characters)	Splitting text into checkable claims; classification
Google Cloud (Vision)	United States	Images you submit (retrieved by URL)	Extracting text from images; reverse-image lookup
Google Analytics	United States	Only for website visitors who consent: usage data about your visit — pages viewed, approximate location (from IP, which Google processes but we do not store), device and browser type, and a cookie-based identifier. Received from website visitors only, never from the extension	Measuring how the website is used so we can improve it
Supabase	United States	Our database and file storage — the information described in §3	Hosting our data
Railway	United States	Traffic to our backend in transit; server logs	Hosting our backend
Vercel	United States	Traffic to our website in transit; server logs	Hosting our website
Resend	United States	Your email address and the content of transactional emails (which include account verification and password reset links)	Sending service email

We require providers to use the information only to provide their service to us. If we add or change providers, we will update this table.

8. Your information leaves Québec

The providers listed above process information outside Québec, primarily in the United States. Before communicating personal information outside Québec, we assess the sensitivity of the information, the purposes for which it is used, the protections in place, and the legal framework of the destination.

9. Technologies on your device

Local storage (always active, essential). We use your browser's local storage for your session token, your display preferences (for example, dark mode), and to remember your analytics choice below. The extension stores your session token locally on your device.

Google Analytics (website only, consent-based). On our website — not the extension — we use Google Analytics to understand how the site is used. It relies on cookies and is off by default: when you first visit, we ask, and Google Analytics collects nothing unless you accept. You can decline just as easily as accept, and you can change your choice at any time in Settings → Privacy & Analytics. If you decline or ignore the request, no analytics cookies are set and the rest of the site works normally. We do not use advertising cookies, cross-site tracking, or profiling technologies.

That is the complete list; if it grows, this section will say so before the technology is used.

10. How long we keep information, and what deletion does

While your account is active: we keep the information in §3 to run the Service. You can remove items from your visible verification history at any time; removed items are hidden from your view and from other users, but the underlying claim and verdict record is retained for the integrity of the verification system.

When you delete your account: we delete or de-identify your account information within 30 days, except where law requires retention or a legal claim requires preservation. The claim and its evidence assessment are retained with the information identifying you as the submitter removed — this preserves the integrity of the verification record, exactly as it does for items you remove from your history while your account is active.

What de-identification means: information that identifies you as the submitter (your email, username, account ID, and the link between your account and the claim) is removed. Claim text and the associated evidence assessment may be retained in a form that no longer identifies you. Note that claim text itself may identify third parties (the people named in the claim) — §12 addresses how those individuals can exercise their rights.

11. Your rights

You may, subject to applicable law:

(a) Access the personal information we hold about you and receive a copy;

(b) Rectify inaccurate or incomplete information;

(d) Ask us to stop disseminating information about you, or to de-index it, where the legal conditions are met;

(e) Receive computerized personal information you provided to us in a structured, commonly used format (portability), or have it communicated to another organization where the law provides.

To exercise a right, contact info [at] sovalsocial [dot] com. We will verify your identity and respond within 30 days. If we refuse a request, we will explain our reasons and your recourses.

If you are unsatisfied, you may complain to the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca. If you live elsewhere in Canada, the Office of the Privacy Commissioner of Canada or your provincial privacy regulator may also have jurisdiction.

12. People mentioned in claims — if a claim is about you

Soval's purpose is assessing claims that circulate publicly, and those claims can name people and businesses. If a claim on Soval concerns you:

What we process is the claim as submitted, and what published, linked sources say about it. Our systems apply stricter evidence requirements before assessing claims that identify a specific person or business, and internal safeguards can withhold an assessment entirely.
You may contest a claim or an Evidence Check about you — no account required — by contacting info [at] sovalsocial [dot] com.
You may exercise the rights in §11 that apply to you, including asking us to stop disseminating information where the legal conditions are met.

13. Automated processing

Evidence Checks are produced by automated systems, with deterministic safeguards and — for claims we source from news trends — human review before publication.

Separately, content that receives three community violation flags is automatically hidden pending review. If that happens to your content, you are notified and may request human review. On request, we will tell you the principal factors behind the decision.

14. How we protect information

Traffic is encrypted in transit (HTTPS). Passwords are stored only as salted cryptographic hashes. Access to administrative functions is restricted and verified against the database on every request. No system is perfectly secure, and we cannot guarantee absolute security.

15. If something goes wrong

We maintain a register of confidentiality incidents. If an incident presents a risk of serious injury, we will notify the Commission d'accès à l'information and the affected persons as the law requires, and act to reduce the harm.

16. Minors

The Service is not for children under 14, and we do not knowingly collect their personal information. If we learn we hold information about a child under 14 without the required consent, we will delete it.

17. Changes to this policy

If we change this policy, we will post the new version with a new effective date and, for material changes, notify you in the Service or by email before the change takes effect.

18. Contact

Soval · Brossard, Québec, Canada · info [at] sovalsocial [dot] com

Person in charge of the protection of personal information: the Founder, reachable at info [at] sovalsocial [dot] com.

Commission d'accès à l'information du Québec: cai.gouv.qc.ca · 1-888-528-7741.