Legal

Privacy Policy

Last updated: 25 September 2026

TheFakto is a social network for verified real people. Verifying people means handling sensitive data, so we handle as little of it as possible. This policy explains what we collect, why we are allowed to, who else touches it, how long we keep it, and what you can demand from us under the EU General Data Protection Regulation. It goes with the Terms of Service, the Rules and the Cookies page.

1. The short version

We never store your identity document image or your selfie. We keep three results: verified yes or no, your year of birth, and the country of the document.
We never see your card number. Stripe handles payments.
We run no advertising network and build no advertising profiles. We do not sell your data and never will.
We use only strictly necessary storage in your browser, so there is no cookie banner.
You can get a copy of your data, correct it, or delete your account, and one person answers those requests.

2. Who is responsible for your data

The controller is Jan Štegner, a sole trader registered in the Trade Licensing Register of the Czech Republic, doing business in the Czech Republic. Contact for anything in this policy: honzastegner19@gmail.com, in English or Czech. Our mail reaches you from hello@thefakto.com.

We have not appointed a Data Protection Officer. TheFakto is run by one person and we do not currently meet the conditions in Article 37 GDPR that make one compulsory. Jan Štegner answers data protection questions personally. If TheFakto grows to the point where a Data Protection Officer is required, we will appoint one and publish the contact details here.

3. What we collect, item by item

Account data. Your first and last name as it appears on your identity document, your username, your e mail address, and your password stored only as a hash, which means we cannot read it and cannot tell you what it is. Also your profile picture, your bio, the city you choose to show, your language, and the date your account was created.

Sign in with Google. If you use it, Google gives us your name, your e mail address and a Google account identifier so that we can recognise you next time. We do not get your Google password or your contacts.

Verification result. Whether you passed, your year of birth, the country that issued your document, the date of the check, and a reference number for the check at our verification provider. Nothing else. See section 5.

What you publish. Posts, photos, videos, Stories, Wheels, comments, likes, shares, the sounds you put on a video, the Groups and Pages you join or run, and the captions, hashtags and locations you add. Also the record that you ticked the consent box before publishing, with the time you ticked it, because that tick is what makes the responsibility rule in the Rules real.

Messages and calls. Direct messages and voice messages you send and receive, and who you exchanged them with and when. For video calls we process the technical connection data needed to join the two devices. TheFakto has no call recording feature, so we do not hold recordings of your calls.

Moderation data. The result of the automatic check on each upload, reports you send us, reports about your content, what we decided, the statement of reasons we sent you, strikes, limits, and any appeal.

Payment data. What you bought, whether the payment succeeded, the state of your subscription, the identifier Stripe uses for you, and the invoice records we need for tax. Card numbers never reach TheFakto.

Technical and security data. Your IP address, browser and device type, the time of requests, counters used to slow down repeated login attempts, the result of the Cloudflare Turnstile check that keeps bots out, and your session token.

Waiting list. While TheFakto is in closed beta, the e mail address you gave us to join the waiting list and the date you joined it.

Correspondence. What you write to us and what we answer.

Your choices. Which version of the Terms, Rules and this policy you accepted and when, whether you want occasional news from us, and your interface preferences if you save them to your account.

We do not ask for and do not want: your exact GPS location, your contacts, your health data, your political views, your religion or your sexual orientation. If you publish any of that yourself in a post, you have made it public yourself, and you can delete it.

4. Why we are allowed to use it

Every use of your data needs a legal basis. Here is ours, one by one.

To run your account and the service you asked for: performance of our contract with you, Article 6(1)(b) GDPR. This covers your profile, publishing, messaging, calls, Groups, Pages and delivering paid features.
To verify your identity and your age: your explicit consent for the biometric part, Article 9(2)(a) GDPR, together with our need to keep an 18+ service free of minors. Details in section 5.
To keep TheFakto safe: our legitimate interest, Article 6(1)(f) GDPR. This covers bot protection, rate limiting, fraud and scam prevention, screening uploads, enforcing the Rules, and keeping a minimal record so that somebody removed for serious abuse cannot quietly return.
To meet legal duties: Article 6(1)(c) GDPR. This covers the duties in the EU Digital Services Act, such as handling reports, sending you a statement of reasons, executing valid orders from authorities and answering the Digital Services Coordinator; keeping removed terrorist content for six months under Regulation (EU) 2021/784; reporting a suspected crime that threatens somebody's life or safety; and keeping tax and accounting records for payments.
To protect somebody's life: Article 6(1)(d) GDPR, in the rare case where we pass information to emergency services because a person appears to be in immediate danger.
Occasional news from us: your consent, Article 6(1)(a) GDPR, which you can withdraw in one click at any time without losing anything else.
Data you publish yourself that is sensitive: if a post of yours reveals, for example, your health or your beliefs, we process it because you manifestly made it public, Article 9(2)(e) GDPR.

Where we rely on legitimate interest, we weighed our interest against your privacy and limited what we collect accordingly. You can object to it, and section 12 says how.

5. Identity verification, in detail

Every account belongs to a verified real person aged 18 or older. The check is carried out for us by Didit, a specialist identity verification provider acting as our processor. You scan your identity document with your camera and take a live selfie, and Didit checks the document and compares the selfie with the photograph on it.

We do not store your document images or your selfie. They are processed by Didit and do not reach TheFakto. What we receive and keep is: verified yes or no, your year of birth, the country of the document, the date, and a reference number.
The selfie comparison is biometric processing, which GDPR treats as a special category of data. It happens on the basis of your explicit consent under Article 9(2)(a) GDPR, which you give at the start of the check. You are told what happens before you start.
To enforce one person one account, and to stop somebody who was removed from coming back, Didit keeps a template derived from your face and checks whether a document or a face has already been used. That is part of the same consent.
You can withdraw your consent at any time. Withdrawing it does not undo checks already made, and an unverified account cannot use TheFakto, so withdrawal means the account ends. Ask us and we will tell you exactly what remains.
If the check says you are under 18, we do not create an account and we delete what we received, keeping only an irreversible fingerprint of the document and the date you turn 18, so that the same document cannot be used again before then. That fingerprint cannot be turned back into your document.
How long Didit keeps what it holds, and on what terms, is set out in Didit's own privacy notice. Ask us and we will point you to the current version.

Verification tells us that a real adult is behind an account. It does not tell us, and we do not collect, anything else from your document: not your document number, not your address, not your exact date of birth.

6. Payments

Paid features are listed in the Terms of Service. Payments run through Stripe. You type your card details on Stripe's own payment page, under Stripe's own privacy notice, and they never pass through TheFakto. Stripe tells us whether the payment worked, what you bought and the state of your subscription. You manage or cancel a subscription in the Stripe customer portal.

We keep the payment records that Czech tax and accounting law requires us to keep, and nothing more.

7. Automatic content checks, and the part a human plays

Every image, video and text is checked automatically when it is uploaded, using AI models running on Cloudflare. Images are described and screened. Text is screened for unsafe content. The point is to stop the worst material before anybody has to see it.

What this means for you in data protection terms:

The check runs on the content you upload and produces labels and a severity score, which we store with the content.
Clear breaches are refused on upload. Content flagged as severe is hidden until a human reviews it. Two independent severe reports also hide content automatically.
The check can be wrong, in both directions. It can refuse a medical photograph, a sculpture or a piece of reporting.
A human decides whenever you ask. No account is closed by a machine alone. Every restriction comes with a notice telling you whether automated means were involved and how to get a human to look again. You have the right under Article 22 GDPR not to be subject to a purely automated decision that significantly affects you, and the appeal route is how you use it.

We do not use these checks to profile you or to decide what advertising you see, because there is no advertising.

8. Who else touches your data

We use a small number of providers, each bound by a contract to process data only on our instructions.

Cloudflare, Inc. Everything runs on Cloudflare. It hosts the site and the application, stores your files in R2 storage, stores records in the D1 database, runs the AI models that screen uploads, protects us from attacks, and runs the Turnstile check that keeps bots out of sign up.
Didit. Identity and age verification, as described in section 5.
Stripe. Payments and subscription management.
Google. Only if you choose Sign in with Google.
Resend. Sending account e mails such as confirmation and password reset, from hello@thefakto.com.

Other users see what you choose to show them. A public post is public. Your username and profile picture are visible to people who can see your content. Messages are visible to the person you sent them to, who can screenshot them, which no privacy policy can prevent.

Authorities get data when a valid order or a legal duty requires it, and only what the order covers. Where we suspect a criminal offence that threatens somebody's life or safety, we inform law enforcement, as Article 18 of the Digital Services Act requires. Where we are legally allowed to tell you that your data was handed over, we tell you.

We do not sell your data, we do not rent it, we do not share it with data brokers, and we do not pass it to advertisers. There are no advertisers.

9. Data leaving the EU

Some of the providers above are established outside the European Economic Area, or process data on servers outside it. Where that happens, the transfer relies on the European Commission's Standard Contractual Clauses in the contract with that provider, or on an adequacy decision for the country concerned, together with the technical protections that provider applies. If you want to know which of the two applies to a specific provider, ask us and we will tell you.

We do not claim to be able to guarantee that a foreign public authority can never reach data held by a large infrastructure provider. Nobody honestly can. What we can say is that the sensitive part, your document and your face, is never on our systems at all.

10. How long we keep things

We keep data only as long as we have a reason to, and the reason is always one of the legal bases in section 4.

Account data and profile: while your account exists.
Your content and files: until you delete it, or until your account is deleted. Deleted files are removed from storage, and copies inside backups age out within 30 days.
After you delete your account: your profile and content stop being visible at once, and your records and files are deleted within 30 days. Messages you sent remain in the other person's conversation, shown as coming from a deleted account, because the conversation is theirs too.
Verification result: while your account exists. After deletion we keep only a minimal record that a verification took place, so that an account closed for serious abuse cannot be recreated with the same document.
A rejected under 18 check: an irreversible fingerprint of the document plus the date you turn 18, deleted on that date.
Moderation records: the record of a report, a removal, a strike and an appeal for as long as we may need it to answer an appeal, to show a pattern of abuse, or to answer an authority. Records of minor breaches stop counting against you after six months.
Terrorist content we removed: six months, because Regulation (EU) 2021/784 requires us to preserve it and the related data for possible review or investigation, then deleted.
Security and technical logs, including IP addresses: a short period measured in days, and no longer than 90 days, unless a specific security incident or legal claim means we need a particular log for longer.
Payment and invoice records: as long as Czech tax and accounting law requires, which can be up to 10 years for tax documents.
Correspondence with us: up to two years, so that we can follow up on a case and show what we told you.
Waiting list: until you are invited, or until you ask us to remove you, and in any case no longer than 12 months.

11. How we protect it

Everything travels over encrypted connections. Passwords are stored only as hashes. Access to production data is limited to the operator, and there is no team with a shared login. Document images and selfies are not on our systems at all. Card numbers are not on our systems at all. Uploads are screened before they become visible. Cloudflare protects the service against attacks and Turnstile keeps automated sign ups out.

No system is perfect, so also do your part: use a password you use nowhere else, and tell us at once if you think somebody got into your account.

12. Your rights, and how to use them

Under GDPR you can ask us to:

Tell you what we hold about you and give you a copy, Article 15.
Correct anything inaccurate, Article 16. Your legal name comes from your identity document, so correcting it may mean verifying again.
Delete your data, Article 17. You can delete your account yourself in settings. Some records survive where the law requires it, and section 10 says which.
Restrict processing while a dispute about accuracy or legality is resolved, Article 18.
Object to processing we base on legitimate interest, Article 21. We will stop unless we have grounds that override yours, and we will explain them.
Receive your data in a portable form, Article 20, in a structured machine readable file.
Withdraw a consent at any time, Article 7(3), including the consent for verification, with the consequence described in section 5.
Ask for a human decision instead of an automated one, Article 22, as described in section 7.

Write to honzastegner19@gmail.com. We answer within one month. If a request is complicated we may take up to two months more, and we will tell you inside the first month if that happens. It is free, unless a request is clearly excessive or repetitive. If we cannot be sure the request comes from you, we will ask for something that confirms it, and we will ask for as little as possible.

If you think we handled your data badly, please tell us first so we can fix it. You can also complain to a supervisory authority, whether or not you came to us. The Czech authority is Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz. You can also complain to the authority in the EU country where you live or work.

13. If something goes wrong

If personal data we hold is breached, we assess it immediately. Where the law requires it we report it to Úřad pro ochranu osobních údajů within 72 hours of becoming aware of it, as Article 33 GDPR says. If the breach is likely to put you at high risk, we tell you without undue delay, in plain language: what happened, what data was involved, what we have done, and what you should do. We will not hide a breach to protect our reputation.

14. If a user dies

GDPR does not cover the data of people who have died, but decency does. At the request of a close relative or the person handling the estate, with proof of death, we will either freeze the account so that nobody can log into it or change it, or close it and delete the content. We do not hand over messages, content or passwords to relatives, because messages involve other living people. A court or an authority can order otherwise and we would follow the order.

15. Children

TheFakto is only for people aged 18 or older, and verification is how we enforce that. We do not knowingly process the data of anyone under 18. If you believe a minor has an account, report it or write to us and we will check it and act.

16. Cookies and browser storage

We store only what the site needs to work: a sign in cookie, a closed beta gate cookie, and your local preferences. No advertising cookies, no third party trackers, no analytics that follow you around the web. The full list, with names and lifetimes, and the reason we do not show a consent banner, is on the Cookies page.

17. Changes to this policy

If we change this policy we update the date at the top. For important changes we tell you in advance by e mail or in the app, and if a change needs your consent we will ask for it rather than assume it.