# Onion Core Vouch — Privacy Notice

## What Vouch stores

A check record stores the requester's name and organization, the stated purpose and certification, token hashes (not the link tokens themselves), the subject's chosen identifiers after signature, the signed consent record and browser user-agent, the generated report, any subject correction note, and lifecycle timestamps.

Vouch does not ask for or store a Social Security number or date of birth for the check.

## What Vouch does not store in logs

Operational logs carry events, statuses, and counts only. They do not carry identifiers, typed signatures beyond the stored consent record, search text, or report contents.

## Who can see a report

The requester sees it through the private requester link. The subject sees and downloads the identical report through the private subject link. The operator ledger shows metadata only — names, purpose category, status, and timestamps — not report contents.

Keep private links private. Anyone holding a link can use the access it grants.

## Retention and deletion

An unsigned consent link expires after 7 days. A report is valid for 30 days. The subject may revoke consent, which immediately blocks requester report access, and may delete the check, which purges the report and identifiers and leaves only a minimal lifecycle tombstone.

## Outside services

The check uses the Onion Core Bridge for public search and XposedOrNot for breach-exposure metadata. An email address supplied by the subject is sent to the breach-metadata service because that lookup cannot happen without it. Search terms derived from supplied identifiers are sent to the search provider through the Bridge.