Privacy Policy

Last updated: 16 October 2026

This policy explains what personal data the Verena app (including the Verena App Clip) and the website verena.se (together, the "Service") process, and why. Verena is built to prove that a real person is present without learning who that person is, so we collect as little as we can.

1. Who we are

The Service is operated by Hidde Lycklama ("we", "us"). For any privacy question or request, contact hiddenlybv@gmail.com.

2. What stays on your device

• Biometrics and passcode. Face ID, Touch ID and your passcode are checked by iOS. Verena never receives your face, fingerprint or passcode, only the result that iOS confirmed it was you.
• Your private key. When you register, the app creates a signing key in your device's secure hardware. The private key never leaves the device and is not synced or backed up.

3. What we process when you use the app

• Device registration. We store your device's public key and a random credential identifier. To check that registration comes from a genuine copy of the app on a real Apple device, the app uses Apple's App Attest service, and we verify the result. This record contains no name, email, phone number or other identifier of you.
• Verification requests. When a website asks you to verify, we create a short-lived session that records which website asked. Sessions are kept in memory only and expire after 5 minutes.
• Proofs. Your device generates a cryptographic proof that it belongs to the set of registered devices, without revealing which one. We check the proof and give the website a one-time token, which we store only as a hash and which expires after 1 hour. The website learns that a registered device and a present person confirmed the request, not who you are.
• Technical logs. Like any web service, our hosting infrastructure may record technical information such as IP addresses and request times, for security and troubleshooting. We do not use these logs to identify or profile you.

4. What we process on our website

• Website operator accounts. If you sign up to integrate Verena into your own website, we store your email address, whether you verified it, your passkey's public key and your API keys (secret keys only as hashes).
• Waitlist. If you join the waitlist, we process the name, email address and optional company and website you enter, to contact you about the Service.

5. What we don't do

We do not use advertising, analytics or tracking SDKs, in the app or on the website. We do not sell or rent personal data, and we do not track you across apps or websites.

6. Service providers

• Fly.io hosts our servers and database.
• Resend sends our emails (account verification and waitlist notifications).
• Apple provides App Attest and Face ID / Touch ID on your device, under Apple's own privacy policy.

These providers process data only on our behalf and may be located outside your country. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses.

7. Legal basis

We process app and account data because it is necessary to provide the Service you asked for, and technical logs and abuse prevention on the basis of our legitimate interest in keeping the Service secure. Waitlist data is processed based on your request to be contacted.

8. How long we keep data

• Verification sessions: up to 5 minutes. Proof tokens: up to 1 hour.
• Device registrations, operator accounts and waitlist entries: until you ask us to delete them, or until we no longer need them to run the Service.

9. Your choices and rights

You can delete your device registration at any time in the app under Settings → Delete credential. This deletes the key from your device and the public key and credential identifier from our server. If you delete the app without doing this first, the record stays on our server but no one can use it, since the key that matches it is gone. Delete the credential in Settings first if you want the server record removed too.

Depending on where you live, including under the EU GDPR and the Swiss Federal Act on Data Protection, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to complain to a data protection authority. To exercise these rights, email hiddenlybv@gmail.com. Because device registrations are not linked to your identity, we may need your credential ID (shown in the app's Settings) to find yours.

10. Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from them.

11. Changes

We may update this policy. We will change the date at the top when we do, and for significant changes we will give notice in the app or on this website.

12. Contact

Questions or requests: hiddenlybv@gmail.com. See also our Terms of Use and Support page.