Privacy Policy

This policy explains what personal information Soval ("we", "us") collects through the website at sovalsocial.com, the Soval web application, and the Soval browser extension (the "Service"), why we collect it, who we share it with, and the rights you have. We have written it in plain language on purpose.

---

1. Who is responsible

The person in charge of the protection of personal information at Soval is the Founder, reachable at info [at] sovalsocial [dot] com.

2. Who this policy covers

Two groups, and they are different:

People who use Soval — you have an account, or you use the extension. Most of this policy is about you.

People mentioned in claims — Soval assesses claims submitted by users and drawn from public reporting, and those claims can name people and businesses who have never used Soval. If that is you, §12 is written for you.

3. What we collect

Information you provide:

• Account: email address, username, and a password (stored only as a cryptographic hash — we cannot read it), or a Google or Apple sign-in identifier if you choose those instead; your notification and message-privacy preferences.
• Optional profile details: bio, profile photo, and location (country, province, city) if you choose to add them.
• Content you submit: claims (text, images and screenshots, links), comments, direct messages, community signals (boosts, verdict reactions, comment votes, bookmarks, hidden posts), reports, flags, and disputes.

Information generated when the Service runs:

• From images you submit: text extracted from the image (OCR) and reverse-image lookup results, used to research the claim. Screenshots often contain information about other people; §12 applies to that information.
• Verification records: the evidence assessment produced for each claim, its sources, and its history.
• Activity records: your reputation points, badges, and notifications; and an internal per-request cost record that links your account to each paid verification call (it contains no content — we use it to control service costs and detect abuse).

Technical information:

• Your IP address is used transiently for security and rate limiting. We do not store it in our database, with one exception: when you create an account, we store the IP address you signed up from together with your account, solely to limit how many accounts can be created from one address (only the last 7 days are counted). We use it for nothing else, we keep it for as long as your account exists, and we delete it when you delete your account. Standard infrastructure logs at our hosting providers (Railway, Vercel) may retain server logs for a limited period as part of normal operations.
• Your browser's local storage holds your session token and display preferences (for example, dark mode). See §9.

Anonymous posts

When you post a claim anonymously, other users see a randomly generated bird name instead of your username, and the post does not earn reputation. Each anonymous post gets its own name, so other users can't link your anonymous posts to each other or to your profile.

Anonymous posting hides your identity from other users, not from Soval. As with every post, we keep the link between an anonymous post and your account so we can moderate content, protect people named in claims, respond to legal requests, and honour your privacy rights (for example, deleting your account severs this link). Soval staff and moderators can see who posted an anonymous claim when they review a report.

Otherwise, anonymous posts are handled like any other public post: they appear on the public feed, they are verified, and their content — never your identity — may be used as described in section 5.7, including in de-identified form. Your dataset setting never attaches your identity to an anonymous post.

The time of posting is visible. If you post publicly and anonymously about the same story at the same moment, others may be able to connect the two.

Private and shared checks

Private and shared checks (including checks you run from the browser extension) are visible only to you and to people you share them with. Soval moderators can also view them when needed to keep the service safe — for example, to review a report of illegal content or abuse. Moderators do not use private checks for any other purpose.

Usage records

Our servers keep basic usage records so we can understand how Soval is used and improve it. These record that something happened — for example, that you signed in, ran a check, or reached your daily limit — along with which part of Soval you used (the website, the browser extension, or Discord). Each record is linked to your account. They never include the text you check, the pages you visit, or your IP address. We review them as totals; our admin tools do not display any one person's records. We delete the detailed records after about 13 months, and when you delete your account, the link between those records and you is removed (see §10).

4. What we do not do

• We do not sell personal information.
• We use no advertising trackers and no cross-site or profiling technologies on the Service.
• We use two third-party analytics tools, both on our website only. Google Analytics is used only for visitors who consent: it is off by default, nothing is collected until you accept, you can decline with equal ease, and you can change your choice at any time. Vercel Analytics counts page views in aggregate, uses no cookies, does not identify you, and runs for all visitors to the website. See §9 for how each works and §7 for what each receives. Our browser extension contains no analytics of any kind.
• The extension performs no passive reading of the pages you visit and contains no telemetry — it transmits only what you explicitly select or submit, and extension checks are private by default. When you use the extension while signed in, our servers keep the basic usage records described under "Usage records" in §3. Those records never include the text you check or the pages you visit.
• We never display the internal confidence scores our systems produce.

5. Why we use your information

1. To operate the Service — accounts, feeds, profiles, messages, notifications.
2. To produce Evidence Checks — researching the claims you submit against published sources through the providers in §7.
3. To moderate and keep the Service safe — reviewing flags, disputes, and reports; enforcing our Terms of Service; preventing abuse and manipulation.
4. To communicate with you — transactional email only (account verification, password reset, and service notices). We will not send marketing email without a separate consent.
5. To improve the Service — understanding failures and quality issues; understanding how Soval is used through our usage records (see §3); and measuring how the website is used through Vercel Analytics and, for visitors who consent, Google Analytics (see §9).
6. To comply with legal obligations.
7. To build research and commercial datasets. Verification records that contain no personal information — the claim, its evidence assessment, its sources, and how that assessment evolved, with all information identifying you as the submitter removed — are not personal information, and we may retain and use them, including in datasets we license commercially. Our dataset exports exclude personal information by construction. Records that do contain personal information are excluded from these datasets; records that could identify you as the submitter are included only with your separate, optional consent, which you can give or withdraw at any time in your settings.

6. Consent

Where our use of your information rests on consent, that consent is requested in clear language, separately for each purpose. Examples include Google Analytics on the website (§9) and inclusion of submitter-identifying records in our datasets (§5.7). You may withdraw a consent at any time in your settings or by contacting info [at] sovalsocial [dot] com. Withdrawal does not affect processing that already lawfully occurred, and some withdrawals may mean parts of the Service will no longer work (we will tell you which).

7. Service providers — who receives what

We use a small number of service providers to run Soval. Verification providers never receive your identity — research requests carry the claim content, not your name, email, username, or account ID.

Provider	Where	What they receive	Why
Perplexity AI	United States	The claim text being checked, contextual provenance (e.g., "submitted with a screenshot"), and up to approximately 2,000 characters of text extracted from a submitted image	Researching the claim against published sources
OpenAI	United States	Passages of text you selected or a fetched article body (up to approximately 8,000 characters)	Splitting text into checkable claims; classification
Google Cloud (Vision)	United States	Images you submit (retrieved by URL)	Extracting text from images; reverse-image lookup
SerpApi (Google Lens results)	United States	Images of public claims, sent by URL (never private or hidden ones); SerpApi keeps search data for 31 days	Finding other copies of a public image online (reverse image search)
Google Analytics	United States	Only for website visitors who consent: usage data about your visit — pages viewed, approximate location (from IP, which Google processes but we do not store), device and browser type, and a cookie-based identifier. Received from website visitors only, never from the extension	Measuring how the website is used so we can improve it
Supabase	United States	Our database and file storage — the information described in §3	Hosting our data
Railway	United States	Traffic to our backend in transit; server logs	Hosting our backend
Vercel	United States	Traffic to our website in transit; server logs; and, through Vercel Analytics, aggregate usage data about website visits — pages viewed, referring site, approximate location, and device and browser type. No cookies. Received from website visitors only, never from the extension	Hosting our website; counting page views
Resend	United States	Your email address and the content of transactional emails (which include account verification and password reset links)	Sending service email

We require providers to use the information only to provide their service to us. If we add or change providers, we will update this table.

8. Your information leaves Québec

The providers listed above process information outside Québec, primarily in the United States. Before communicating personal information outside Québec, we assess the sensitivity of the information, the purposes for which it is used, the protections in place, and the legal framework of the destination.

9. Technologies on your device

Local storage (always active, essential). We use your browser's local storage for your session token, your display preferences (for example, dark mode), and to remember your analytics choice below. The extension stores your session token locally on your device.

Language cookie (always active, essential). When you choose your language, or we detect it on your first visit, we set one first-party cookie, named NEXT_LOCALE, that lasts one year and remembers whether you read Soval in English or French. It holds nothing else and is not used for analytics.

Google Analytics (website only, consent-based). On our website — not the extension — we use Google Analytics to understand how the site is used. It relies on cookies and is off by default: when you first visit, we ask, and Google Analytics collects nothing unless you accept. You can decline just as easily as accept, and you can change your choice at any time in Settings → Privacy & Analytics. If you decline or ignore the request, no analytics cookies are set and the rest of the site works normally. We do not use advertising cookies, cross-site tracking, or profiling technologies.

Vercel Analytics (website only, no consent step). On our website — not the extension — we use Vercel Analytics to count page views in aggregate. It uses no cookies and does not identify you. Because it sets no cookies, it runs for all visitors to the website and is not controlled by the Google Analytics choice above.

Usage records (on our servers, not on your device). Our servers keep the usage records described in §3. They are listed here so that this section covers everything we use to understand how Soval is used.

That is the complete list; if it grows, this section will say so before the technology is used.

10. How long we keep information, and what deletion does

While your account is active: we keep the information in §3 to run the Service. You can remove items from your visible verification history at any time; removed items are hidden from your view and from other users, but the underlying claim and verdict record is retained for the integrity of the verification system.

Usage records: we delete the detailed usage records after about 13 months. When you delete your account, the link between those records and you is removed.

When you delete your account: we delete or de-identify your account information within 30 days, except where law requires retention or a legal claim requires preservation. The claim and its evidence assessment are retained with the information identifying you as the submitter removed — this preserves the integrity of the verification record, exactly as it does for items you remove from your history while your account is active.

What de-identification means: information that identifies you as the submitter (your email, username, account ID, and the link between your account and the claim) is removed. Claim text and the associated evidence assessment may be retained in a form that no longer identifies you. Note that claim text itself may identify third parties (the people named in the claim) — §12 addresses how those individuals can exercise their rights.

11. Your rights

You may, subject to applicable law:

(a) Access the personal information we hold about you and receive a copy;

(b) Rectify inaccurate or incomplete information;

(c) Withdraw consent as described in §6;

(d) Ask us to stop disseminating information about you, or to de-index it, where the legal conditions are met;

(e) Receive computerized personal information you provided to us in a structured, commonly used format (portability), or have it communicated to another organization where the law provides.

To exercise a right, contact info [at] sovalsocial [dot] com. We will verify your identity and respond within 30 days. If we refuse a request, we will explain our reasons and your recourses.

If you are unsatisfied, you may complain to the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca. If you live elsewhere in Canada, the Office of the Privacy Commissioner of Canada or your provincial privacy regulator may also have jurisdiction.

12. People mentioned in claims — if a claim is about you

Soval's purpose is assessing claims that circulate publicly, and those claims can name people and businesses. If a claim on Soval concerns you:

• What we process is the claim as submitted, and what published, linked sources say about it. Our systems apply stricter evidence requirements before assessing claims that identify a specific person or business, and internal safeguards can withhold an assessment entirely.
• You may contest a claim or an Evidence Check about you — no account required — by contacting info [at] sovalsocial [dot] com.
• You may exercise the rights in §11 that apply to you, including asking us to stop disseminating information where the legal conditions are met.

13. Automated processing

Evidence Checks are produced by automated systems, with deterministic safeguards and — for claims we source from news trends — human review before publication.

Separately, a report that content involves child safety or illegal content automatically hides that content pending review, because visibility is itself the harm in those cases. No other kind of community flag hides content on its own, however many it receives. If you believe this was a mistake, contact us at info [at] sovalsocial [dot] com and a person will review it. On request, we will tell you the principal factors behind the decision.

14. How we protect information

Traffic is encrypted in transit (HTTPS). Passwords are stored only as salted cryptographic hashes. Access to administrative functions is restricted and verified against the database on every request. No system is perfectly secure, and we cannot guarantee absolute security.

15. If something goes wrong

We maintain a register of confidentiality incidents. If an incident presents a risk of serious injury, we will notify the Commission d'accès à l'information and the affected persons as the law requires, and act to reduce the harm.

16. Minors

The Service is not for children under 14, and we do not knowingly collect their personal information. If we learn we hold information about a child under 14 without the required consent, we will delete it.

17. Changes to this policy

If we change this policy, we will post the new version with a new effective date and, for material changes, notify you in the Service or by email before the change takes effect.

18. Contact

Soval · Brossard, Québec, Canada · info [at] sovalsocial [dot] com

Person in charge of the protection of personal information: the Founder, reachable at info [at] sovalsocial [dot] com.

Commission d'accès à l'information du Québec: cai.gouv.qc.ca · 1-888-528-7741.