Privacy policy

Who is responsible

Verus Communications Ltd operates Verus and is the data controller for the purposes of the UK GDPR and the Data Protection Act 2018.

Verus Communications Ltd, company number 17429651, C/O Usque Ltd, 97 Alderley Road, Wilmslow, Cheshire SK9 1PT, United Kingdom. Questions about this policy, or about your data, go to hello@verusapp.co.uk.

What Verus never asks for

You do not give Verus a phone number, an email address or a name to use it, and there is nowhere to put one. There is no column for any of them. You are not asked for your contacts and the app never uploads an address book. Signing up produces an address, which is a fingerprint of a key your device generated and holds, and nothing else.

That is not a promise about how we behave. It is a description of a database that has no field to put those things in.

The early access list, which is this website and not the service

There is one place on this site where we do ask for an email address: the form on the homepage for being told when the apps reach the stores. It would be easy to leave that unmentioned here, and it is exactly the kind of thing this page exists to say out loud.

It is a list held by this website. It is not an account, it is not attached to any Verus address, and it does not travel to the service. The row is an email address and the day you joined, and there is nothing else in it: no name, no IP address, no referrer, no tracking pixel and no third party. Joining sends you nothing, because a list that emails you on submission is a list anybody can use to post mail at somebody else.

The promise is one message, on the day there is something to install. Ask at hello@verusapp.co.uk and the row is deleted. The lawful basis is your consent, given by typing it in.

Applying to host a Verus Relay

The form on the Verus Relay page, which the apps show too, asks what you would host and your country, with your connection and a note if you like. It also asks how to reply: an email address, or your Verus address if you would rather stay anonymous. It goes straight from your browser to the Verus service, never through this website.

We keep exactly what you typed and the day it arrived, nothing about your browser and no IP address, to handle your application. It is deleted a year after it arrives, or sooner if you ask. If you give a Verus address, that address is linked to your application for as long as we keep it. We reply to you in Verus. The lawful basis is your consent, given by sending the form.

Your Verus account still has no email on it. The account table has no column for one, and the deployment says so itself when anybody asks it, which is the only form of that statement worth anything.

Joining a Verus for Business team

A team on Verus for Business can ask everyone who joins to show it is their work email. If you join one, the app asks for your work email address and Verus sends a six digit code to it, from lj@verusapp.co.uk, through our website host SiteGround's mail service in the United Kingdom. You type the code back into the app, and the service gives your device a signed note saying that your Verus address read mail sent to that address. Your device passes that note to the team's admin, who sees the address next to your name. You then confirm with Confrmo that it is you.

While the code is waiting, for ten minutes at most, the service holds a scrambled form of your email address and of the code that cannot be read back, and nothing else. Once you type the code, or it runs out, both are deleted. The service never learns which team or company you are joining, and it keeps no record that you checked an email at all. Your email address stays on your device and the devices of the team you joined, and leaves the team when you do. The lawful basis is your consent, given by asking for the code, and the legitimate interest of the team in knowing who its members are.

The investor data room, which is this website and not the service

One more part of this website holds personal data, about a small number of people: the due diligence data room at verusapp.co.uk/dataroom/, where we share confidential documents with people considering an investment in Verus and their advisers. You can only use it if we invite you. It has nothing to do with the Verus app.

If we invite you, we hold your name, email address and organisation. We send one-time sign-in links to that address from trust@verusapp.co.uk, through our website host SiteGround's mail service in the United Kingdom. Each time you sign in, view or download a document we record the time, your IP address and your browser. The first time you sign in you accept a confidentiality acknowledgement. We record when and from which IP address, with a SHA-256 fingerprint of the exact text you accepted. Every PDF you open is marked with your name, email address, the time and a reference number, so that a copy that turns up somewhere can be traced to the person it was prepared for.

The room sets one cookie, to keep you signed in for up to seven days. It sets nothing else: no analytics and no third party. Only our admins can see the record. It is held by this website's host in London and is not connected to the Verus service or to any Verus address. The lawful basis is our legitimate interest in managing a confidential disclosure in a proposed investment and keeping that information secure. Everything about you in the room is deleted 365 days after the room is closed.

Ask Verus, the assistant on this website

Ask Verus answers questions about Verus on this website. It belongs to the website, not the service: it has no connection to the Verus app, your address or your conversations. It cannot see or change anything in them. Using it is optional.

When you ask it something, your question and the earlier questions and answers in the same chat are sent from our website host to Anthropic, the company that provides the AI model, in the United States, to write the answer. Nothing else goes with them: no IP address, no browser details and no identifier. Anthropic deletes them within 30 days, unless its automated safety checks flag them as breaking its usage policy, when it can keep them for up to two years, or the law requires it to keep them longer. It does not use them to train its models.

We do not keep what you type. The conversation is held in your own browser tab and is gone when you close it. To stop the assistant being misused, the website keeps a scrambled form of your IP address, which cannot be read back and changes every day, with a count of your questions, for at most a day. Beyond that it keeps only a daily total of questions asked. The lawful basis is our legitimate interest in answering questions about Verus. Please leave out personal details.

What the server does hold

All of it, with why it exists and how long it stays.

Messages

A message is encrypted on the device that sends it and decrypted on the device that receives it. The server stores it as a block of bytes it cannot read, holds it until the recipient collects it, and deletes it then. Undelivered messages are deleted after thirty days whether they were collected or not.

The stored message carries who it is for, because otherwise it could not be delivered. It does not carry who sent it. There is no sender column in the table, so the server cannot produce a record of who talked to whom, and neither can anyone who takes a copy of it.

Attachments

Photos, files and voice notes are encrypted on your device before they are uploaded. The server holds the encrypted bytes, an identifier and two timestamps, and holds no filename, no type and no thumbnail. They are deleted after seven days.

Translation, and no AI in the app

Verus can show a message you receive in the language your phone is set to. It happens on the device: Apple's Translation framework on iPhone, iPad and Mac, and ML Kit on Android and, for Hungarian and Hebrew, which Apple's framework does not offer, on iPhone too (since 11 October 2026). Both work against a language pack the phone downloads once from Apple or Google. No message text is ever sent anywhere to be translated. There is no translation provider and no model API, which is the only reason the feature exists at all.

On Android, and on iPhone when a Hungarian or Hebrew message needs translating, ML Kit is Google's software and it talks to Google itself. It downloads the language models from Google. Google's SDK also sends Google telemetry about how it is running: device information, an identifier for that installation of the app, performance metrics, error codes and the languages involved. The text of your messages is not part of it.

There is no artificial intelligence service anywhere in the Verus apps or the service that carries your messages. No message, call, address or other app data of any kind is shared with one. Nothing you write in Verus is sent to a model, used as a prompt or used to train anything, here or by anyone else. The one place AI appears is Ask Verus, the optional assistant on this website, which has no connection to the app and sends only what you type into it. The demonstration account on our try it page is not an exception to that: it is a fixed list of phrases on our own server, matched against what you send, with nothing behind it.

Notifications

If you turn on notifications, your device gives a token to its push service and the server stores it so it can wake the app: Apple's push service on iPhone and Mac, and Google's Firebase Cloud Messaging on Android. The wake itself is empty: it carries no sender, no preview and no content, and the message is fetched by your device over the encrypted connection after it wakes. That is how a new message reaches your lock screen while Verus is closed.

This is the one place the Verus service stores an identifier that a third party also holds. It is worth being straight about that. Apple or Google can see that a device was woken and when, and nothing else about the message. Turning notifications off removes the token. Older Android versions of Verus, which collect messages themselves, register no notification token with anyone.

Verification with Confrmo

Verification is optional and an account works without it. If you choose it, Confrmo tells Verus that an account holder approved this, and, where Confrmo asserts it, that the person's live face was matched against an identity document Confrmo verified. Verus stores that answer as a signed claim attached to your address, along with anything you actively chose to reveal, which is usually nothing.

Verus stores the reference Confrmo returns only after hashing it again under a key held on the server, so a copy of the Verus database on its own cannot be matched back to a Confrmo account or to another Verus deployment. Removing the claim leaves the same address working, unverified.

Paying for Verus Plus

Verus Plus can be bought through the App Store or Google Play, where Apple or Google take the payment and Verus never sees your card or your Apple or Google account. On this website it can also be paid for from your own wallet to a published address, in VSolidus (VSOL), Bitcoin, Ether, or USDT on Tron.

A payment in any of these coins is public on its blockchain, as every payment on it is. Verus watches the chain for the exact figure it quoted and holds no wallet key. For Bitcoin, Ether and USDT the chain is read through public services (listed on the sub-processors page); our server asks them about our own receiving address and nothing about you. It never records the wallet you paid from or the transaction. If you give your Verus address with the order, the server keeps it with the order only until the payment confirms, usually about ten minutes, and then deletes it; what is left says that a purchase exists and how far it is paid up, and nothing joins it to your address. If you would rather not give an address at all, you get a code instead and enter it yourself.

How you type

Verus can watch how this device is being typed on, so it can ask whether it is still you holding it. That is the risk sign up cannot see: an account is proved once, and a phone is handed over afterwards.

This is off unless you turn it on in the You tab. It is the only feature in Verus that has to be switched on rather than off. Measuring how somebody types in order to recognise them is biometric data in the legal sense, and biometric data deserves a decision rather than a default. Turning it on is your explicit consent, and turning it off deletes what was learned rather than parking it.

What is measured is rhythm and habit: the gaps between keystrokes, how often you correct yourself, how long your messages are, whether you write contractions with the apostrophe. Not the words. What is stored is a running average and spread, which is a handful of numbers, not a history of anything you wrote.

None of it is ever sent anywhere. There is no request in Verus that carries any of it and no column in any table to receive it. It lives in the encrypted file on the device alongside your keys, and it goes when the account goes. If it ever became something transmitted, this page would have to change first, and it would say so.

When the device stops recognising you it asks you to confirm. It does not lock you out, because the most common reasons for typing differently are being tired, being injured, using a different keyboard or dictating, and none of those should cost anybody their messages. Declining removes your verification badge, which is the claim that has actually stopped being true, and leaves everything else working.

Screenshots and recording

While anything is recording or mirroring the screen, conversations are not drawn at all, and the app is covered when it is not in front. Android refuses screenshots outright, because its window manager provides a way to say so. iOS provides no way to prevent a screenshot, and we would rather write that down than imply otherwise: what happens there is that a screenshot is detected after the fact and the person who wrote the message is told it happened.

Messages can also be kept covered until you tap one, which is the only setting that changes what a screenshot, or a camera, can actually capture.

What none of that stops is a second phone pointed at the screen, and nothing can: once the light has left the display, no software has any say in what happens to it. What Verus does instead is print a faint mark across the conversation carrying the address of the device it is being read on, so a photograph that appears somewhere can be traced to who was holding the screen.

Logs

The service logs operational events such as an address registering or a claim being minted, with the address involved, and web server access logs record IP addresses in the ordinary way. Both are kept for thirty days for security and abuse handling, and are not used to build a profile of anybody.

Who else the app talks to

Almost everything the app does goes to the Verus service and nowhere else. There are five exceptions. Each happens only for the reason given here:

• Google, on Android, and on iPhone for Hungarian and Hebrew, for ML Kit: the language model downloads and the SDK telemetry described under translation above.
• Google Firebase Cloud Messaging, on Android, if you turn on notifications: the token and the empty wakes described under notifications above.
• Confrmo Ltd, at api.confrmo.com, only when you choose to verify with Confrmo.
• Google Wallet, only when you choose to add a pass to it.
• SiteGround, our website host, only when you join a Verus for Business team and ask for a work email code: its mail service delivers the code to the address you gave.

On iPhone and Mac, Apple is involved in the same limited way: the language pack for translation and, if you turn them on, notifications.

What Verus does with all of this

It runs the service. Nothing here is sold, rented, shared for advertising, used to train anything, or handed to a data broker. There are no analytics, no advertising identifiers and no third party trackers in the app or on this website. Beyond the exceptions listed above, no request from your device reaches anyone but us.

Legal basis

Holding an address, keys and undelivered messages is necessary to perform the contract you enter by using the app. Logs and abuse handling rest on our legitimate interest in keeping the service working and safe. Optional verification rests on your consent, given by choosing to verify, and withdrawn by removing the claim.

Where it is held

Messages, attachments, addresses and keys are held on servers in the United Kingdom, in London, with live copies in Germany and a second London site so the service can keep running if one fails. Calls travel through a Verus Relay near the caller as the normal route, so neither person learns the other's IP address. The relays are in the United Kingdom, the United States, Canada, Brazil, South Africa, Singapore, Australia, Japan or South Korea. The call is encrypted end to end, the relay sees only the two devices' IP addresses and nothing is stored there. Only when both people have chosen to be verified to each other, or belong to the same Verus team, can a call connect directly between the two devices. The radio some relays carry is only a fallback for messages when there is no internet or signal. If that changes, this page changes with it.

Your rights

You have the right to access what is held about you, to have it corrected or erased, to restrict or object to processing, and to receive it in a portable form. Two of those are unusually simple here: deleting your account removes everything tied to your address, and there is little to correct because there is little to be wrong.

You can delete your account from inside the app, in the You tab. You can read what that removes on the account deletion page. Requests by email go to hello@verusapp.co.uk and are answered within one month.

Be aware of what Verus cannot do for you. It cannot recover your messages, because it cannot read them. It cannot tell you who sent you something, because it never recorded that. And it cannot restore an account whose keys are gone.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk, and we would rather you told us first at hello@verusapp.co.uk.

Children

Verus is for people aged 18 and over. People can send each other whatever they like and nobody, including us, can read it to check, which is not a service to put in front of a child.

Verus is not designed for children or marketed to them. Our standards against child sexual abuse and exploitation, how to report a concern and our named child safety contact are set out in our child safety standards.

Changes

If this policy changes in a way that matters, the app will say so rather than quietly updating a page nobody visits. The date at the top always reflects the current version.