Privacy, in short

Three kinds of data: what you give us (email, optional profile details used for survey matching), what using Vouch generates (your ledger), and technical signals (your IP address and the browser details your requests already send). The technical signals mostly exist to stop fraud, which we do under “legitimate interests” with a documented assessment behind it.

If you sign in with Google, Google shares your name, email address and profile picture with us, and nothing else. Sign-in itself is run by our authentication provider, Clerk; we never see your Google or Vouch password.

Before your first gift card we also ask for a UK mobile number and text you a code. It has to be a real mobile line, not a virtual or internet number. We use it only to confirm it's you and to keep one person to one account. We don't market to it or share it beyond the service that sends the code.

To stop the same person claiming an offer twice, we link accounts that share a verified phone number. A shared internet connection on its own never links accounts, so housemates and families are fine. When accounts are linked, a repeat claim is held and a person reviews it. Nothing is decided by the link alone, and you can always ask us to look again.

The services that run Vouch (login, hosting, email, gift-card issuing) and our offer partners, so your completions get attributed and validated. Some providers are US-based; those transfers use approved safeguards.

We don't sell your data, and we don't run advertising trackers.

Essential cookies (login, security) run without asking. Everything else asks first, and “reject” is as easy as “accept”. No advertising cookies at all, and we don't fingerprint your device.

You can access, correct, or delete your data, object to processing, and complain to the ICO. Requests go to support and are handled within the statutory windows.