Tier 1 confirms you're a real, unique human via a selfie and an active liveness challenge (head turns + a blink). It's sybil-deduped — only one credential per face — but it doesn't make any claim about who you are beyond “a unique person.”

Tier 2 adds government-ID verification on top. Your credential carries an age range (not your exact age) and jurisdiction (country only), cryptographically signed and verifiable by anyone. Every Tier 2 submission is manually reviewed by a human.

Your credential is downgraded to Tier 1 — never hard-revoked. Your handle, link page, theme, click counts, and profile links all stay put. The only thing that changes is the badge on your public page (Tier 2 → Tier 1) and the claims in your signed credential (age range and jurisdiction get cleared).

You manage cancellation through Stripe's Billing Portal, which you can reach from your account page. The same surface handles updating your card and viewing past invoices.

Yes. From your account page, click Upgrade — that takes you through Stripe Checkout, then ID capture and a fresh liveness check. Your handle stays bound to you the entire time, even during review.

If we approve the upgrade, your existing credential flips from Tier 1 to Tier 2 in place. If we reject it, the latest invoice is refunded, the subscription is canceled, and you keep your Tier 1 credential exactly as it was — handle, links, theme, clicks, all preserved.

Tier 2:the latest invoice is refunded in full and the subscription is canceled. We email you a brief explanation. No charge stands when we couldn't deliver the service.

Tier 1:there's no payment, so no refund applies. If our sybil check flags your selfie as a likely duplicate of an existing account, we route the case to a human reviewer rather than auto-issuing.

We compute a one-way mathematical representation of your face (an embedding) and compare it against every other TrustMark user's embedding. If your face matches an existing credential within our threshold, we don't issue a second one. The embedding can't be reversed back into a photo of you — it's a vector of numbers, not an image.

This is what Tier 1 is selling: not who you are, but the fact that one real human can only ever hold one TrustMark page.

World scans your iris with a custom hardware device (the Orb) and ties your identity to a crypto token. TrustMark checks your government-issued ID with a phone camera and ties your identity to a signed credential — no hardware, no token, no chain.

We're building toward a Tier 3 with in-person notary co-signing, which has actual legal weight in the jurisdictions notaries operate in. World can't offer that without re-architecting around government documents.

You allowlist 1–5 hostnames (with optional *. subdomain wildcards) in your account page. We generate an iframe snippet for you to paste on your site. The browser refuses to render the badge anywhere outside your allowlist — we enforce it server-side via a Content-Security-Policy: frame-ancestorsheader that's built fresh on every load.

The embed is Tier 2 only. If your subscription lapses, the badge stops rendering on your embed origins until you resubscribe.

Your account page has a Managebutton that opens Stripe's hosted Billing Portal. From there you can update your card, view past invoices, change your billing email, or cancel the subscription. Cancellation takes effect at the end of your current billing period.

Deleting your credential releases your handle (someone else can claim it), removes your face embedding from our biometric index, and revokes your signed credential so anyone who tries to verify it sees the revoked status.

Your raw ID image and selfie were already deleted from Cloud Storage when your review completed (or within 7 days at most). We never had your data sitting around long-term — that's the whole architectural point.

The Illinois Biometric Information Privacy Act (BIPA) requires a specific written consent flow before any biometric processing. We haven't shipped a BIPA-compliant flow yet, and rather than process Illinois residents' biometrics without proper consent we geoblock the state until we're ready. We'll lift the block when the consent flow is in place.

No. The only parties that ever see your verification data are: Google Cloud (storage and biometric infrastructure we run on), Stripe (Tier 2 payments only), and Resend (transactional email). None of them are permitted to use your data for anything other than providing those services to TrustMark. See our privacy policy for the full list and what each provider touches.