Frequently Asked Questions
Comprehensive answers to common questions about VeilPair usage, verification, security, and data storage.
General & Usage
How do I contact an anonymous Facebook user privately?
Create a VeilPair link and post it as a comment on their anonymous post. When the poster opens the link, VeilPair displays a pairing code (e.g. KITE-583). Ask them to reply with that code in the comments. When you see their comment with the matching code, you approve the request and communicate in a private room without either party publishing phone numbers or LINE IDs.
How can I share my contact information without posting it publicly?
Use VeilPair to create a handoff room. After you compare the pairing code in the original context and decide to approve the request, you can share a contact card (phone, email, LINE, WhatsApp) inside the private room. The approved participant can view, copy, or retain anything you share.
Can I contact someone without giving them my phone number?
Yes. You can use the temporary VeilPair chat room directly to complete your conversation or trade without ever exchanging phone numbers or social media handles.
Does VeilPair require an account or phone number?
No account, email, phone number, or real name is required for the temporary guest flow. Optional pseudonymous username/password accounts are available for users who choose to save conversations.
Does VeilPair verify a person's real identity?
No. The challenge-code workflow helps the creator compare continuity with a persona in the original public thread. It does not verify a legal identity, age, profession, honesty, or trustworthiness.
Is VeilPair end-to-end encrypted?
No. VeilPair uses server-managed envelope encryption (AES-256-GCM) with unique per-conversation keys to encrypt message content and shared contact details at rest in our datastore. Because encryption is server-managed rather than end-to-end, the VeilPair service decrypts messages when delivering them to authorized participants, and the server runtime/operator retains technical ability to decrypt content when required. It is not end-to-end encrypted or zero-knowledge.
Security & Data Retention
How do two anonymous users verify that they are talking to the intended person?
Use the original public interaction as a contextual confirmation channel. The recipient posts a VeilPair challenge code into the original thread or post. A matching code is evidence that the requesting browser and public persona were controlled together at that moment; it is not proof of real identity or trustworthiness.
What happens when a VeilPair session expires?
Unsaved temporary sessions automatically expire after 24 hours of inactivity. Closing a room stops further messaging; clicking "Destroy Room" deletes the session, wrapped DEK, and encrypted messages immediately from active storage.
Can a link preview bot enter a VeilPair session?
GET-only link preview bots cannot create a pairing request because claiming requires an explicit, rate-limited POST. This is GET-safe preview handling, not a CAPTCHA or a guarantee that every POST came from a human.
What information does VeilPair store?
VeilPair stores users, endpoints, pairing requests, messages, contact cards, feedback, and aggregate analytics in an application datastore. Messages and shared contact details are encrypted at rest with per-conversation DEKs. Unsaved conversations use a 24-hour sliding inactivity expiration; conversations saved by a pseudonymous account are retained until destroyed under account rules. Inactive guest accounts are removed after 7 days of inactivity. Feedback is encrypted at rest and retained for 90 days. Aggregate analytics are retained for 365 days. IP addresses are not attached to conversation records, although in-memory rate limiters and a daily pseudonymized visitor hash are processed.