What Veil is#
Veil is the public directory of cryptographic identities. It keeps one card per person or organisation, and a card ties public keys to the accounts people know its owner by: Discord, GitHub, email, a domain, the Fediverse and more. Anyone can find a card by one of those accounts and check its keys in their own browser. Someone who steals one of your accounts still can’t sign as you, because the keys stay on your devices.
Veil is free. There are no passwords: a browser that holds a card’s key signs for it.
Your card is public#
Everything on a card is public: the name you choose, the picture, the alias, the linked accounts, your devices’ names and public keys, the public keys you bring from elsewhere, and the history of every change. Publish only what you are happy for anyone to read.
Every change goes into a public log that independent witnesses sign and nobody can rewrite, Veil included. Part of each entry stays there for ever, even after the card is closed. The privacy notice lists exactly which part.
What you agree to#
- Link only accounts, domains and keys that are yours. Each link needs a proof, and if an account stops being yours, unlink it.
- Don’t pass yourself off as someone else. Two cards can share a name, so a name proves nothing, and a card that uses one to deceive is removed for impersonation.
- Don’t publish other people’s personal data, unlawful content, or a picture you have no right to use.
- Don’t use the directory for spam or harassment, or to collect data about people in bulk.
- Don’t attack the service, the log or anyone’s card. If you find a weakness, tell us before anyone else.
Your keys#
Your private keys never leave the devices that made them. Veil can’t see them, can’t recover them and can’t sign for you. The backup file is the one copy, encrypted with your passphrase, and only you hold it.
If you lose every device and have no backup file, nobody can recover the card, Veil included. You can make a new card and ask for your accounts back. Each request waits 7 days, so a real owner can cancel it.
Veil never asks for a private key. If you paste one anywhere by mistake, treat it as exposed and replace it.
The server’s word#
The pages check each card in your browser, against the public log and the keys of its witnesses. That check is the one to rely on.
Everything else is the server’s word: the JSON API, the previews in chat apps, the badges and card images, the contact files, the replies of the Discord app. They come from the same data, and each one says where the real check runs. Don’t take an important decision on the server’s word alone.
The API and its limits#
Lookups, cards and verification need no key. Each network address can make 300 reads and 30 writes a minute, and create 5 cards an hour. A developer API key from veil.rip/developers gives an integration its own quota of 600 reads and 120 verifications a minute. Past a limit the answer is 429, with the seconds to wait in Retry-After. The limits guide has every number.
Show cards the way Veil does: a name always with its number, and a link to where the reader can check it. Never present the server’s word as a check you did not run.
Veil may suspend an API key or block an address that breaks these terms or puts the service at risk.
Moderation#
The Veil staff can hide a name or a picture, suspend a card for a time or remove it, for impersonation, spam, abuse or unlawful content. Each action is signed, shows on the card, and goes into the public log with the name of the staff member who took it. The reason stays private.
Anyone with a card can report another card from its page. A removed card’s accounts can’t be linked again for a year.
Closing your card#
You can close your card at any time from veil.rip/account. The closing waits 24 hours, so you can still cancel it. Then the card’s content is destroyed. The privacy notice says what the log keeps.
What Veil does not promise#
Veil comes as it is, without a warranty. We work to keep it running and correct, but it can be down, slow or wrong. Because the check runs in your browser, a wrong answer from the server shows up as a check that fails.
As far as the law allows, Veil is not liable for losses that come from using it or from not being able to. Nothing here takes away the rights that the law of your country gives you as a consumer.
If these terms change, the date at the top changes too. Using Veil after that means you accept the new version.
Contact#
Veil is run by the owners of the Veil organisation, whose card is veil.rip/o/veil. Every month one of them signs the warrant canary.
Write to [email protected] about these terms, a weakness you found, or a legal request.