Legal
Privacy Policy
The short version
- Verkle reads only the files and photos you choose, to sort them, find duplicates and clutter, and answer your questions.
- File contents are sent to Google's Gemini API to be read, on paid terms under which Google does not use them to train its models.
- We don't sell your personal information, don't use it for advertising, and don't use your files for anything except providing Verkle to you.
- Nothing is deleted without your approval. You can disconnect any service, or delete your account and everything with it, at any time from the Account screen.
1. Who we are
Verkle is a service operated by One Matter Inc., a Delaware corporation doing business as "Verkle", with its principal office at 3733 160th PL SE, Bothell, WA, 98012 ("we", "us" or "our"). This Privacy Policy explains how we collect, use, share, protect and delete personal information when you use the Verkle website at verkle.ai, the Verkle web app, and related emails and support (together, the "Service").
For people in the European Economic Area, the United Kingdom and Switzerland, One Matter Inc. is the "controller" of personal information processed through the Service. If you have a question or request, contact us at support@verkle.ai.
This policy should be read together with our Terms of Service and our Consumer Health Data Privacy Policy.
2. Information we collect
2.1 Information you give us
- Account details: your name, email address and password. Passwords are stored only as a one-way cryptographic hash (bcrypt); we cannot read them.
- Sign in with Google: your Google account identifier, name and email address. Signing in with Google does not give Verkle access to your Google Drive or Google Photos.
- Communications: messages you send us, such as support requests and feedback, and our replies.
- Chat questions: the questions you type into Ask Verkle.
- Your agreements: when you agreed to our Terms (and which version), and when you gave consent to the processing of sensitive information in the files you choose (see section 8).
2.2 Information from services you choose to connect
Only when you connect a service, and only for the items you choose:
- File details (metadata): names, sizes, types, dates, folder paths and the provider's identifier for each file or photo, and for photos the date taken.
- File contents: the contents of the files and photos you choose, which Verkle reads so its AI can sort them (see section 4). Photos and videos can contain embedded details (metadata), such as the camera used and the location where they were taken. Verkle keeps these as part of a stored file, and they may be included when a file is sent to Gemini to be read, but Verkle does not extract, use or show location information.
- Connection keys (OAuth access and refresh tokens) that let Verkle act on your behalf within the permissions you granted. They are stored encrypted.
2.3 Information Verkle creates
- For each file: a content fingerprint (a SHA-256 hash) used to recognise exact copies, and the AI's results: a category, tags, a short summary, and whether the file looks like a duplicate or clutter, with the reason.
- Your choices in Verkle, such as files you keep, mark as not needed or move between categories.
- Cleanup history: when you cleaned up, how many files and how much space, and where files were moved (for example, your Google Drive trash).
- Plan and usage information: your plan, trial dates and daily usage counts (AI reads and chat questions), used to apply plan limits.
2.4 Files Verkle stores a copy of
- Files you upload from your computer, phone or iCloud, and copies of Google Photos you pick (Google's links to picked photos expire after about an hour), are stored in private cloud storage so Verkle can read and show them to you. They are never publicly accessible.
- Files in Google Drive and OneDrive are not copied and kept. Verkle downloads them temporarily to read them and deletes the temporary copy afterwards.
2.5 Payment information
Payments are processed by Stripe. We never receive or store your full card number. We keep your Stripe customer and subscription identifiers, your subscription status and renewal date.
2.6 Technical information
- Server logs: our hosting provider records standard request information, such as IP address, date and time, the page or address requested, and browser type, to operate and secure the Service.
- Security signals: we use IP addresses and email addresses temporarily to limit repeated sign-in and password-reset attempts.
- Error reports: if the Service has a technical problem, we may record what went wrong, with passwords, keys, links and email addresses removed first. Our application logs and error reports are designed to refer to files by an internal identifier, not by name or contents.
We do not use third-party advertising, analytics trackers or social-media pixels.
3. How we use information
- To provide the Service you ask for: reading and sorting the files you choose, finding duplicates and clutter, answering your chat questions, preparing backups you request, and moving files to their service's trash only when you approve a cleanup.
- To run your account: sign-in, email confirmation, password resets, plan limits, billing and support.
- To keep the Service safe: preventing fraud, abuse and unauthorised access, and enforcing our Terms.
- To fix and improve the Service: diagnosing errors and understanding, in aggregated form, how features are used. We never use your files' contents for this.
- To communicate with you: service emails such as confirmations, receipts, security notices and changes to our terms. We currently send only service emails (see section 14).
- To comply with law and protect our rights and the rights of others.
We do not sell your personal information, use it for targeted advertising, build advertising profiles, or use the contents of your files for any purpose other than providing the Service to you.
4. AI processing
To sort a file, Verkle sends its contents to Google's Gemini API with instructions for sorting it. For very large media, Verkle may send a representative sample (for example, a few short clips of a long video). When you use Ask Verkle, your question and the details (names, categories, tags, short summaries) of up to 50 of your files are sent, and a file's contents if your question needs them.
- We use the Gemini API on Google's paid service terms. Under those terms, Google does not use the content we send to train or improve its models. Google may keep it for a limited period to detect abuse and comply with law, as described in the Gemini API Additional Terms.
- Large media uploaded to Gemini's file service is deleted by Verkle as soon as it has been read (and is deleted by Google automatically within 48 hours in any case).
- We do not store your chat conversations after the answer is shown to you.
- AI results can be wrong. Verkle's suggestions (for example, that a file looks like clutter) never have legal or similarly significant effects on you: you decide what to keep and what to clean up, and nothing is cleaned up without your approval.
- We do not use your files, or Google or Microsoft user data, to develop, improve or train generalised AI or machine-learning models.
5. Google user data
| Permission you grant | What Verkle does with it |
|---|---|
| Sign in with Google: your name, email address and Google account identifier (openid, email, profile) | Creates your Verkle account and signs you in. Nothing else. |
| Google Drive: "See, edit, create and delete only the specific Google Drive files you use with this app" (drive.file) | Reads the files you choose in Google's file picker so the AI can sort them and find duplicates and clutter. Moves a chosen file to your Google Drive trash only when you approve a cleanup. Verkle cannot see any other file in your Drive. |
| Google Photos: the photos and videos you pick (Google Photos Picker) | Reads the items you pick so the AI can sort them and find duplicates, and keeps a private copy so you can view them later. Google does not allow apps to delete photos, so Verkle gives you a checklist and you delete them yourself in Google Photos. |
In particular, Verkle:
- uses Google user data only to provide and improve the user-facing features described above, which you can see in the app;
- transfers Google user data to others only as necessary to provide or improve those features (to the service providers in section 10), to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you;
- does not use or transfer Google user data for serving advertisements, including retargeting, personalised or interest-based advertising;
- does not sell Google user data, and does not use or transfer it to determine creditworthiness or for lending purposes;
- does not allow humans to read Google user data, unless you give us permission for specific messages or files (for example, for support), it is necessary for security purposes such as investigating abuse, to comply with applicable law, or the data has been aggregated and anonymised for internal operations;
- does not use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models.
You can disconnect Google Drive or Google Photos at any time in Verkle (Account → Connected services), and remove Verkle's access completely at myaccount.google.com/connections.
6. Microsoft (OneDrive) data
When you connect OneDrive, Verkle asks Microsoft for permission to read and write your files (Files.ReadWrite). Microsoft's permission technically covers all files in your OneDrive, but Verkle opens only the folders you browse and the files and folders you pick. It also asks for permission to stay connected without asking you every hour (offline_access) and to read your basic profile (User.Read). Verkle uses this access only to list folders when you browse, read the files you pick or the folders you choose to follow, so the AI can sort them, and to move a file to your OneDrive Recycle Bin when you approve a cleanup. Verkle does not use Microsoft data for advertising and does not sell it. You can disconnect OneDrive in Verkle, and remove its access at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts).
7. iCloud and files on your device
Verkle never asks for your Apple ID or signs in to iCloud. When you choose files, photos or a folder on your device (including your iCloud Drive folder), your browser lets Verkle read only what you chose. If you connect a folder in a supported browser, Verkle can move files you approve for cleanup into a "Verkle Trash" folder or, for iCloud Drive, delete them so they go to iCloud's Recently Deleted. The permission to a connected folder is stored by your browser, on your device, and you can remove it in your browser's site settings at any time.
8. Sensitive information in your files
The files you choose may contain sensitive information, for example about health, finances, government identifiers, or other people. When you create your account or first open Verkle, we ask for your explicit consent to process such information in the files you choose. You can withdraw it at any time in Account → Your consent: Verkle then stops reading your files straight away (processing already done is not affected), and you can delete your files and account at any time. Verkle processes this information only to provide the Service you asked for (reading, sorting and helping you clean up those files), not to infer characteristics about you, profile you, or for any other purpose. Labels such as "Healthcare & Medical" or "Tax Documents" describe a file's subject so you can find it; they are not used about you in any other way. Please don't choose files you aren't comfortable having processed as described in this policy.
Our Consumer Health Data Privacy Policy explains how we handle any consumer health data and your rights over it. It applies to all Verkle users.
9. We do not sell your personal information
We have not sold personal information, and we have not "shared" it for cross-context behavioural advertising, in the past 12 months, and we will not do so.
10. Who we share information with
We disclose personal information only:
- To service providers (processors) that run parts of the Service for us, under written contracts that allow them to use it only to provide their services to us and require them to protect it:
| Provider | Purpose | Information involved |
|---|---|---|
| Google LLC (Gemini API) | Reading files and answering chat questions | Contents of files you choose; chat questions; file details |
| Render Services, Inc. | Hosting the website and server | All information processed by the Service, in transit and in memory; server logs |
| Neon (Databricks, Inc.) | Database | Account details, file details, AI results, encrypted connection keys, usage and cleanup history |
| Cloudflare, Inc. (R2 storage and DNS) | Private storage for uploaded files and Google Photos copies; domain name service | Stored file copies |
| Stripe, Inc. | Payments and subscriptions | Name, email, payment details you give Stripe, subscription status |
| Resend (Plus Five Five, Inc.) | Sending account emails | Email address and email contents (for example, a confirmation link) |
| Functional Software, Inc. (Sentry), if used | Error reports | Technical details of errors, with passwords, keys, links and email addresses removed |
| Google LLC (Google Workspace) | Our support mailbox | Messages you send to our support address |
- To the services you connect, as needed to do what you ask (for example, telling Google Drive to move a file to its trash when you approve a cleanup).
- For legal reasons: if we believe in good faith that disclosure is required by law, subpoena or court order, or necessary to protect the rights, property or safety of our users, the public or us. Where permitted, we will tell you about requests for your information.
- In a business transfer: as part of a merger, acquisition, financing, reorganisation or sale of assets, subject to this policy, with notice to you before your information becomes subject to a different privacy policy.
- With your consent or at your direction.
We may share aggregated or de-identified information that cannot reasonably be used to identify you. We maintain such information in de-identified form and do not attempt to re-identify it.
11. Where your information is processed
We are based in the United States, and our service providers process information mainly in the United States. If you use the Service from outside the United States, your information will be transferred to, stored and processed in the United States and other countries whose data-protection laws may differ from yours. Where required by law, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses (and the UK Addendum) in our providers' data-processing terms.
12. How long we keep information
| Information | How long |
|---|---|
| Account details, file details, AI results, stored file copies, cleanup history | While your account is open, until you remove them or delete your account |
| Temporary downloads used to read a file | Deleted as soon as the file has been read |
| Files you remove from Verkle | Their details and any stored copy are deleted straight away |
| Connection keys | Until you disconnect the service or delete your account |
| Daily usage counts | While your account is open |
| Email confirmation and password-reset links | Until used or expired (48 hours and 1 hour), then no longer usable |
| Sign-in sessions | Up to 14 days after your last visit, or until you sign out |
| Server logs and error reports | For a limited period set by our providers, typically up to 90 days |
| Database backups | Overwritten on a rolling basis within our database provider's backup window (no more than 30 days) |
| Payment and tax records | As long as required by tax and financial law (Stripe keeps its own records under its privacy policy) |
| Support messages | As long as needed to help you and keep a record of our communications, generally up to 3 years |
When you delete your account, we delete your personal information from our live systems straight away, except where we must keep limited records to comply with law, resolve disputes or enforce our agreements.
13. Security
We use administrative, technical and physical safeguards designed to protect your information, including: encryption in transit (HTTPS/TLS); encryption of connection keys (AES-256-GCM); password hashing (bcrypt); private storage for file copies, served only to their signed-in owner; access controls so each account can reach only its own files; limits on repeated sign-in attempts; and removal of secrets from error reports. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a security breach affecting your personal information, we will notify you and the authorities as required by law.
You are responsible for keeping your password secret and your devices secure. Tell us straight away at support@verkle.ai if you believe your account has been compromised.
14. Your choices and controls
- Remove files from Verkle at any time; their details and any stored copy are deleted.
- Disconnect a service in Account → Connected services. Verkle deletes its connection key (and, for Google, asks Google to cancel the permission when no other Google service is connected). You can also take that service's files off your Verkle list.
- Withdraw your consent to the processing of sensitive information in Account → Your consent. Verkle stops reading your files straight away; you can't use the Service again until you agree again, and you can still delete your account.
- Delete your account in Account → Delete account. This deletes your account, file list, AI results, cleanup history and every file copy Verkle kept, cancels any subscription, and takes back Verkle's Google access. Your original files in Google Drive, OneDrive, Google Photos, iCloud and on your devices are not touched.
- Email: we currently send only service emails (such as email confirmation, password resets, subscription confirmations and security notices), which are needed while you have an account. If we ever send optional emails, you will be able to opt out of them.
- Or email support@verkle.ai and we will help.
15. US state privacy rights
Depending on where you live (for example, California, Colorado, Connecticut, Oregon, Texas, Virginia, Washington and other states), you may have the right to:
- know and access the personal information we hold about you, including the categories, sources, purposes and recipients described in this policy, and to receive a copy in a portable format;
- correct inaccurate personal information;
- delete personal information;
- opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we do none of these);
- limit the use of sensitive personal information (we use it only as needed to provide the Service you request);
- not be discriminated against for exercising your rights.
How to make a request: use the controls in the app, or email support@verkle.ai from the email address on your account. We will verify your request by confirming that it comes from that address, and we will respond within 45 days (or the time your law requires), extendable once where permitted. You may use an authorised agent; we may ask the agent for proof of your signed permission and ask you to confirm your identity with us. We honour Global Privacy Control signals as a request to opt out of sale and sharing, although we don't sell or share personal information.
Appeals: if we decline your request, you may appeal by replying to our decision or emailing support@verkle.ai with the subject "Privacy appeal". We will respond within the time your law requires. If you are not satisfied with our answer, you may contact your state Attorney General.
Notice at collection for California residents
| Category (California law) | Examples | Purposes | Disclosed to |
|---|---|---|---|
| Identifiers | Name, email address, account identifiers, IP address | Providing the Service, account, security, support | Service providers |
| Customer records | Name, email, subscription status | Account, billing | Service providers (Stripe) |
| Commercial information | Plan, subscription and payment history | Billing, plan limits | Service providers (Stripe) |
| Internet or network activity | Server logs, usage counts | Security, operating and fixing the Service | Service providers |
| Sensitive personal information | Account login credentials; contents of files you choose (which may include health, financial or identification information, photos, video and audio, and location details embedded in photos) | Only to provide the Service you request and keep it secure | Service providers |
| Inferences | AI labels about your files (category, duplicate, clutter) | Showing you your files sorted; not used to profile you | Not disclosed, except as processed by service providers |
We collect these categories from you, from the services you connect, and automatically from your use of the Service. We keep them for the periods in section 12. We do not sell or share any category, and we do not use sensitive personal information to infer characteristics about you.
16. EEA, UK and Swiss residents
Legal bases. We process personal information: to perform our contract with you (providing the Service, your account and billing); for our legitimate interests in keeping the Service secure, preventing abuse, fixing errors and improving the Service (balanced against your rights); to comply with legal obligations; and with your consent where we ask for it (you can withdraw consent at any time). Where your files contain special categories of data (such as health information), we process it only with your explicit consent (GDPR Article 9(2)(a)), which you give when you create your account or first open Verkle and can withdraw at any time in Account → Your consent (withdrawal does not affect processing already done).
Your rights. You have the right to access, correct, delete or receive a portable copy of your personal information; to object to or restrict certain processing; and to withdraw consent. To exercise them, email support@verkle.ai; we will reply within one month (extendable where the law allows). You also have the right to complain to your local data-protection authority, for example in the UK the Information Commissioner's Office.
17. Cookies and browser storage
- One essential cookie,
verkle.sid, keeps you signed in (for up to 14 days after your last visit). It is strictly necessary and does not track you across other websites. - Browser storage on your device only: the folders you connected (the permission is held by your browser) and a few display preferences. It never leaves your device.
- Fonts and images: Verkle serves its own fonts and images. The "Continue with Google" button shows Google's logo, which your browser loads from Google.
- Payments: when you upgrade, you're taken to Stripe's checkout page, which uses its own cookies under Stripe's privacy policy.
We don't use advertising, analytics or cross-site tracking cookies, so there is nothing to opt out of.
18. Children
Verkle is only for people aged 18 and over and is not directed to children. We don't knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, contact support@verkle.ai and we will delete it.
19. Other websites and services
The Service connects to services operated by others, such as Google, Microsoft, Apple and Stripe. Their handling of your information is governed by their own privacy policies, and we are not responsible for their practices.
20. Changes to this policy
We may update this policy from time to time. We will change the effective date at the top and, for material changes, notify you by email or in the Service before the changes take effect. Where the law requires your consent to a change, we will ask for it.
21. Contact us
One Matter Inc. (doing business as Verkle)
3733 160th PL SE, Bothell, WA, 98012
support@verkle.ai