Privacy Policy

1. Overview

Alibi Ledger, LLC ("we," "our," or "us") values your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you access or use the Trust Onion mobile app, our iMessage extension, our website (trustonion.io), and related services, including any branded or white-labeled versions we operate for organizations (collectively, the "Services"). It also explains how we handle business, investor, and press contact information that we obtain from other sources (Section 2.h).

The Services help trusted groups — including friends, families, clubs, teams, and organizations — check the identity of someone they are talking to. They do this through time-based codewords, verified selfies ("Proofies™"), and cryptographic key exchange between members of a private group. Please read this Privacy Policy to understand our practices before using the Services.

2. Information We Collect

We may collect the following types of information:

a. Information You Provide in the App

Account information (such as your name, email, or other identifiers) when you create a family or organization account; family-group information; encrypted family-backup data when you enable that feature; and user-submitted content such as feedback or in-app support requests.

b. Information You Provide on Our Website

When you reach out to us or interact with our website, we collect what you choose to send us:

• Support requests: when you submit our support form, we collect your name, email address, support category, subject, an optional order or account reference, and your message.
• Newsletter sign-up: your email address and which sign-up form you used, if you choose to subscribe to our weekly Voice Clone Scam Pulse alerts.
• Email to us: if you email us directly (for example, our general, support, press, or legal addresses), we receive the contents of your message and your email address.

Voice safety demonstration: if you choose to use our Hear Your Own Voice Cloned demo, This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. Our voice provider creates a temporary clone to produce the demonstration audio, and we request deletion from our provider immediately after the demo. Submit only your own voice with the speaker's permission, and do not submit another person's voice.

c. Automatically Collected Information

Device information (hardware model, operating system, browser type), log data (IP address, timestamps, and activity on the Services), and cookies or local storage identifiers. When you submit a support request, we record the IP address and browser user agent associated with the submission to help prevent abuse and fraud. Optional analytics and advertising cookies are only used if you agree to them; see Section 4.

d. Codewords Data

Codewords are generated locally on your device using a time-based algorithm and rotate on a schedule. They are never transmitted to or stored on our servers. We have no access to your codewords.

e. Secret Passkeys

Proofie signatures use a standard P-256 WebAuthn passkey. A standard P-256 WebAuthn passkey signs after Face ID, fingerprint or device-passcode unlock. The signature must carry both user-presence and user-verification flags. This is not a crypto-wallet signature. The cryptographic signing identity is the full public key, not its shortened label. Compare the verified full signing key with the person's public key in your shared Trust Onion group. This does not automatically verify a real-world identity or detect AI-generated images.

If you enable family backup, the app encrypts family-group data on your device using a key derived from your passkey. An encrypted backup blob, together with the information needed to identify and restore that blob (such as an initialization vector and key identifier), may be uploaded to our servers. We store only the encrypted backup data and have no ability to decrypt it; decryption happens only on your device.

f. Proofie™ Data

A Proofie™ is a selfie signed using your passkey in the Trust Onion app. Use the app to send and verify Proofies, compare the signing key against the person's full public key in your shared group, and check that the exact original photo has not changed since it was signed. One signature covers the photo hash and size, a unique proof ID, a single-use server nonce, time, What3Words location, optional coordinates, and the latest Arbitrum One block number and hash. The photo and the full signed record are stored on Amazon Web Services (AWS). Our systems handle the related metadata for history, synchronization, display, verification and sharing.

Public by default, under your control. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.

Sending to a selected recipient does not by itself make the photo or signed record private: anyone with the link can view them unless you add a password.

g. Location Information

Proofie signed records include What3Words location and may include optional coordinates. This signed information is viewable by anyone with the Proofie's link unless you add a password. Only create a Proofie if you are comfortable sharing its signed location with people who may see the link. Signed location cannot be changed undetected, but is not independent proof of physical whereabouts.

h. Business, Investor, and Press Contact Information From Other Sources

To reach organizations that may want our white-label service, investors, and journalists who cover scams, we collect professional contact information about people in those roles from other sources. This can include name, job title, employer or outlet, work email address, public social media handles, investment focus or portfolio, articles the person has written, and the public web pages where we found this information. We obtain it from business-contact providers (Hunter and Apollo), from web search and page-fetching services (Exa and Zyte), and from public websites, news articles, and social media. We use it to decide whom to contact, to write and send a relevant business email, to credit reporters and outlets when we share their work, and to keep a record of our outreach.

If you do not want us to use your information this way, email legal@trustonion.io or reply to any outreach email from us. We will stop contacting you, keep only the minimum needed to remember not to contact you again, and delete the rest of the information we sourced about you on request.

i. Email Engagement Information

Our emails are sent through Postmark. For our weekly alerts and our business, press, and investor outreach emails, Postmark records when an email is opened (using a small image in the email), and for outreach emails it also records which links are clicked. These records can include the time, approximate location, and email client or device. We use them to measure whether our emails are delivered and read, and to avoid sending follow-ups to people who are not interested.

3. How We Use Information

We use information to operate, maintain, and improve the Services; to respond to your contact and support requests; to send weekly alerts if you have subscribed (you can unsubscribe at any time); to contact businesses, investors, and journalists as described in Section 2.h; to measure how our website and, with your consent, our advertising perform; to detect and prevent abuse, fraud, and security threats; and to comply with legal obligations and enforce our Terms of Service.

4. Cookies and Similar Technologies

Our website uses three categories of cookies and similar technologies (such as local storage):

• Strictly necessary: remember your privacy choices, keep sign-in and password-protected areas working, and protect our forms against abuse. These are always on.
• Analytics (optional): PostHog product analytics, sent through our own domain (t.trustonion.io). PostHog records pages viewed, clicks, page-leave events, browser and device type, referring site, approximate location derived from IP address, and a pseudonymous identifier. It may also record sessions to show how pages are used; form fields are masked, and our newsletter forms, support form, voice demonstration, and sign-in pages are never recorded or automatically captured.
• Advertising (optional): the Google Ads tag (Google tag / gtag.js) measures whether our ads lead people to download the app. Google receives the page address, IP address, browser and device information, ad-click identifiers, and when you click an App Store or Google Play link. Google may use this information as described in its own privacy policy.

When you first visit, we ask whether you accept these optional categories. Analytics and advertising do not load until you accept, and rejecting is as easy as accepting. You can change your choice at any time from the “Your Privacy Choices” link in the footer of every page or open your privacy choices here. If you withdraw consent, we stop loading these tools and remove their cookies from our domain.

Global Privacy Control: if your browser sends a Global Privacy Control (GPC) signal, we treat it as a choice to opt out of analytics and advertising on our website, without you needing to click anything.

Our homepage video is embedded from YouTube's privacy-enhanced domain (youtube-nocookie.com) and only loads after you click play. Our fonts and page scripts are served from our own domain.

5. How We Share Information

We do not sell your personal information for money. Unless you add a password, a Proofie's photo and signed record can be viewed by anyone with its link, as described in Section 2.f; that access is not limited to your selected recipients or our service providers. Apart from this Proofie sharing, we share personal information only with the service providers described in Section 6 (who process it on our behalf), with Google when you allow advertising cookies (Section 4), when required by law, court order, or government request, or in connection with a merger, acquisition, or asset sale (with notice where required).

6. Third-Party Processors

We use the following service providers. Each receives only the data needed for its function:

• Amazon Web Services (AWS) — securely stores Proofie photos and signed records.
• Neon — hosts our database, which stores support requests, newsletter subscribers, outreach records, and the other information described in this policy.
• Cloud hosting and object storage (Google Cloud) — host our website, servers, and stored files such as images and media.
• Clerk — secures sign-in to our team's internal tools; it processes our team members' sign-in details and session cookies.
• Postmark — sends our emails (weekly alerts and business, press, and investor outreach). It receives recipient names, email addresses, and email content, and records opens and, for outreach emails, link clicks (Section 2.i).
• Make — an automation service that alerts our team about new contact and support messages. It receives your name, email address, subject, category, reference, and an excerpt of your message.
• Slack — our team's internal messaging, where we receive operational alerts that can include a contact's name, email address, or outlet.
• PostHog — website analytics, only with your consent (Section 4).
• Google Ads — advertising measurement, only with your consent (Section 4).
• ElevenLabs — our voice provider for the voice safety demonstration. It receives the voice sample you record and a fixed message, creates a temporary clone to produce the demonstration audio, and we request deletion from our provider immediately after the demo.
• Anthropic (Claude) — an AI model we use to write and review our own articles and social posts, to check content for safety, and to draft business, press, and investor outreach emails. For outreach, it receives the recipient's name and professional details such as firm or outlet, investment focus, portfolio, or recent articles. It may also search the public web to find a journalist's professional contact details.
• OpenAI and Google (Gemini, Imagen) — AI tools we use to produce our editorial content and images. They process our editorial material and public news reports, which can name people mentioned in those reports.
• Hunter and Apollo — business-contact providers we query for professional names, job titles, and work email addresses (Section 2.h).
• Exa and Zyte — web search and page-fetching services we use to find news coverage, organizations, and public professional information (Section 2.h).

Proofie photos and their full signed records are stored securely on AWS. They are public by default, so anyone with a Proofie's link can view it unless you add a password. Our systems handle related metadata to support history, synchronization, verification, display and sharing. Use the Trust Onion app to verify the signed record and original photo and compare the full signing key with the person's public key in your shared group. Deleting a Proofie removes its photo and signed record from AWS and takes its link offline; it cannot recall copies someone has already downloaded or saved.

For the voice safety demonstration, our voice provider processes the submitted sample and the fixed message solely to provide the one-time playback. We use short-lived, minimized hashed IP identifiers to enforce abuse limits; those identifiers are retained only for the rate-limit window and are not used to identify you. The demo has per-IP, daily, shared-capacity, and concurrency limits.

7. Data Retention

We retain personal information in our systems for as long as needed to provide the Services, comply with legal obligations, or resolve disputes. You can delete your account and request deletion of your account data through the app. When you delete your account, we remove your personal information from our systems within 30 days. You can delete individual Proofies at any time, which removes their photos and signed records from our AWS storage. Contact and support records are retained only as long as needed to handle your request and meet our legal obligations. Newsletter subscriptions are deleted when you unsubscribe. Sourced business, investor, and press contact information is kept while it is useful for our outreach, and deleted on request as described in Section 2.h.

Public by default, under your control. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.

8. Security

We use commercially reasonable safeguards to protect data in our systems. Codewords are generated locally and never leave your device. A standard P-256 WebAuthn passkey signs after Face ID, fingerprint or device-passcode unlock. The signature must carry both user-presence and user-verification flags. This is not a crypto-wallet signature. Proofies are public by default; add a password to a Proofie to restrict who can view it. No method of transmission or storage is completely secure.

9. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal information, to object to or restrict how we use it (including our use of sourced contact information for outreach), to withdraw consent for optional cookies, and to opt out of marketing communications. Contact us at legal@trustonion.io to exercise these rights. We may need to confirm your identity before acting on a request.

10. California Privacy Rights

If you live in California, the California Consumer Privacy Act (as amended) gives you additional rights:

• Right to know and access the categories and specific pieces of personal information we have collected about you, its sources, why we use it, and whom we disclose it to.
• Right to delete and correct personal information we hold about you, subject to legal exceptions.
• Right to opt out of the sale or sharing of your personal information. We do not sell personal information for money. Allowing advertising cookies lets Google receive information about your visit for ad measurement, which may count as “sharing” for cross-context behavioral advertising under California law. You can opt out by rejecting advertising cookies through the “Your Privacy Choices” link in the footer (our “Do Not Sell or Share My Personal Information” opt-out), or by using a browser that sends Global Privacy Control, which we honor as a valid opt-out request.
• Right to limit use of sensitive personal information. We do not use sensitive personal information to infer characteristics about you. Voice recordings submitted to the demonstration are used only to produce the one-time playback.
• Right to non-discrimination for exercising these rights.

In the past 12 months we have collected these categories of personal information: identifiers (such as name, email address, and IP address); internet or other electronic network activity (such as pages viewed and email opens); professional or employment-related information (for sourced business, investor, and press contacts); audio information (voice demonstration samples, not retained by us); and the account, Proofie, and location information described in Section 2. The sources, purposes, and recipients are described in Sections 2, 3, 5, and 6. We do not knowingly sell or share the personal information of consumers under 16.

To make a request, email legal@trustonion.io. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to confirm your identity.

11. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you and relevant authorities as required by applicable law.

12. International Data Transfers

Your data may be transferred and stored on servers outside your jurisdiction, including in the US. We ensure appropriate safeguards for such transfers, such as standard contractual clauses where required.

13. Links to Other Sites

Our Services may link to external sites, including the Apple App Store, Google Play, and the news outlets we cite. We are not responsible for the privacy practices of those third parties.

14. Children's Privacy

Trust Onion is designed for family use. Children under 13 may use the app under parental supervision as part of a family group. We do not knowingly collect personal information from children under 13 without parental consent.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website with a revised effective date.

16. Contact Us

If you have questions or concerns, contact:

Alibi Ledger, LLC
30 N Gould St Ste N
Sheridan, WY 82801

Email: legal@trustonion.io

To report content you believe infringes your copyright, see our Copyright & Takedown Requests page.