Privacy notice · version 2026-10-27

What we keep, who sees it, and how to get it deleted

OPtrust is built by an operator for operators. The whole point is that you control what employers see and that your service record is handled the way you would handle a teammate’s. This page says exactly what happens to your data. No lawyer wrote it; if something here is unclear, ask.

What you give us

• Account: email, display name, password (stored as a bcrypt hash; we cannot read it), optional two-factor secret (encrypted at rest).
• Profile: career field, units and dates, deployments, courses, skills, languages, clearance level, headline, about, availability.
• DD214: the file you upload and the fields we read from it (see below).
• Vouches: the ratings you give teammates, the ten-character “how you know them” note, and the ratings you receive.
• Invites: who invited you and who you invited.
• Usage: sign-in times, IP addresses in server logs, and the actions admins take on your account (audit log).

Your DD214

• The file is encrypted (AES-256-GCM) before it goes to private storage on a US East Coast server. Storage never holds a readable copy; only this server can open it.
• We read it on our own server with open-source tools. It is never sent to a third-party OCR, AI, or document service.
• We extract service-related fields only: name, branch, rank, dates, primary specialty, decorations, education, character of service. We deliberately do not extract or store your SSN, date of birth, home address, DoD ID, or separation and reentry codes.
• You review and correct the extracted fields before they are saved. OPtrust reviews the extraction against the document to mark your record verified.
• The uploaded file is deleted after review. Only the reviewed fields remain. Every review is written to an audit log.

What employers see

• Employers get an approved account after a manual review. They see you as an anonymous ID with your career field, trust tier, score, skills and badges, clearance level, and availability. Not your name, not your email, not your units.
• Your name and email are revealed to an employer only when you accept that employer’s connection request. Applying to a posting shows the employer the same anonymous profile until you accept.
• Your public verification card shows only what you chose to put on it, is signed so it cannot be forged, and can be revoked by you at any time.

What other operators see

• Operators on the network can find you by name to vouch for you, and see your public profile: display name, career field, tier, skills, unit history, and service events by name and date, never a location.
• A “First pick” vouch shows the person you rated who it came from. “Solid” and “Pass” ratings are anonymous to them, so nobody softens a rating under pressure.

How the score uses your data

The trust score is computed from the vouch graph: who vouched for whom, how those people are rated themselves, how independent the vouches are, and how recent. It runs on our server twice a day. No data is sold, shared with data brokers, or used to train outside AI models.

Who we share with

• Infrastructure: the server, database, and file storage are US-based.
• Email: verification, invite, and notification emails go out through an email delivery service, which handles your address and the message.
• Nobody else. No analytics trackers, no ad networks, no resume aggregators.

Retention

• DD214 files: until reviewed, then deleted. Extracted fields: until reviewed, then everything but your branch and service dates is deleted; those stay while your account exists.
• Résumés: encrypted at rest, stored under a generic filename, and only ever downloaded through OPtrust by you or an employer you accepted.
• Vouches you gave and received are deleted with your account. Other people’s scores are recomputed without them.
• Server logs: 30 days. Admin audit log: two years.

Your controls

• Edit or remove any profile field, skill, unit, or event at any time.
• Turn on two-factor authentication in Settings.
• Revoke your verification card or any invite link you made.
• Decline or ignore any employer connection request. Nothing is revealed until you accept.
• Leave. Settings → Delete my account removes your data the moment you confirm: profile, service history, DD214 record, résumé, cards, connections and every vouch you gave or received. What stays carries no name: the records an employer was billed on and the audit log entry that the account was deleted. If you can’t sign in, email privacy@optrust.me from your account address and we do the same for you. We can send you a copy of your data first if you ask.

Security

Passwords are bcrypt-hashed. Two-factor secrets are encrypted with AES-256-GCM. Verification cards are signed with Ed25519. Traffic is HTTPS only. The database is on a private network with automatic backups. Sign-in is rate limited per address and per account. The full picture, including the disk encryption and where the key lives, is on the security section of the home page.

Changes

If this notice changes in a way that affects you, we’ll do our best to email every account before it takes effect. The version date at the top is the one you agreed to.

See also the operator terms and the employer terms.