What is stored, and what leaves.

01Who is responsible for your data

Verity is software that someone runs. The organisation operating the instance you are signed in to is the controller of everything in your account, and it is the party you exercise your rights against. For this deployment that is operatorlegal entity, registered address and the contact for privacy questions is operatorprivacy contact address.

If you run Verity yourself, none of your data reaches the authors of the software. There is no phone-home, no licence check, and no telemetry endpoint in this codebase. Your controller is you.

02What Verity stores

An account holds only what the product needs to be the product. In a normal deployment that is:

• Account record. Email address, a password hash if you signed up with a password, and the provider identifier if you signed in with GitHub. Passwords are never stored in a readable form and never reach Verity’s own services.
• Conversations. Titles, messages, and the model responses to them, including any images or files you attach.
• Work you create. Projects, artifacts, knowledge base entries, flows, and offices, together with their schedules and run history.
• Memory. Facts the system has extracted from your conversations so it can carry context forward, and the tags it filed them under.
• Connector configuration. Which MCP servers you have added and which header carries their credential. The credential itself is encrypted and is write-only: it can be set and replaced, and it is never returned by any API, not even to you.
• Usage ledger. An append-only record of metered actions, used to enforce your plan limits and to bill. It records that an action happened and what it cost, not what you said.

03What leaves the deployment

This is the part worth reading closely, because it is the part people usually assume rather than check.

• Model providers. Verity does not train or host models. When you send a message, its content goes to whichever provider the operator configured, under that provider’s own terms and retention policy. For this deployment the configured providers are operatorlist of model providers. Verity cannot make promises on their behalf, and neither should the operator.
• Pages you ask it to read. If you give the assistant a URL, the fetch service requests that page. The site you named will see a request.
• Connectors you add. An MCP server you configure receives the tool calls you approve, along with the credential you gave it. Adding a connector is a decision to share with a third party.
• SpiderMesh. If a job runs on contributed SpiderMesh capacity, the work unit travels to the node that executes it. See the SpiderMesh page for what a node can and cannot see.

Nothing else leaves. There is no analytics provider, no error-reporting service, no advertising network, and no data broker in this codebase.

04What this website stores in your browser

One cookie once you sign in, which holds that session. Two entries in local storage: your theme, and the fact that you read the storage notice. All three are necessary, none is shared, and none is used to profile you. The storage policy lists each one and lets you inspect and clear what is actually there.

05How your data is kept separate from other accounts

Tenant identity travels between services as call metadata and is never read out of a request body, so a client cannot assert whose data it is asking for. Every stored record is scoped to an account, and the data layer treats a missing tenant filter as an error rather than as a wildcard: a query that forgets to scope itself fails instead of returning everyone. A cross-tenant test corpus runs in CI on every push and fails the build if isolation breaks.

A record that is not yours is reported as not found. That is deliberate: an account should not be able to learn that something exists by being told it is forbidden.

The Security page describes each layer and what it enforces.

06How long it is kept

Content you create is kept until you delete it or close your account. Deleting a conversation, artifact, or knowledge entry removes it from the deployment; backups age out on the operator’s schedule, which is operatorbackup retention window.

The usage ledger is append-only and is retained for operatorledger retention period, typically set by tax and accounting law, because it is a billing record. It contains metered events and their cost, not message content.

07Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, take it elsewhere in a portable form, object to particular processing, or complain to a regulator. Verity is built so these are ordinary operations rather than favours: everything in your account is scoped to your account and can be exported or removed.

To exercise any of them, contact operatorprivacy contact address. The operator responds within operatorresponse window, commonly 30 days. Your supervisory authority is operatorrelevant data protection authority.

One honest limit: content already sent to a model provider is subject to that provider’s retention, and deleting a conversation here does not reach into their systems.

08Security incidents

If a breach affects your data, the operator notifies affected accounts and, where the law requires it, the relevant authority. Report a suspected vulnerability to operatorsecurity contact address. Reports made in good faith will not be pursued.

09Changes

Material changes are announced in the changelog before they take effect, with the effective date above updated. A change that widens what leaves the deployment will always be called out explicitly rather than folded into a general update.