Plain language, on purpose.

What we collect

• Account data. When you sign up, our authentication provider (Clerk) collects your email address, a hashed password, and basic session metadata. We receive a stable user ID and (if you grant it during sign-up) your name and avatar URL.
• Search history. The topics and titles you score are stored against your account so you can revisit your research. We do not associate searches with any advertising profile.
• Saved opportunities. Anything you save is kept until you delete it. There is no expiration, no surprise purge, no retention-until-we-decide otherwise.
• Waitlist emails. If you join the waitlist, we store your email, optional source tag, and referrer, and we send a confirmation message.
• Operational logs. Standard server logs (IP, user agent, request path) for abuse prevention and debugging. Retained for 30 days, then deleted.

What we do not do

• We do not sell your data. To anyone. For any amount.
• We do not run third-party advertising on Veritas, and we do not share your activity with ad networks.
• We do not enrich your profile with data brokers, social listening tools, or purchase-intent vendors.

Where the research data comes from

Veritas blends signals from public, first-party sources. The two primary sources are Google Trends (aggregate interest over time) and Google Books (catalogue volume and publication velocity). These providers are bound by their own terms and may receive requests from our servers. Every signal surfaced in the product is tagged with its source, so you can always see what informed a given score.

Sub-processors

We use a small, vetted set of vendors to operate the service:

• Clerk — authentication.
• Resend — transactional email (waitlist confirmations, account notifications).
• Render / Vercel — application hosting.
• Postgres (managed) — primary database.

We will notify you by email of any new sub-processor before it processes your data.

Your rights

You can request a copy of all data we hold about you, ask us to correct it, or ask us to delete your account. Email privacy@veritas.pub. We respond within 30 days, usually faster.

EU and UK residents have the additional rights granted by the GDPR; California residents have those granted by the CCPA. We honour both regardless of where you live.

Data retention

We hold data only as long as it serves you or the operation of the service. The current schedule is:

• Account data: retained for the life of the account; deleted within 30 days of account closure.
• Search history & saved opportunities: retained for the life of the account; you can delete any item at any time from the dashboard.
• Waitlist emails: retained until you unsubscribe or ask us to delete them.
• Operational logs: 30 days, then deleted automatically.
• Backups: retained for 90 days for disaster recovery, then rotated out.

Cookies

We use a small set of cookies, and only the ones we need:

• Authentication: a short-lived session cookie set by our auth provider (Clerk) so that signed-in users stay signed in. Strictly necessary.
• Preferences: a small JSON blob in sessionStorage (not a cookie) that remembers your A/B-test variant and form state.
• Analytics: none at the moment. If we add analytics later, we will update this page first and offer an opt-out.

We do not use third-party advertising cookies. We do not place tracking pixels from social networks. We do not fingerprint your device.

Data deletion workflow

You can request deletion in two ways:

1. Self-serve — from the dashboard, Account page, click “Delete account.” This immediately removes your session, saved opportunities, and search history. Account record is anonymised within 30 days.
2. By request — email privacy@veritas.pub from the address on your account. We verify identity with a one-time code, then delete within 30 days and email you a confirmation.

We do not retain financial data after the period required by our payment processor. We do not sell or transfer your data to any third party.

Changes to this policy

If we make a material change, we will email every active account and post a notice in the dashboard at least 14 days before it takes effect. The date at the top of this page is the source of truth.