Privacy Policy

1. Introduction

RateMyVSO LLC ("we," "us," "the Site") is committed to protecting your privacy. This policy explains what information we collect, how we use it, and the choices you have regarding your data.

2. Information We Collect

Sign in with Google or Sign in with Apple

If you create or access your account using Sign in with Google or Sign in with Apple, the provider sends us limited identity information so we can sign you in. We receive and store:

• A provider user ID (Google's sub claim or Apple's user identifier). We use this to recognize you on future sign-ins. It is not displayed publicly.
• Your email address as confirmed by the provider, used for the same purposes as a password-based account email.
• Your name, only if the provider sends it. Apple sends name only on the very first sign-in. We use it as your default display name and you can change it later.

Apple supports a "Hide My Email" option that gives us a private relay address ending in @privaterelay.appleid.com. If you use it, we store and email that relay address. Apple forwards messages to your real inbox without disclosing it to us. We record a flag noting your account uses an Apple private relay so we can support it correctly.

We do not store passwords for accounts created through Google or Apple. We do not store the OAuth access or refresh tokens after the sign-in handshake completes. We do not request or receive your contacts, calendar, photos, or any other data from these providers.

Account Information

When you create a local account without Google or Apple, we collect:

• Username. Displayed publicly on your reviews.
• Email address. Used for account verification, password resets, and communication. Never displayed publicly.
• Password. Stored in encrypted (hashed) form. We cannot see your password.

Optional Profile Information

Regardless of how you signed in, you may add the following to your profile at any time:

• Display name (optional). Shown on reviews if provided.
• State (optional). Helps with local relevance.
• Veteran status (optional). Displayed as a badge on reviews if provided.

User-Generated Content

Reviews, ratings, review responses, and messages you submit are stored and may be displayed publicly (except messages, which are private).

Claim Outcome Submissions

If you share a claim outcome through our "Share Your Outcome" feature, we collect the condition name, claim type, outcome, rating received, timeline, and whether you used a VSO or private medical opinion. You may submit anonymously. When anonymous is selected, your user ID is stored for account management purposes only and is never associated with the submission in any public-facing display. Claim outcome data is only displayed in aggregate form (combined statistics) and never as individual submissions.

VSO Representative Verification

If you claim a representative profile, we collect your VA registration number and a verification document. Documents are stored securely and accessed only during the verification process.

Automatically Collected Information

We use server-side session cookies to keep you logged in. We do not use third-party tracking cookies, analytics services, or advertising networks.

3. How We Use Your Information

• To provide and maintain the Site's functionality
• To verify your identity and prevent fraud
• To display your reviews and responses to the community
• To aggregate claim outcome submissions into community statistics
• To communicate with you about your account or messages
• To moderate content and enforce our Terms of Service

4. Information Sharing

We do not sell, rent, or share your personal information with third parties. We may disclose information only if:

• Required by law or legal process
• Necessary to protect the rights, safety, or property of RateMyVSO or its users
• You have given explicit consent

During Sign in with Google or Sign in with Apple, your browser exchanges an identity token with Google or Apple. That handshake is governed by Google's and Apple's own privacy policies. We do not send any of your account history, reviews, or activity to either provider.

5. Data Security

We implement reasonable security measures to protect your data:

• Passwords are hashed using bcrypt and cannot be read by anyone, including administrators
• Sessions are stored server-side with HTTP-only cookies
• Email addresses are never displayed publicly
• Verification documents are stored in a restricted directory

No system is perfectly secure. We cannot guarantee absolute security of your data but take reasonable steps to protect it.

6. Your Rights and Choices

You have the right to:

• Access your account information, review history, and claim outcome submissions
• Delete your own reviews and claim outcome submissions at any time
• Request deletion of your account by contacting us
• Update your password through the password reset process

7. Data Retention

We retain your account information and reviews for as long as your account is active. If you request account deletion, we will remove your personal information within a reasonable timeframe. Anonymized review data may be retained for statistical purposes.

8. Children's Privacy

The Site is not directed at individuals under the age of 13. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

9. Public Data Sources

Representative names, registration numbers, and organizational affiliations are sourced from the publicly available VA Office of General Counsel (OGC) Accreditation Database. Diagnostic code information is sourced from 38 CFR Part 4. BVA decisions, GAO reports, VA Inspector General reports, VA Annual Benefits Reports, and VA PACT Act performance data are publicly available government documents. This information is a matter of public record.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the Site after changes are posted constitutes acceptance of the revised policy.

11. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us.

RateMyVSO LLC
Georgia, United States