Who runs Avouch
Avouch is run by Aaryan Mahtani in Sydney, Australia. It isn't a registered company yet and has no ABN; this page will name the company when there is one. Write to aaryan.mahtan@gmail.com about anything on this page.
What we keep
| When you | We keep | Why |
|---|
| Join as a seller | Your name, email, the handle and platform you post on most, what your followers are into, the country if you give it, the moment you said you're 18 or over, who invited you (if anyone), the connection address you joined from, and the private address of your portal. | To match you to apps, make your links and codes, email your portal link, tell one person from another, and slow down sign-up floods. |
| Are invited by us | Your name, email, the platform and public handle we found you on, a short note on why, and whether the invite was sent, opened or used. We find these on public profiles; nobody gets an account they didn't ask for. The invite link fills in your email only together with the code in the email we sent you; without that code it shows your first name and handle and leaves the email empty. | To send one personal invite and know whether you used it. |
| Film takes in your portal | The video and sound of the takes you record or upload (and, while an upload is unfinished, its pieces), and the film our engine makes from them. | To make your film. A person may watch a post to check it's really you on camera before it earns the on-camera rate. Your takes are never used to train any model and never shown to anyone but you, the reviewer, and the people who see the post you choose to publish. |
| Log a post | The address of your post, whether it's on camera, and the link we made for it. | To count that post's clicks and sales and send you its report. |
| Set up payouts | The ID of your Stripe account (it starts acct_) and whether it's ready. Payouts are in test mode today. | To know where your money goes. Stripe's own pages collect your bank and identity details; we never see them. |
| Click a seller's link | That a click happened, which link, when, and a short daily code made by scrambling your connection address, browser and the date together. Not your address itself. | To count clicks and different visitors, and to leave out a seller's clicks on their own link. |
| Buy through a seller | What the app reports: its order number, the amount, the currency, whether you're a new customer, the app's payment reference, which seller or code, and, if the app sends it, your email scrambled into a short one-way code, keyed with a secret only our server holds, so it can't be checked against a list of addresses. Also the connection address the sale was reported from: when the app reports it from your browser (our tracking pixel), that is your address. The pixel also writes a short log of each report (the address, the time and the app), which we delete after 30 days. | To credit the seller who sent you, to refuse a seller buying through their own link, and to slow down fake reports. The one-way code can't be turned back into your email, but anyone who already had your email could match it, so it is never shown on a receipt or to anyone else. |
| (any sale) | A signed receipt: the product, the amount and currency, whether it was a new customer, the app's payment reference, the seller's public code (never their name), and its status. | So anyone can check the sale was real. A receipt is public to anyone who has its address. It never contains a buyer's name or email. |
| Read a lesson, open a dispute, write to us | That you read it, what you write in a dispute, and your messages to us and our replies. | Payouts open after the lesson on saying it's an ad. A dispute is read by the app and by us. Never put a buyer's personal details in one; the form refuses an email or phone number. |
| Ask for your portal link again | A scrambled code of the email you typed, your connection address and the time. We delete these after 30 days. | So nobody can flood one inbox with link emails. |
| List an app, or ask for platform access | The app's name, address and description, your name, company and work email, the share you set, a signing secret for your sales, your Stripe webhook secret if you add one, and the type of each Stripe event we receive. API keys and the tokens apps get when you connect them through OAuth are kept only as scrambled hashes. The private address of your listing's manage page is a long random key, kept as it is, like a seller's portal address. | To run the listing and the account, and so only you can report its sales. We open the app's public address to check it's live and has a refund policy. |
| Join the founder waitlist | Your app's name and address, the builder you used, and your email. | To tell you when Avouch opens to you. |
| Run the sandbox | Nothing about you except the connection address that started the run, kept with it to limit runs an hour. The run uses made-up data in its own throwaway database, and both are deleted when it's an hour old (at the latest by the next day's clean-up). | To show the real system working. |
| Unsubscribe, or delete your account | Your email address, on a do-not-email list, and nothing else with it. | So we never email you again from any list. Joining again yourself takes you off it. |
Emails
These are all the emails Avouch sends: your portal link (when you join, claim an invite, or ask for it again); at most one message a day in your first week as a seller (for example, that your post is ready); our replies when you write to us; and one personal invite to sell, to people we found on public profiles, which says why you got it. Every invite carries a link that stops all emails from us. Once you unsubscribe or delete your account, nothing more is sent to you, except your portal link if you ask for it yourself. We never send anyone else's offers.
What is stored in your browser
When you join, the page keeps your portal's address in your browser on that device, so it can open it again. While you fill in the seller application, it keeps your place on that device (your name, email, where you post, your handle and what your people are into) for up to 14 days, so you can come back to it; it is cleared once you join. The portal remembers which tab you had open, on that device only. There are no advertising or analytics trackers. Pages load their fonts from Google Fonts, which receives your connection address when they do. The landing page's smooth scrolling runs in your browser and sends nothing.
Who sees it
An app sees the sales credited to its sellers, each seller's public code and handle, and the posts that sold. Sellers see their own numbers. The operator sees everything above. We don't sell any of it or give it to anyone else, except the services below and where the law requires.
The services we use
The host that runs the site and stores the database and videos: Railway (railway.com), in its US West region, so what we hold is stored in the United States. Email, once it's switched on: Resend, which receives each email's address and text to deliver it. Payouts, once they're live: Stripe, whose own pages collect bank and identity details; we never see those. Until payouts are live, no bank details, card numbers or tax forms are collected.
Who can sell
You must be 18 or over to join as a seller. The sign-up asks, and won't go through until you say you are.
How long we keep it
Set by the code today: the pixel's log, the portal-link asks and the other connection logs, 30 days. A sandbox run, about an hour. Your saved place in the application, in your browser, 14 days. Backups: one copy of the database a day, on the same storage, each kept 14 days, so anything deleted is gone from the backups within 14 days. Everything else: for as long as your account is open, then deleted or stripped of your details as the next section says. Your takes and films are deleted when you ask, or when you close your account.
Seeing, changing or removing it
You can do both without writing to us. With your portal's private key (the part after /m/ in your portal address), /api/me/<key>/export downloads everything we hold about you, and a request to /api/me/<key>/delete deletes your account; a paused account's portal shows the download link. Deleting removes your takes, films and posters (and any unfinished upload), wipes your name, email and handles, ends your portal link and removes any invite we sent you. The records of sales stay for the apps' books, without your name. Your email stays only on the do-not-email list, and, if you were banned, a scrambled code of it that can't be turned back, so the ban holds. A business can do the same with its manage page's key, at /api/f/<key>/export and /api/f/<key>/delete. Or write to the address above from the email you joined with, and we'll send you a copy of what we hold, fix it, or delete it, within 30 days. Signed receipts already issued stay valid, because others rely on them, but we remove anything in them that could identify you.