Privacy policy

Vouch tells you whether to trust a website using the word of people who were there. A trust service that leaks browsing history is finished, so Vouch is built to hold as little about you as it can. This page says exactly what that is.

Last updated 9 November 2026. Vouch is made by Exivar Ltd., PH3 325 South Park Road, Markham, Ontario L3T 0B8, Canada.

What Vouch never collects

The content of any page you visit. The extension reads nothing from pages. It receives the address of the current tab from the browser and shows what Vouch knows about that domain.
Your browsing history. Passive browsing stays on your device. A visit reaches Vouch only when you act on a site: open the panel, rate it or flag it.
Your phone number in readable form. It is stored only as a salted hash, so Vouch can enforce one account per number without being able to read the number back.
Your name, email address or payment details. Vouch asks for none of them.

What Vouch stores

Account: A random account id, the pseudonym you pick, the date you joined, and a hash of your verified mobile number.
Engaged visits: The domain, and on a product page the path, of a site you opened the panel on, rated or flagged, with the time. Each visit is signed on your device so Vouch can tell it was witnessed by your browser. These visits are what let you write a review and what count towards "people have engaged with this site".
What you write: Your ratings, reviews and scam alerts, shown to other Vouch users under your pseudonym, and the likes, dislikes and requests for proof they receive.
Devices: A public key for each browser you sign in from, so visits can be verified and so you can sign a device out from the dashboard.
Phone verification: When you request a code, Vouch keeps a hash of the code, the hashed number and your IP address for a short time, to stop the same number, address or account requesting codes repeatedly.

Text messages

Vouch sends one kind of text message: a one-time code to the mobile number you enter yourself on your account page, when you press the button to send it. Nothing else is ever sent to that number. No marketing, no reminders, no messages you did not just ask for.

Message and data rates may apply. Reply STOP to any message to stop receiving codes, and HELP for help. Mobile carriers are not liable for delayed or undelivered messages.

Your mobile number and your consent to receive codes are not shared with third parties or affiliates for marketing purposes.

Who sees your data

Other Vouch users see your pseudonym, your ratings, reviews and alerts, and how your account has been received. They never see your phone number, your devices or your visits.
Vouch moderators see held reviews while deciding whether a burst of ratings on a domain is genuine. Removed reviews carry the moderator's notice to you.
Service providers process data on Vouch's behalf and under its instructions: the text message carrier that delivers your code receives the number you entered; the database and hosting providers hold the data above; the sign-in service run by Exivar handles the web dashboard sign-in. None of them may use your data for their own purposes.
Nobody else. Vouch takes no money from the businesses it rates and sells no data to anyone. The only other disclosure is one the law compels.

Domain facts

The facts strip beside a verdict shows a domain's age, registrar, server location and ratings from other review sites. These come from public RDAP and DNS records, the DB-IP IP to Country Lite database, and other services' official APIs. They are about the website, not about you, and your request for them carries no account information.

How long it is kept

Your account, visits and reviews stay for as long as your account exists. Phone verification codes expire after ten minutes. The records behind them count towards rate limits only for the hour after they are created, and are deleted with your account. Sign-in sessions end when you sign out, when you sign a device out from the dashboard, or after 90 days without use.

Your choices

See everything Vouch holds on you in the web dashboard: your sites, your reviews and what happened to them, your devices and your account.
Delete your account from the account page. Your visits, devices and phone hash are deleted. Reviews you wrote stay visible to keep the record honest, attributed to "deleted account" instead of your pseudonym.
Stop sending visits at any time by not opening the panel, or by removing the extension.

For anything this page does not answer, or to ask for a copy or deletion of your data, write to devops@exivar.com.

Changes

When this policy changes, the date at the top changes with it, and anything that affects what is collected is announced in the dashboard before it takes effect.