Privacy Policy
What Verified Handles collects about you, why, who sees it, how long we keep it, and what you can do about it.
Effective 26 October 2026.
Who we are
Verified Handles is run by JEM MEDIA LTD (“JEM Media”, also styled “JEMEDIA”, “we”), a company registered in England and Wales, company number 16287434, registered office 195-197, Suite Ra01 Wood Street, London, United Kingdom, E17 3NU. JEM Media is the controller of the personal data described here.
For anything about your personal data, email privacy@jemedia.xyz. For help with Verified Handles itself, email support@verifiedhandles.org.
What this policy covers
This policy covers verifiedhandles.org, the Verified Handles apps for iPhone and Android, and the emails we send. It adds to the JEMEDIA Privacy Policy, which covers your JEMEDIA account and applies here too. Where this policy says something more specific about Verified Handles, this policy applies.
Signing in with JEMEDIA Accounts
You sign in to Verified Handles with a JEMEDIA account, at auth.jemedia.xyz, which JEM Media also runs. Verified Handles never sees or stores your password, passkeys or authenticator. When you sign in, JEMEDIA Accounts tells us your account ID, your name, your email address once you have verified it, and whether you administer Verified Handles.
If you use Sign in with Google there, Google’s data goes to JEMEDIA Accounts, not to us. How it is used is set out in the JEMEDIA Privacy Policy’s section on Google user data.
What we collect
When you visit, whether or not you sign in:
- your IP address, browser (user agent), the page you asked for and the time, in our server logs and in those of Google Project Shield, which sits in front of the site;
- anonymous visitor statistics (see Visitor statistics);
- technical details of any error the site hits, such as the page and browser.
When you have an account:
- your JEMEDIA account ID, name, verified email address, role, when you joined and last signed in, and your preferences (copying, email notifications, recent searches, and who sees your name on what you did);
- your sign-in sessions, held on our server, and the cookie that points to one;
- what you send us: suggested changes, reports, claims, applications and their evidence, comments, and images you upload, each with the time and the IP address it came from;
- a log of what you do on the site (edits, reviews, signing in and out, and other actions), with the IP address it came from;
- an edit to an entry you have started and not yet saved or discarded, so you can pick it up on any device;
- if you create API keys, their names and dates (never the key itself, only a one-way hash of it); if you link a Wikimedia account, its username and an encrypted access token;
- copies of the emails we send you, and whether your address has bounced or reported our email as spam (from Amazon SES).
If you email us, we have your message and email address. Your recent searches stay in your browser; only your choice to keep them is saved to your account.
The Verified Handles apps
The Verified Handles apps for iPhone and Android do what the website does, and everything else in this policy applies to them too. This section covers what is different on a phone.
On your phone. The app keeps the entries you save, your recent searches and the entries you opened, and any edit you have started, on your phone, so they open quickly and work offline. When you sign in, it keeps your sign-in in the phone’s secure storage (the Keychain on iPhone, the Keystore on Android), which is left out of backups and never moved to another phone. Signing out removes your sign-in from the phone, and deleting the app removes everything it kept there.
What reaches us. When you sign in, the app tells us your phone’s name (such as “Alex’s iPhone”), whether it is an iPhone or an Android phone, and the app’s version, so you can tell your devices apart in your list of devices. If you turn on notifications, it sends us a push token: an identifier for your phone that lets us send it notifications. If the app crashes, it sends us a crash report saying what went wrong and which app and phone versions it happened on, with no name, email address, sign-in or search in it. Crash reports pass through our server to our own error tracker, which never receives your IP address. Otherwise the app sends us what the website would: the searches you make, the entries you open and what you submit.
Notifications. We send them through Expo, which hands them to Apple (on iPhone) or Google (on Android) to deliver; both act for us as service providers. They receive your push token and the notification itself, which says only that something happened, such as a decision on something you sent us: never the text of a submission, anyone’s name or an email address.
No tracking, no analytics. The app contains no analytics or advertising code, does not track you across other companies’ apps or websites, and does not use your phone’s advertising identifier. We count how much the apps are used from our own server’s records of the requests they make, not from anything that identifies you.
Searches and lookups. When you search, or check an account you have shared to the app, what you typed or shared travels to us in the request’s web address. Our server logs keep those addresses, with the IP address they came from, for about a year (see How long we keep it), to keep the service running and secure. They are never linked to your account.
Signing out. To sign out on the phone in your hand, choose Sign out in the app’s Settings. To sign out a phone you no longer have, remove it from your list of devices, in the app’s Settings or in Settings under My account on the website; removing a device does not stop someone holding it from signing in again. Sign out everywhere, in the same places, signs you out of the apps and the website on every device at once, and then offers to sign your JEMEDIA account out everywhere too, so that a lost phone cannot sign straight back in.
Who is listed, and how to be removed
Verified Handles lists notable public figures and organisations only: people and bodies whose public role means others look for their official accounts, as our eligibility policy sets out. It is not a directory of private individuals, and an entry about someone who does not meet that policy is removed.
An entry holds its subject’s name and the official accounts, websites and identifiers they publish themselves, and may show an image of them. It never holds private contact details, home addresses or private accounts. This comes from public sources such as Wikidata, Wikipedia and Wikimedia Commons, from the subject or their team, and from contributors, and we check it before it is published. Entries are reference data, released into the public domain under CC0 so that anyone can reuse them. We publish them because it is in the public’s and the subject’s interest that people can tell real accounts from impersonators (legitimate interests).
If an entry is about you, or someone you represent:
- Claim it: sign in, choose Claim on the entry’s page, and prove that you run one of the accounts or the website it lists. Once your claim is confirmed, your changes to the entry go live straight away.
- Correct it: sign in and choose Edit to propose a change, or Report it to tell us what is wrong (see Corrections).
- Ask for a correction or removal: in the Verified Handles app, open the entry and send a request about yourself from its report options, signed in. Without an account, or from the website, contact us with “Content removal” in the subject. What a removal takes off the site is set out in Removing information about yourself.
How we use it, and our lawful bases
| What for | Lawful basis |
|---|---|
| Running your account, signing you in, and handling what you send us (reviewing it, replying, publishing it) | Contract: providing the service you asked for |
| Emails about your applications and other submissions | Contract; you can turn them off at any time |
| Keeping IP addresses and the log of actions to investigate abuse, fraud and impersonation, rate limits, and keeping the site secure | Legitimate interests: protecting the site, its users and the people listed on it |
| Showing who made each change in an entry’s history | Legitimate interests: an accurate, accountable public record |
| Anonymous visitor statistics, error reports, and backups | Legitimate interests: running a reliable service |
| Stopping email to addresses that bounce or report spam | Legitimate interests: not sending unwanted or undeliverable email |
| Answering lawful requests, and keeping records the law requires | Legal obligation |
Where we rely on legitimate interests, you can object (see Your rights). We never sell personal data, and never use it for advertising or profiling.
Visitor statistics
To see how the site is used, we count visits with Plausible Analytics, open-source software we run on our own server. It sets no cookies and stores nothing on your device. It records the page you visit, the site that linked you here, your browser, operating system, device type and country, which handles you open, and roughly how quickly each page loaded and responded to you. Your IP address is used only to tell one day’s visitors apart, through a code that changes every day and cannot be traced back to you; the address itself is never stored. None of it is shared with anyone else or used for advertising.
Content you submit
When you suggest a change or claim an entry, your submission is handled solely by us and used only to improve the database. Contributed content (excluding email addresses or other personal information) is released into the public domain under CC0 when published. Who made a change is shown in the entry’s history under the name you choose to show, or as “Verified editor”.
Service providers
| Provider | What for | Where |
|---|---|---|
| Hetzner Online | The server Verified Handles runs on, its database and its logs | Falkenstein, Germany |
| Google (Project Shield) | Protection against attacks, encryption and caching in front of the site; it sees your IP address and the pages you ask for | Global |
| Google (Workspace) | Our mailboxes, including the one you reach through Contact us | Global |
| Amazon Web Services (Route 53) | DNS for verifiedhandles.org | Global |
| Amazon Web Services (SES) | Sending our emails, and telling us when one bounces or is reported as spam | London, UK (eu-west-2) |
| Expo (650 Industries) | Sending the apps’ notifications on to Apple and Google; it sees your push token and the notification | United States |
| Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) | Delivering the apps’ notifications to your phone | Global |
Visitor statistics (Plausible) and error reports (GlitchTip) run on our own server, so no one else receives them. Images come from Wikimedia Commons through our own server; when you open an image full size, your browser loads it from upload.wikimedia.org, and Wikimedia receives your IP address under its own privacy policy.
International transfers
Our server is in Germany, which the UK recognises as giving adequate protection (UK adequacy regulations for the EEA). Google, Amazon, Apple and Expo may handle data in the United States and elsewhere; where they do, the transfer relies on the UK Extension to the EU-US Data Privacy Framework for certified providers, or otherwise on the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
How long we keep it
| Data | Kept for |
|---|---|
| Your account, preferences and linked Wikimedia account | Until you delete your account |
| Sign-in sessions | 7 days after you last used the site, and never more than 30 days |
| Sign-ins from the apps, with each phone’s name, kind and app version | 400 days after the app was last used on that phone, unless you sign out or remove the device first |
| Push tokens | Until you sign out on that phone, remove the device, or delete your account |
| API keys | Each works for at most 90 days; its name and dates stay until you delete your account |
| Your submissions and comments | Published ones stay as part of the public record; unpublished ones go when you delete your account |
| Your unsaved edits to entries | 30 days after your last change, unless you save or discard them first, or delete your account |
| Your changes to entries, and the log of actions | As long as the entry’s history; moved to an anonymous account when you delete yours |
| IP addresses with submissions and in the log of actions | 1 year, then erased |
| Who asked for an entry to be refreshed from Wikidata | 1 year |
| Copies of emails we sent | 30 days |
| Addresses that bounced or reported spam | Until the address is no longer used on an account, or 1 year after the last report |
| Server and access logs (IP address, browser, the web address asked for, including searches and lookups) | 1 year |
| The application’s own logs | 14 days |
| Error reports | Up to 1 year |
| Logs of our Wikidata sync and rate limits (no personal data) | 30 days; daily request counts 400 days |
| Visitor statistics | Kept, but hold no personal data |
| Emails you send us | As long as we need them to deal with your request |
| Backups | Up to 6 months, so anything deleted is gone from them by then |
Each time you sign in or out, the log of actions records it with the IP address it came from, and that address is erased after a year, like the others.
Security
The site is served only over HTTPS. We never hold your password, only a one-way hash of each API key, and the Wikimedia access token encrypted. We limit how fast anyone can make requests, and keep a log of every change so abuse can be traced and undone.
Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable form.
- Download your data yourself: sign in, open Settings under My account, and choose Download my data. It is one JSON file with your account, preferences, submissions, comments, edits, the log of your actions with their IP addresses, your API keys’ names (never the keys), the emails we sent you, and more. Other people in it are named as the public sees them.
- Delete your account yourself from the same page (see Deleting your account).
- For anything else, email privacy@jemedia.xyz. We respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to put it right first.
Deleting your account
You can delete your Verified Handles account yourself, from your Settings, under My account, when signed in. That deletes your profile, preferences and API keys, and every submission of yours that was never published, with its comments, takes your address off our email lists, and signs you out everywhere. What you contributed to entries stays, because an entry’s history is the public record of how it came to say what it says; it moves to an anonymous deleted account that is not linked to your name, your email or your sign-in, so signing in again starts a new account. The one exception is an account that was blocked when it was deleted: we keep a code made from its sign-in with a secret key, which cannot be turned back into it, so that signing in again starts the new account blocked too, until an administrator lifts the block. IP addresses are erased one year after they were recorded, including those kept for a deleted account, and backups age out within six months.
In the Verified Handles apps, the same deletion is in Settings, under Delete account. Delete your Verified Handles account sets out every step, and works without signing in.
Deleting your Verified Handles account does not delete your JEMEDIA account. To delete that too, use Delete your JEMEDIA account; How to delete your account explains both, and works without signing in.
Emails
We send email only about things you did: an application or other submission being received, needing an answer from you, or being decided. We never send marketing. Our email comes from no-reply@verifiedhandles.org through Amazon SES. Every message has an unsubscribe link, and you can turn the emails off in Settings under My account. If an address bounces permanently or reports our email as spam, we stop emailing it.
Children
You must be 13 or older to have an account or send us anything. If we learn that an account belongs to someone younger, we delete it.
Changes to this policy
The date this version took effect is at the top. When we change this policy in a way that matters, we say so on the site before the change takes effect.
Contact
Data protection: privacy@jemedia.xyz. Help with Verified Handles: support@verifiedhandles.org. By post: JEM MEDIA LTD, 195-197, Suite Ra01 Wood Street, London, United Kingdom, E17 3NU.