Biometric Data Retention and Destruction Policy

Policy version 2026-09 · Last updated: September 15, 2026

This is VyByN LLC's written policy establishing our retention schedule and our guidelines for permanently destroying biometric identifiers and biometric information. It is published here, publicly and without needing an account, because it must be available before any biometric data is collected.

Identity verification is optional and always has been. You can create an account, build a profile, match, message, add money, split a date and withdraw your balance without ever using it. We do not make it a condition of anything, and we will not.

1. What happens, step by step

Only if you choose the optional identity verification step, and only after you have read the notice in the app and affirmatively agreed to it:

Your phone records a short live video of your face while the screen shows a sequence of coloured lights. That video is streamed directly from your phone to Amazon Web Services, which runs its Rekognition Face Liveness check on it. VyByN's servers never receive the video and never store it.
Amazon Web Services returns two things to us: a liveness result with a confidence score, and one reference frame selected from the video.
We use that reference frame in memory only, to compare it against your primary profile photo, and then it is discarded. We do not store the frame. It is not written to a file, to a database, or to any object store.
The facial geometry involved — the measurements and relative distances between your facial features, analysed by Amazon Web Services in the video and by us in that single frame — is a biometric identifier, and this policy governs it.

Your existing primary profile photo is used as the comparison image. You cannot begin identity verification without a primary profile photo on your account.

2. Why we do it

Two purposes, and no others:

Identity matching — confirming the person in front of the camera is the person in the profile photos.
Liveness detection — confirming a real person is in front of the camera. Amazon Rekognition Face Liveness is designed to detect spoofing attempts such as printed photos, faces displayed on another screen, and masks. No automated check is perfect, and we do not claim this one is.

We do not use facial geometry to identify you anywhere else, we do not use it for advertising or profiling, and we do not sell, lease, trade or otherwise profit from it.

3. What we store, and for how long

There is no entry below for the video or for the reference frame, because neither is stored. What we keep is the result of the check. These periods are enforced by automated jobs that run on a schedule. They are not requests you have to make.

What	Kept for	Measured from
The measurements: the Face Liveness confidence score, the similarity score against your profile photo, whether the liveness check passed, and its supporting detail (the status Amazon Web Services returned, the challenge type, and the threshold we applied)	1 year	When the attempt was processed — or when it was started, if it was never completed
The outcome record: that an attempt happened, whether it was approved or failed, the stage at which it was refused and the reason given for the refusal, the Amazon Web Services session identifier, and the timestamps	Kept as the record that the check took place	— (see the note below the table)
The record that you were verified, and the verified badge it puts on your profile for other people to see	While your account is open — unless you withdraw consent, which removes it at once	—
The record that you were shown this notice and agreed to it	6 years	The erasure of your account. Withdrawing consent on its own does not start this clock — the consent record is kept until the account is erased

The consent record is kept because destroying it would destroy the evidence that you were asked and that you agreed. It contains the wording you were shown and when you accepted it. It does not contain biometric data.

One part of that is worth saying plainly. If an attempt failed because your face did not match your profile photo closely enough, the reason text we keep says exactly that, in fixed words. It does not record the match percentage, and it does not record any other measurement of your face. The percentage itself is the similarity score, and that is in the first row of the table above: deleted a year after the attempt, and immediately if you withdraw your consent. The outcome record does outlive all three of those things — the one-year deletion, a withdrawal of consent, and the erasure of your account — but what outlives them is the record that an attempt happened and how it ended, not a measurement of your face.

The Amazon Web Services session identifier is a handle on a session that stops being reachable three minutes after it is created (see section 6). It is retained as part of the outcome record, it measures nothing about your face, and it is never included in a copy of your data supplied to you — we withhold it deliberately rather than export a handle to a biometric process.

4. Destruction triggers

Your biometric measurements are permanently destroyed on whichever of these comes first. Two of the four below destroy them; the other two are listed because people expect them to, and we would rather say plainly which is which than let the heading imply all four do.

The retention period above expires. Automatic, whether or not you ask.
You withdraw consent. In the app, at any time. Withdrawal deletes the measurements in the first row of the table above immediately — it does not wait for the one-year clock. It also removes the verified badge from your profile. The badge is a statement that the face check passed, and we do not keep displaying a claim that rests on processing you have withdrawn your consent to. It does not remove the outcome record, including the reason text; as the note above explains, that text carries no measurement of your face.
You delete your account — which is not, by itself, one of the two. Deleting your account erases or scrubs your personal data across our systems, but it does not touch the verification attempt row: that row is retained as the record that a check took place, and the measurements on it come off on the one-year clock above, not on the deletion. If you want them gone at once, withdraw consent — you can do that before you delete your account, or instead of deleting it.
The purpose is abandoned — nothing to destroy. An attempt you start and never finish leaves us no video and no frame to delete, because we never stored either. What reached Amazon Web Services stops being reachable on the three-minute window described in section 6.

5. What "permanently destroyed" means here

The video and the reference frame are never written to storage at all, so there is nothing about them left to destroy. The measurements are overwritten with empty values in our database by an automated job.

Our live systems and our backups are erased on different schedules. A record may persist in a backup for up to 8 days after it is erased from our live systems, after which the backup containing it is destroyed.

6. Who else sees it

The liveness check is performed by Amazon Web Services, Inc., in AWS region us-east-1 (Northern Virginia, United States), acting as our service provider and processor under contract and on our instructions. No other person or company receives your biometric data. We do not disclose it except where a law, a warrant or a subpoena compels us to, and we will not sell, lease or trade it in any circumstance.

The session — the video, the reference frame and everything Amazon Web Services derived from them — stops being reachable, by us and by anyone using our AWS account, three minutes after the session starts. Amazon Web Services does not share any of it with its other customers.

That three-minute window is how long the session is reachable. It is not by itself a promise that Amazon Web Services destroys everything: separately from the session, AWS may retain a copy of content sent to its AI services and use it for fixing operational issues, evaluating service performance, debugging, or training its own models. That copy sits outside the session and is not subject to the three-minute window. AWS says such a copy may be stored in a different AWS region from the one named above, which can mean a different country. Whether AWS does any of this is governed by an account-level AWS setting.

AWS AI services opt-out: We have opted our AWS account out of AWS using this content to improve its services.

7. Your rights

Withdraw consent at any time, in the app, in as few steps as it took to give. The measurements in the first row of the retention table are deleted immediately when you do, on the same scope as the one-year sweep, and the verified badge comes off your profile at the same time.
Ask for a copy of the data we hold about you, including what remains of a verification attempt.
Ask us to delete it without deleting your account.
Decline entirely. Nothing in the app is withheld from you for declining the face check described here. Note that adding or receiving money separately requires a government-ID check run by Stripe, which takes no face measurements and is described in our Privacy Policy — that is a different check from this one.

Use Settings → Privacy & Data in the app, or email privacy@vybyn.app.

8. Changes to this policy

This policy carries a version number, shown at the top of the page and recorded with your consent. If we change it materially, the version changes, and anyone who consented to an earlier version is asked again before any further biometric data is collected from them. Consent to an earlier version is never carried across.

9. Contact

VyByN LLC
254 Chapman Rd, Ste 208 #25531
Newark, Delaware 19702
Email: privacy@vybyn.app