Privacy Policy

Who We Are

Truestamp Inc. is a Delaware corporation with its registered office at 16192 Coastal Hwy, Lewes, DE 19958, United States. Truestamp Inc. is the controller of your personal data within the meaning of the EU General Data Protection Regulation (GDPR), the UK GDPR, and equivalent data protection laws. You may contact us about any privacy matter at [email protected].

EU and UK Representatives

Truestamp Inc. is based in the United States. Under Article 27 of the GDPR and the UK GDPR, controllers outside the EU or UK that offer goods or services to data subjects in those jurisdictions may be required to appoint an EU representative and a UK representative. We are currently evaluating whether our processing activities meet the thresholds that require such appointment and, if so, designating representatives. Until that evaluation is complete, EU and UK data subjects may contact us directly at [email protected], and we will treat your request as if it had been made through a representative. This policy will be updated with the representatives' contact details if and when they are appointed.

Data Protection Officer

Our processing activities do not currently meet the thresholds in GDPR Article 37 that require the mandatory appointment of a Data Protection Officer. Privacy questions, access requests, and complaints should be directed to [email protected], which is monitored by our privacy function.

Information We Collect

Information You Provide

• Account Information: Your email address; a username you choose during onboarding, which is visible to members of your teams; optionally your first and last name; and your sign-in credentials. Depending on how you choose to sign in, credentials may include a password (stored only as a bcrypt hash), passkeys (we store only the public key), a two-factor authenticator secret, and single-use recovery codes stored as hashes. You can also sign in with an emailed magic link, in which case no password is stored at all
• Preferences: Interface settings you choose, such as language, time zone, and timestamp display options
• Timestamping Data: The claims you submit with each item: a name and, optionally, a description, URL, geographic coordinates, a file hash, your own timestamp, and freeform metadata, plus any tags you add. Claims are stored on our servers until you redact or delete the item. When you timestamp a file through your browser, the file is hashed locally on your device; the file itself is never uploaded to us and we receive only the resulting hash
• Team Data: Team names, member roles, and optional messages you attach to team invitations
• Integration Settings: Outgoing webhook URLs with their authentication secrets and custom headers (secrets and headers are additionally encrypted at the application layer)
• AI Assistant Conversations: Messages you exchange with the built-in AI assistant, described in the AI Assistant section below
• Communications: Messages you send to our support team or submit through the feedback widget

Information We Automatically Collect

• Usage Information: How you interact with our service (timestamps created, API calls made)
• Technical Information: IP address, browser type, device information, and operating system
• Security Activity: Sign-in and other authentication events, recorded in a security log you can review in your profile. Each entry stores the event, its outcome, and a truncated form of your IP address (we remove the final portion of the address before storage), and failed sign-in attempts also record the identifier that was tried. Entries are deleted after 90 days
• Log Data: Server logs that help us maintain and secure our service

How We Use Your Information

We use your information only for the following purposes, along with the legal basis for each under applicable data protection laws:

• Provide and maintain our timestamping services (Legal basis: contract performance)
• Authenticate your identity and manage your account (Legal basis: contract performance)
• Process your timestamping requests and maintain blockchain records (Legal basis: contract performance)
• Send transactional communications (account notifications, security alerts, billing, service status) (Legal basis: contract performance and legitimate interest)
• Send marketing communications (newsletters, product updates) (Legal basis: consent. We only send marketing communications to recipients who have opted in, and every such message includes an unsubscribe link. You can withdraw consent at any time)
• Improve our platform security and prevent fraud (Legal basis: legitimate interest)
• Comply with legal obligations and enforce our terms (Legal basis: legal obligation)

Team Ownership of Items

When you create or join a team on Truestamp, that team has an ownership model that determines who owns the items created within it. This is a property of the team, chosen by the team owner, and it applies to every item created in that team.

Every item also records the individual user who created it. That authorship record is permanent and does not change, even if ownership of the item is later transferred to a different user or to the team.

Creator Retains Ownership

Under this model, the user who creates an item is the owner of that item. They control read, update, redaction, and deletion of the item for as long as they remain a member of the team. If the user later leaves the team, items they own move with them to their personal team, and they retain full control over those items.

Team Retains Ownership

Under this model, the team is the owner of every item created in the team, even though each item still records the individual user who created it. The team, acting through its team owner and team administrators, controls read, update, redaction, and deletion. This model is available on paid plans only.

Because this model affects what happens to your work if you later leave the team, invitees to a team that retains ownership are required to acknowledge the ownership clause before their invitation can be accepted. If a member is later removed from or leaves such a team, items they created stay with the team and the departing user loses access to them going forward. Any proofs they previously exported remain independently verifiable.

Team administrators can reassign the owner of an individual item at any time, for example when responsibility for a record moves between users or between users and the team. Reassignments are recorded in the audit log, and the original authorship record remains unchanged.

Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We only share your data in these limited circumstances:

Subprocessors

We engage the following subprocessors to operate the Service. Each is bound by a written contract that imposes data protection obligations equivalent to ours, restricts processing to the purposes listed, and requires appropriate security measures. Except where a different location is noted below, our subprocessors process customer data in the United States.

We do not currently use third-party error monitoring or payment processors. If and when we introduce any new subprocessor that processes personal data, we will update this list and, for business customers with an active Data Processing Addendum, notify them before the change takes effect. Public blockchain commitments (Stellar, Bitcoin) are sent from our infrastructure directly to self-hosted or publicly available network nodes; we do not use a hosted blockchain API provider.

Map Data from OpenStreetMap

Some pages display geographic maps rendered with map tile images loaded by your browser from the domain tile.openstreetmap.org, operated by the OpenStreetMap Foundation (a United Kingdom charity). When your browser loads these tiles, it transmits your IP address and user-agent to OpenStreetMap, which may log them per the OpenStreetMap Foundation Privacy Policy at https://wiki.osmfoundation.org/wiki/Privacy_Policy. We do not share any other information with OpenStreetMap, and they do not set cookies in your browser. Our legal basis is our legitimate interest in providing a functional map visualization. If you do not wish to share this information, avoid pages that display maps or block requests to that domain in your browser.

Separately, when an item's claims include geographic coordinates, our servers convert those coordinates into a human-readable place name using the OpenStreetMap Foundation's Nominatim reverse-geocoding service (nominatim.openstreetmap.org). Only the coordinates themselves are transmitted; no account, item, or network identifier of yours is attached, and results are cached on our servers. Coordinates in claims are provided by you, so include only locations you are comfortable submitting, and use redaction if you later change your mind.

Business Customers and Data Processing Addendum

If you use the Service on behalf of an organization and our processing of personal data through the Service makes you a controller and Truestamp a processor under GDPR, UK GDPR, or an equivalent law, our Data Processing Addendum (DPA) applies and is incorporated into our Terms of Service by reference. The DPA incorporates the European Commission Standard Contractual Clauses (Commission Decision 2021/914) and the UK International Data Transfer Addendum where applicable, and lists the subprocessors above. See our Data Processing Addendum page for details, or email [email protected] to request an executable copy.

Legal Requirements

We may disclose your information if required by law, court order, valid subpoena, or to protect our rights and the safety of our users. Where we are legally permitted to do so, we will notify affected users in advance of disclosure so they have the opportunity to challenge the request. We do not provide bulk or unrestricted government access to user data.

Data Security

• Encryption in transit: All connections between your browser or API client and our service are encrypted using TLS. TLS is terminated at our Cloudflare edge and continues over TLS to our application servers
• Encryption at rest: Our managed PostgreSQL database (PlanetScale on AWS) is encrypted at rest with AES encryption as provided by the underlying platform, which documents that the storage hosting its automated backups is encrypted as well. Sensitive integration secrets - specifically outgoing webhook authentication secrets (bearer tokens) and custom webhook headers - are additionally encrypted at the application layer using AES-256-GCM (via the Ash Cloak and Cloak libraries) with a key held in environment configuration
• Authentication credentials: Passwords are hashed using bcrypt before storage. API keys are stored only as one-way SHA-256 hashes; the plaintext value is shown to you once at creation and cannot be recovered from our systems. Session cookies are signed with HMAC-SHA256, are HttpOnly and SameSite=Lax, and are marked Secure in production
• Access controls: Access to production systems is limited to a small number of authorized personnel, controlled through role-based authorization policies in the application, strong authentication for administrative interfaces, and audit logging
• Security monitoring: We operate a web application firewall (via Cloudflare), rate limiting, and server-side logging. Logs are reviewed for anomalies
• Data minimization: We collect and store only data necessary for the Service. Your item claims data may contain personal or identifying information because you choose what to submit; we provide a redaction mechanism (described below) so you can remove it while preserving cryptographic proofs
• Breach notification: If we become aware of a personal data breach affecting your information, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours as required by GDPR Article 33. We will notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34 and equivalent laws

Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we have about you
• Correction: Update or correct inaccurate personal information
• Deletion: Request deletion of your account and associated personal data
• Redaction: Remove submitted claims data from timestamped items while preserving cryptographic proof of existence. Reversible only by you, by submitting a proof that matches the original claims hash; we cannot reverse a redaction on our own
• Data Portability: Request a copy of your data in a portable format
• Withdrawal of Consent: Withdraw consent for data processing where consent is the legal basis (for example, marketing communications); withdrawal does not affect the lawfulness of processing done before the withdrawal
• Objection: Object to processing based on our legitimate interests, and object at any time to processing of your personal data for direct marketing
• Restriction: Request restriction of processing in the circumstances set out in Article 18 GDPR, for example while we verify the accuracy of data you believe is incorrect
• Complaint to a Supervisory Authority: Lodge a complaint with your local data protection authority. See the section below

How to Lodge a Complaint

We encourage you to raise any concerns with us first at [email protected] so we can try to resolve them directly. You also have the right to lodge a complaint with a supervisory authority, in particular the authority in the EU or EEA member state of your habitual residence, place of work, or the place of the alleged infringement. A directory of EU supervisory authorities is available at edpb.europa.eu. In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO) at ico.org.uk. In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) is reachable at edoeb.admin.ch.

Blockchain Commitments and Personal Data

Data committed to our internal blockchain and to external public blockchains (such as Stellar and Bitcoin) consists solely of cryptographic hash values. These hashes are produced using SHA-256 cryptographic hashing and are structurally salted by: (a) verifiable external entropy sources, including the U.S. NIST Randomness Beacon and block hash values of prior public blockchain blocks; (b) the hashes of all other items submitted to the Service before yours, via inclusion in a Merkle tree; and (c) internally generated identifiers. As a result, published hashes are not reversible to recover your original content and do not, on their own, identify you.

When you delete your content or account, we erase your original data, metadata, and the internal mappings that would allow any published hash to be associated with you. Once those mappings are destroyed, we consider the remaining on-chain hash values to fall outside the definition of personal data in GDPR Article 4(1) and equivalent laws. This approach is designed to reconcile cryptographic integrity with the right to erasure, but it does not replace or modify your statutory rights, which remain as described in this policy.

Timestamping Data and Privacy

Data Collection and Storage

When you submit data for timestamping, you may include claims, metadata, filenames, or other information that could contain personal or identifying details. This data is cryptographically hashed and linked to both our private blockchain and public blockchain networks to provide immutable proof of existence.

Item Visibility and Public Items

Every item has a visibility setting: private, team, or public. A public item can be viewed, found through our public search, and verified by anyone, without a Truestamp account. For public items, the claims you submitted (name, description, URL, coordinates, timestamp, and metadata) and your tags are readable by anyone, and the item's name and description are also rendered into the publicly fetchable preview images used when its link is shared. Items submitted through the web interface on the free plan are created with public visibility; items submitted through the APIs default to private.

Public pages never display your username, name, or email address. The item's internal creator, owner, and team identifiers are technically readable through our APIs for public items, but they are random values that do not by themselves reveal who you are. Changing a public item back to private stops new access through the Service; it cannot recall information that others have already viewed or saved.

Data Redaction Capability

Privacy Best Practices

Please be mindful of what information you include when submitting timestamping requests. While you can redact data later, we recommend:

• Avoiding personal information in metadata fields unless necessary
• Using descriptive but non-identifying filenames when possible
• Downloading cryptographic proofs before redaction if you need future access
• Considering the permanent nature of blockchain timestamps in your data submission decisions

AI Assistant

The Service includes an AI assistant, available both to signed-in users and to visitors without an account. To generate responses, the content of your conversation is sent through OpenRouter, Inc. (United States) to the AI model provider OpenRouter routes it to; those providers can change. For signed-in users, the assistant can also look up your account profile and the items you have access to, so item claims data may be included in what is sent when needed to answer your question. Signed-out visitors' assistants can only use public information and utility tools. Under our agreement with OpenRouter, conversation data is not used by OpenRouter for model training and is not stored by OpenRouter unless logging is enabled for our account, which it is not; OpenRouter does store metadata about each request, such as token counts, which does not include the content of the conversation. We send every assistant request with OpenRouter's data collection preference set to deny and with its zero-data-retention option enabled, so OpenRouter forwards it only to a model endpoint it records as not collecting user data and as not retaining prompts or responses for any period. Conversation titles are generated the same way.

When a signed-in user's search or assistant question requires searching our documentation, the text of the query is sent through OpenRouter, Inc. (United States) to compute the numeric representation used for semantic search. When the AI assistant, or an API or MCP client, searches our documentation, the query text together with short excerpts of our own documentation is sent through OpenRouter to be ranked by relevance. OpenRouter routes these requests to the AI model providers it publishes for each purpose, and those providers can change. Neither search flow includes your items, account details, or identity. Documentation searches by signed-out visitors are processed entirely on our own servers and never reach OpenRouter; their conversations with the assistant are processed through OpenRouter as described above. Under our agreement with OpenRouter, this data is not used by OpenRouter for model training, and the query text and results are not stored by OpenRouter unless logging is enabled for our account, which it is not. We send every request with OpenRouter's data collection preference set to deny, which limits routing to the model providers OpenRouter records as not collecting user data. The published documentation itself is also processed through the same OpenRouter route when we index it; that is our own content, not your data.

Conversations are stored on our servers so you can revisit them. Conversations of signed-out visitors are keyed to a random identifier held in your session cookie and are automatically deleted 90 days after their last activity. Signed-in users' conversations are retained with the account and deleted when the account is deleted. Daily message limits apply. Do not paste passwords, credentials, or other sensitive personal data into the assistant.

Data Retention

We retain personal information only as long as necessary to provide the Service and to meet legal, accounting, and security obligations. Specific retention rules:

• Account Information: Retained while your account exists. We do not currently delete accounts based on inactivity. You can delete your account yourself from your profile at any time, or request deletion by email, and we will delete your account information within a reasonable period not exceeding 60 days, subject to the carve-outs below. Deletion removes your account, the teams you created, the items you own, and your conversations, API keys, credentials, and preferences. Items you created that are owned by someone else (for example, by a team that retains ownership of its items) are not deleted; instead, our record of you as their creator is replaced with an anonymous placeholder. If you created a team that retains ownership and that team still holds team-owned items, you must remove those items or delete that team before your account can be deleted. Security log entries age out on their own 90-day schedule
• Free-plan item data: Items submitted on the free plan automatically expire 90 days after submission. We send warning emails in advance, and expired items pass through a short grace period during which upgrading your plan restores them. After the grace period, all server-side data associated with the item is permanently removed, including the data required to generate or verify cryptographic proofs. Hash values previously committed to public blockchains remain on those networks indefinitely, but without the corresponding server-side data we cannot reconstruct a proof for you. If you want to keep a verifiable proof of a free-plan item beyond the 90-day window, download the complete proof while the item is still active; any proof you have previously downloaded remains independently verifiable after the sweep
• Paid-plan item claims data: Retained until you redact or delete the item. Redaction permanently removes the original claims data from our systems while leaving the item's cryptographic proofs and timestamps intact. Redaction can later be reversed only if you provide us with a complete proof that contains the original claims: we verify that the submitted claims hash to the same value we recorded before redaction and restore the claims only if they match. On full item deletion, all server-side data for the item is removed and cannot be restored
• Blockchain records: Cryptographic hash values previously committed to our internal blockchain or to public blockchains remain on those networks indefinitely. As described above, those hashes are not personal data once the internal mappings that link them to you are deleted
• System and security logs: Retained for up to 90 days for security, fraud-prevention, and operational purposes, unless a longer period is required for an active investigation or legal hold
• AI assistant conversations: Signed-out visitors' conversations are deleted 90 days after their last activity. Signed-in users' conversations are retained with the account and deleted when the account is deleted
• Webhook delivery records: The payload and response of each outgoing webhook delivery are stored encrypted and deleted after 31 days
• Billing, tax, and accounting records: Retained in access-restricted form for the period required by applicable tax and accounting law (typically seven to ten years), even after account deletion. These records are used only for those statutory purposes
• Support and privacy correspondence: Retained for up to three years after the last interaction so we can provide continuity of support and respond to follow-up questions
• Backups: Our database is protected by automated, encrypted backups kept on a rolling schedule and deleted automatically after a limited period. References in this policy to deleting or removing data describe our live systems: residual copies may persist in backups until those backups rotate out, after which they are gone. Backups are used only for disaster recovery. We do not use them to restore data you have deleted, and if a recovery from system failure ever resurfaces deleted data, we will re-apply your deletion
• Legal holds: Where we are subject to a legal hold, subpoena, or other binding preservation obligation, we will retain the subject data for the duration of that obligation

Cookies and Tracking

We use cookies only for essential website functionality. We do not use tracking cookies, analytics cookies, or advertising cookies. For detailed information about our cookie usage, please see our Cookie Policy.

International Data Transfers

Truestamp is based in the United States, where our core infrastructure and most of our subprocessors process customer data. Cloudflare processes traffic in transit on its global edge network, and our email delivery provider routes messages through its own global infrastructure, as noted in the subprocessor list. If you are located in the European Economic Area, the United Kingdom, or Switzerland, your personal data is transferred to the United States to provide the Service to you.

We do not currently rely on the EU-US Data Privacy Framework. Instead, we rely on the following lawful transfer mechanisms, depending on the jurisdiction:

• European Economic Area: European Commission Standard Contractual Clauses (Commission Implementing Decision 2021/914)
• United Kingdom: the UK International Data Transfer Addendum to the EU SCCs, issued by the Information Commissioner's Office
• Switzerland: the SCCs as amended to recognize the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner

Email is delivered through SMTP2GO (Sand Dune Mail Limited), a New Zealand company. New Zealand benefits from adequacy decisions under the GDPR (Commission Implementing Decision 2013/65/EU), the UK GDPR, and Swiss law, so transfers of personal data to New Zealand require no additional safeguards.

In accordance with the judgment of the Court of Justice of the European Union in Schrems II (C-311/18) and the European Data Protection Board Recommendations 01/2020, we apply the following supplementary technical, contractual, and organizational measures to transfers to the United States:

• End-to-end encryption of connections using TLS, including between our Cloudflare edge and our application servers
• Encryption at rest of databases and backups as provided by our hosting platform, plus application-layer AES-256-GCM encryption of sensitive integration secrets
• Bcrypt hashing of passwords and one-way hashing of API keys so that plaintext credentials are not retrievable
• Role-based access controls, audit logging, and the principle of least privilege for administrative access to production systems
• A commitment, in our processor contracts and in this policy, to challenge any overbroad government request and to notify affected users where legally permitted

Copies of the relevant Standard Contractual Clauses and our Data Processing Addendum are available on request from [email protected].

Sensitive Personal Information and Special Categories

Truestamp is a general-purpose timestamping service. We do not request, require, or knowingly process special categories of personal data within the meaning of Article 9 GDPR (for example, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning a natural person's sex life or sexual orientation) or sensitive personal information as defined by the California Privacy Rights Act. If you choose to include such data in content you submit for timestamping or in your profile, you do so at your own direction, and that data is hashed, stored, and (on your request) redacted on the same terms as any other content. We strongly recommend avoiding personal and sensitive information in content and metadata you timestamp.

Children's Privacy

Truestamp is not directed to children. We do not knowingly collect personal information from children under the age of digital consent applicable in their jurisdiction, which is 13 in the United States under the Children's Online Privacy Protection Act (COPPA), 13 to 16 in European Union member states under GDPR Article 8, and 13 in the United Kingdom under UK GDPR. Users between 13 and the local age of digital consent may only use the Service with verifiable parental or guardian consent where permitted by law. If we become aware that we have collected personal information from a child without the required consent, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact us at [email protected].

California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following rights regarding your personal information:

• Right to Know: Request the categories and specific pieces of personal information we have collected, used, disclosed, or sold about you
• Right to Correct: Request that we correct inaccurate personal information we hold about you
• Right to Delete: Request deletion of your personal information, subject to the carve-outs described in the Data Retention section
• Right to Limit Use of Sensitive Personal Information: Direct us to limit our use and disclosure of sensitive personal information to what is necessary to provide the services you requested. As noted above, we do not knowingly process sensitive personal information
• Right to Opt Out of Sale or Sharing: We do not sell or share your personal information as defined by CCPA/CPRA, and we have not done so in the preceding 12 months. We honor Global Privacy Control (GPC) browser signals as an opt-out of sale or sharing in accordance with California Attorney General enforcement guidance
• Right to Data Portability: Receive a copy of your personal information in a portable and readily usable format
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights, including by denying service, charging different prices, or providing a different level of quality

To exercise these rights, contact us at [email protected]. We will confirm receipt within 10 business days and respond to verifiable requests within 45 days, with one 45-day extension available if reasonably necessary and communicated to you. You may also designate an authorized agent to make a request on your behalf; we may require the agent to provide written authorization and may require you to verify your own identity directly with us.

Other U.S. State Privacy Laws

Residents of Colorado, Connecticut, Virginia, Utah, and other U.S. states with comprehensive consumer privacy laws may have rights similar to those described in the California section, including rights to access, correct, delete, and port personal information, and to opt out of targeted advertising and the sale of personal data. Because we do not engage in targeted advertising or the sale of personal data, those opt-out rights do not generally apply to our processing. To exercise any state-level right, contact [email protected].

Automated Decision-Making

Truestamp does not use automated decision-making or profiling that produces legal effects or similarly significant effects on users. All timestamping operations are deterministic cryptographic processes, not decisions based on personal data analysis.

Updates to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email and by posting the updated policy on this page with a revised "Last updated" date. For significant changes that affect how we process your personal data, we will provide at least 30 days notice before the changes take effect, giving you the opportunity to review the changes and delete your account if you do not agree.

Language

This Privacy Policy is published in English. The English text is the authoritative version and governs in the event of any conflict or question of interpretation. Translated content elsewhere on this site is provided for convenience and does not modify this policy.

Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or want to report a privacy concern:

• [email protected]

Postal address: Truestamp Inc., 2810 N Church St Ste 82200, Wilmington, DE 19802-4447, United States.