Privacy policy

Last updated October 16, 2026

Verified Ham proves that people hold the amateur radio call signs they claim, and lets them sign in to other apps and websites with that proof. It is run by Nicernet, LLC ("we"). This policy explains what we collect, why, who we share it with, and how long we keep it.

The short version

  • We collect as little as we can: an email address, your passkeys, your call sign, and the record of verifying it.
  • Your name and mailing address come from public licence data, and we use the address only to mail your postcard. We never share it with apps you sign in to.
  • An app learns only what you approve on the consent screen.
  • We don't sell your information, show ads, or use third-party analytics or tracking. The only cookie keeps you signed in.

What we collect

Your account

  • Email address, to confirm your account and to tell you about your verification.
  • Passkeys: the public key your device creates, the name you give it, and when it was last used. We never receive your fingerprint, face or device PIN; those stay on your device.
  • Backup codes, stored only as one-way hashes.
  • When your account was created and when you last signed in.

Licence data

We import the public amateur licence databases published by the US Federal Communications Commission (ULS) and Innovation, Science and Economic Development Canada. They contain each licensee's call sign, name, mailing address, licence class and dates. This is public information, and we hold it for every licensee, not only for people with an account. Any signed-in user can look up a call sign and see what the licensing authority publishes for it, so they can check the details before paying to verify.

Verifications

When you verify a call sign, we keep a record of it:

  • the call sign, and the name and mailing address the postcard was sent to;
  • a one-way hash of the code on the card, and how many wrong codes were entered;
  • the payment's Stripe references and amount, and any refund;
  • the postcard's tracking status, and an image of the card as printed;
  • an audit log of what happened and when, including the IP address you used to start and to complete the verification.

If you choose to

  • Public verified page. If you turn it on, your page shows your call sign, its country, the month you were verified, and any links you add.
  • Discord. If you link Discord, we store your Discord user ID and username, and Discord's access and refresh tokens, encrypted.
  • Apps you register as a developer: their names, addresses and settings. If you list an app in the app directory, its listing shows your verified call sign as its developer.

Technical data

Our servers use IP addresses to limit abuse, such as too many sign-in attempts. Those counters hold a hash of the address and expire within hours. Our error log records which pages were requested and by which account; it is rotated and overwritten as it grows. We don't record your browser's user agent.

Who we share it with

Only these, and only what each needs:

  • Apps you sign in to. Only what you approve on the consent screen: always an account ID unique to Verified Ham, and depending on what the app asks for, your call sign and whether it is verified, your name as it appears on your licence, your email address, and your licence class and expiration date. Apps never receive your mailing address.
  • Stripe processes payments. We send your email address and the call sign being verified; you give your card details to Stripe directly, and we never see them.
  • Lob prints and mails postcards. It receives the name and address from the licence, and the call sign and code to print on the card. When cards are printed by hand instead, our administrators receive them by email.
  • Mailgun delivers our emails, so it handles your email address and the messages we send you.
  • Discord, if you link it: we tell Discord your verified call sign and whether it is verified, so servers can give you roles.
  • The public, only for what you choose to publish: your verified page, and app directory listings.
  • Authorities, if the law requires it, or where necessary to protect our users or the service from fraud or abuse.

Our administrators can see account and verification records, to support you and to prevent abuse. We don't sell or rent personal information to anyone.

Cookies

We set one cookie, vh_session, which keeps you signed in. It expires after 12 hours without use. There are no third-party analytics, advertising or third-party cookies, and no tracking scripts.

How long we keep it

  • Accounts whose email address was never confirmed are deleted after 30 days.
  • Postcard codes stop working, and are erased, 60 days after the card is mailed.
  • Remembered app approvals, and an app's ability to keep you signed in, last until they lapse or you ask us to remove them; refresh tokens expire after 30 days unused.
  • Your account and its verification records are kept while you have an account. Records of payments and of who verified which call sign may be kept after an account is deleted, as long as we need them to handle refunds and disputes, or to prevent fraud.
  • Licence data is refreshed from the licensing authorities every day.

Your choices and rights

  • Your verified page and Discord link can be turned off at any time from your account.
  • To see or correct your information, look at your account, or ask us. Your name and address come from your licence: change them with the FCC or ISED, and our copy updates with their next data.
  • To delete your account, or remove an app's access to it, email us from the address on your account, and we'll do it within 30 days.

Depending on where you live, you may have rights to access, correct, delete or export your personal information, or to object to how we use it. Email us to exercise them; we won't treat you differently for doing so.

Security

There are no passwords to steal: you sign in with a passkey. Backup codes and postcard codes are stored as hashes, Discord tokens are encrypted, and everything travels over HTTPS. No system is perfectly secure, but if a breach affects you, we'll tell you.

Children

Verified Ham is not directed to children under 13, and we don't knowingly collect their information without a parent's consent. If you're a licensed operator under 13, a parent or guardian needs to create and manage the account for you.

Changes

If we change this policy, we'll update the date at the top. If a change is significant, we'll email account holders before it takes effect.

Contact

Nicernet, LLC
P.O. Box 12433
Portland, OR 97212
United States
support@verifiedham.net