Who is responsible

VettID's legal entity is in formation (see About). Today this website and the mailing list are run by The VettID Project, which is operated by its founder, Al Liebl. For anything in this notice, write to info@vettid.org.

The short version

• This site sets no cookies and uses no analytics, no trackers and no advertising.
• It loads nothing from anyone but us: the pages, scripts, styles and fonts all come from vettid.org.
• Like every web server, ours keeps request logs. They are described below, and they are deleted after 90 days.
• One record lasts longer: our AWS account's audit log keeps mailing-list addresses for 400 days (see “The mailing list”).
• If you join the mailing list, we keep your email address until you unsubscribe: every mailing-list email from us has a link for that.
• If you request early access at account.vettid.org, we keep your name and email address with the request: see Requests for early access.
• We do not sell or share any of it.

Cookies and browser storage

This site sets no cookies and uses no analytics, so there is no cookie banner and nothing to consent to.

The Privacy Playbooks remember your choices — the device you picked and the steps you ticked off — in your own browser's storage. They are never sent to us. Clear them by clearing the site data for vettid.org in your browser's settings.

When you visit

The site is served through Amazon Web Services (AWS): CloudFront delivers the pages, and AWS WAF, a firewall, sits in front of it. Both keep a record of each request:

• Access logs: the date and time, your IP address and port, the country and network (ASN) that CloudFront derives from that address, the address of the page you asked for including any query string, the referring page and the user-agent string your browser sent, the response status and sizes, the TLS protocol and cipher, and which CloudFront location served you.
• Firewall logs: the same request as the firewall saw it, including the names and values of the request headers and a fingerprint of your browser's TLS handshake (JA3 and JA4). Cookie and Authorization header values are removed before the log is written.

We use these logs to keep the site running, to spot and limit abuse (requests are rate-limited by IP address and by TLS fingerprint) and to count traffic. We do not use them to build a profile of you, and we do not combine them with anything else we hold.

Access logs, firewall logs and the results of our own queries over them are all deleted after 90 days. An older-format copy of the access logs is no longer written; what remains of it is deleted within 30 days of 12 October 2026.

One thing to know about these logs: when you use your mail app's unsubscribe button, the app sends a request whose address contains your unsubscribe code, so that code is in the logs for 90 days. It stays valid until it is used, and all it can do is take your address off the list. The link in the text of our emails does not put the code in the logs.

The mailing list

If you enter your email address in the form on the home page, this is what happens:

• Your address is sent to our sign-up service on AWS. We store it with the time you asked and the status of your request.
• You get a confirmation email. Usually it is the verification email that Amazon's email service (Amazon SES) sends on our behalf; if AWS has already verified your address for us, we send our own email with a link that works once, for 48 hours. You are on the list only after you click that email's link. To send it, AWS keeps your address as a verified address in our SES account. When you confirm through Amazon's email, we send one short welcome email. Every mailing-list email of ours carries your unsubscribe link; Amazon's verification email does not.
• If you do not confirm, your address is deleted after 3 days from our list, and from SES if we created its record there for the list (the exceptions are under “To leave” below).
• When you confirm, we record the time, and a notice that somebody confirmed is emailed to the project's own administrative mailbox. Since 12 October 2026 the notice carries no address.
• Our sign-up service's own logs never contain email addresses. They are deleted after 90 days.

We use the list to tell you when membership opens and to send VettID updates. That is its whole purpose. No spam, no sharing.

To leave, use the unsubscribe link in any mailing-list email, or your mail app's unsubscribe button; or email info@vettid.org. You are removed from the list at once. Your address is deleted from our list storage, and from Amazon SES, normally within the hour; if that step fails it is retried. We keep the SES record if we did not create it for the list (AWS already held your address for us), if a VettID account uses the address, or if you have signed up again.

AWS's audit log of our account (CloudTrail) records each call we make to SES about your address: when the record is created, each time we check whether you have confirmed (every 15 minutes while your request is pending), and when the record is deleted. Each entry contains the address. We keep that log for 400 days, and unsubscribing does not remove your address from it.

The list's database keeps rolling backups for up to 35 days, after which the address is gone from those too.

Requests for early access (account.vettid.org)

Membership is not yet open, but you can request early access at account.vettid.org. Requests are for people aged 18 and over. This is what happens to one.

• What you give us: your first name, your last name and your email address, a registration code if you have one, and your agreement to receive email from VettID. The form asks for nothing else.
• Why: so that the project's administrator can review your request and, if it is approved, an account can be created for that address. With a valid registration code the account is created at once, without review.
• Who sees it: the project's administrator, on an admin site that can be reached only from VettID's own network. Each request also sends a notice, with your name and email address, to the project's own administrative mailbox. Nobody else receives it; we do not sell or share it.
• The emails: Amazon's email service (Amazon SES) sends you a verification email on our behalf. Clicking its link confirms the address is yours and is how you agree to email from us; to send it, AWS keeps your address as a record in our SES account. When an account is ready, we send one email saying so from no-reply@vettid.org, and sign-in links come from the same address when you ask for one. We do not send an email when a request is declined.
• How long: if you never click the verification email, the request is deleted after 14 days, and so is the SES record unless our mailing list also uses the address. A verified request waits until the administrator approves or declines it; there is no time limit. An approved request becomes an account. A declined request is kept, marked as declined, with the reason if the administrator wrote one, until you ask us to delete it.
• Records that outlast the request: the account system's audit log records that a request was made and what was decided, with your email address; those entries are not deleted with the request, and no deletion period is set for them today. AWS's audit log of our account (CloudTrail) records each call we make to SES about your address — when the record is created, each time we check whether you have verified (every 15 minutes until you have), and when it is deleted — with the address, for 400 days. The request database keeps rolling backups for up to 35 days.
• Logs: requests to account.vettid.org are logged in the same way as described under “When you visit” (CloudFront access logs and firewall logs), and those logs are deleted after 90 days. The account service's own log of requests (time, path and status, no addresses) is also kept for 90 days, and its error logs for 30 days. To limit abuse, a counter of requests from your IP address is kept, and expires after about an hour.
• In your browser: making a request sets no cookies. If you use the page's light and dark switch, that choice is kept in your own browser's storage and is never sent to us. Signing in to an account does use cookies; that is part of the member service, which this notice does not cover.
• Where: AWS's US East (N. Virginia) region, like everything else in this notice.

To withdraw a request, or to have a declined one deleted, email support@vettid.org from the address you used; the same address answers questions about a request. There is no button for it; we do it by hand: we delete the request, the SES record for your address (unless the mailing list uses it) and the notice in our mailbox. The audit-log entries and the backups described above remain for their periods.

When you email us

If you write to one of our addresses (general, security, donations), we get your address and whatever you put in the message, and we keep the correspondence for as long as it takes to deal with it and to keep a record of what was agreed. Our mailboxes are hosted by Proton. For security reports, the security page has a PGP key so you can encrypt what you send.

Donations

The donate page collects nothing. If you arrange a donation by email, the paragraph above applies. A Bitcoin payment is recorded on the public Bitcoin blockchain, which we do not control.

Where the data is

The logs and the mailing list are stored in AWS's US East (N. Virginia) region, in the United States. CloudFront answers your request from one of its locations in North America or Europe, usually the one nearest you. AWS processes this data for us as our hosting and email provider, and Proton as our mailbox provider. Nobody else receives it: we do not sell it, rent it, or share it for advertising or anything else. We would disclose it only if the law required us to.

Links to other sites

We link to other sites: GitHub for our source code, the projects on Tools We Trust, and a few others. Once you follow a link you are on their site, under their rules.

Your choices

Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. Email info@vettid.org. For the mailing list, that is a single address; the audit-log entries described above are the exception, and expire after 400 days. For request logs, tell us the IP address and the time, since the logs hold no names; they are deleted on the schedule above in any case.

Age

VettID and this site's mailing list are for people aged 18 and over. We do not knowingly collect anything from anyone younger; if you think someone under 18 has joined the mailing list, tell us and we will remove the address.

Changes

If what the site does changes, this page changes with it and the date at the top is updated. The site's source, this page included, is public in the vettid.org repository, so every past version can be read there.