DRAFT — PENDING LEGAL REVIEW. This document has not yet been reviewed by counsel and may change.

OneVerdict — Forensic Intelligence Platform

Privacy Policy

Draft of 23 July 2026 · Contact: kartfelds@gmail.com

1. Who we are

OneVerdict ("we", "us") operates a forensic media-authentication service at 1verdict.com and oneverdict.net. You submit a media file (image, video, audio, or document); our automated multi-agent system analyzes it for signs of manipulation and produces a verdict and a forensic report. This policy explains what data that involves, where it lives, how long we keep it, and how to have it removed.

2. What we collect

The uploaded media file itself — the photo, video, audio recording, or document you submit for analysis. Uploaded files may contain personal data (faces, names, metadata); you are responsible for having the right to submit them.
A SHA-256 cryptographic hash of the file — used for chain of custody and duplicate detection, plus a perceptual hash for images (near-duplicate and mirror detection).
Derived forensic artifacts — per-agent findings, anomaly descriptions, heatmaps and analysis overlays, cross-reference scores, the verdict, and the generated PDF report.
Optional context you provide — subject name, relevant dates, reference photos or ID documents (used only by the face-intelligence and contextual analysis you request).
Your IP address — used for rate limiting (abuse prevention) and appearing in standard server logs.
Account data, if you register — email address and a salted password hash. Registration is optional; anonymous analysis is available.
Audit records — a tamper-evident, hash-chained log of what the system did with each case (analysis events, expert sign-offs, report issuance).

We do not collect advertising identifiers and we do not run third-party advertising or tracking scripts.

3. Where it is stored

Database records (case metadata, hashes, findings, verdicts, audit log, account data) are stored in a PostgreSQL database hosted by Supabase.
Media files, reports, and heatmaps are stored in Cloudflare R2 object storage.
The application runs on Render.

4. How your file is processed

Most analysis runs locally on our own servers using our own algorithms and models. For some analyses, the media file (or a downscaled copy) is transmitted to third-party AI providers for a vision-model opinion, and to provenance services for reverse-image lookup. These calls are made only to produce your analysis, and are subject to each provider's terms.

5. Retention

Media objects in R2 (uploads, generated reports, heatmaps) are automatically deleted 90 days after upload by a storage lifecycle rule.
Database records (case metadata, findings, verdicts, hashes, audit log) are retained until you request deletion, so that issued reports remain verifiable.

6. Your right to deletion

You can delete a case and everything derived from it at any time, in either of two ways:

Self-service: send an HTTP DELETE request to /v1/verify/<case-id>. This permanently removes the case, all agent findings, the report, the stored media objects, and the case's audit records. For cases created under an account, the request must be authenticated as that account.
By email: write to kartfelds@gmail.com with the case ID (or, if you do not have it, enough detail to identify the upload). We will delete the data and confirm.

Deletion cannot be performed while an analysis is still running; retry once it finishes.

7. Who sees your data

We do not sell personal data, and we do not share it with anyone except the subprocessors below, which we use to operate the service:

Subprocessor	Purpose
Render	Application hosting
Supabase	PostgreSQL database hosting
Cloudflare	Object storage (R2), DNS, edge network
Anthropic	AI vision analysis (Claude)
Google	AI vision analysis (Gemini), reverse-image lookup (Cloud Vision)
OpenAI	AI vision analysis
NVIDIA	AI vision analysis (NIM hosted models)
SerpApi	Reverse-image provenance lookup
SendGrid	Transactional email (expert-review notifications)
Sentry	Error monitoring

Cases escalated for human review are seen by vetted expert reviewers under confidentiality obligations, solely to review the analysis.

8. Security

Files are validated on upload, referenced by cryptographic hash for chain of custody, and stored in access-controlled storage. Audit records are hash-chained so tampering is detectable. PDF reports are permission-protected. No system is perfectly secure; do not upload material you are not permitted to share.

9. Nature of the results

Verdicts are the output of probabilistic automated analysis. They can be wrong, they may be marked provisional pending human expert review, and they are not legal advice and not a certified expert opinion unless explicitly signed off by a named human expert. See the Terms of Service.

10. Changes and contact

We will update this policy as the service evolves; material changes will be reflected on this page with a new date. Questions, complaints, and data requests: kartfelds@gmail.com.