Privacy Policy

Proof is designed to know as little about you as possible. For a file, we keep only its name and a SHA-256 fingerprint, which cannot be turned back into the file. For text, we keep the text itself and show it on the proof page, so anyone with the link can read it. If what you are proving is confidential, prove it as a file. We don’t run third-party analytics, we don’t sell data, and we don’t need your name or email to use the service.

When you create a proof, we store:

• The title and description you type in
• The SHA-256 fingerprint of your content
• For a text proof, the full text you entered
• For a file proof, the file name (not the file)
• The DigiByte address you were signed in with when you created it, and the one that signed it (if signed)
• The DigiByte transaction ID and payment address (if stamped)
• Timestamps of each step (created, signed, stamped)

Files: your browser sends the file to our server over an encrypted connection. The server reads it in memory to compute the fingerprint and then discards it. The file is never saved. The same is true when you check a file against a proof.

Text: the text is saved with the proof and shown on its page. It is not written to the blockchain, and it is not included in the PDF certificate or the downloads.

A proof page can be opened by anyone who has its link. It shows:

• The title and description
• The text, for a text proof; the file name, for a file proof
• The fingerprint, the signer’s DigiByte address, and the transaction ID if stamped

The title and description also appear in link previews when the link is shared, and in the PDF certificate and downloads. Proof pages are not listed in our sitemap, but a search engine can index one if its link is posted somewhere public.

Every published proof linked to a DigiByte address is also listed on that address’s public proof list. A proof you create while signed in is linked to your address, and listed there, even before you sign it. That list asks search engines not to index it.

If you set a display name or bio in your profile, they are public: they appear on your proof list and on proofs you signed.

When you sign in with Digi-ID, we set an encrypted session cookie so the site remembers you are signed in. It contains your DigiByte address and an expiration time, and nothing else. While a sign-in is in progress there is also a short-lived cookie holding a random code that ties the QR code to your browser, so nobody who sees the QR can sign in as you. It is deleted when you finish signing in, or after five minutes. We don’t use tracking cookies, advertising cookies, or any third-party cookies.

When you choose to stamp a proof, the fingerprint is written to the DigiByte blockchain via an OP_RETURN transaction. Blockchain data is public and permanent: anyone can read it, and no one (including us) can delete it. The on-chain record does not include your title, description or text, only the fingerprint prefixed with “prooflink.digistamp.co:”. When proofs are stamped together in a batch, the chain holds one combined fingerprint (a Merkle root) for the whole batch instead.

• We do not run Google Analytics, Meta Pixel, or any third-party tracker
• We do not sell, rent, or share your data with anyone
• We do not send marketing email (we don’t even ask for your email)
• We do not build ad profiles
• We do not save files, only their name and fingerprint

We do not keep request logs. Your IP address is never written to disk or to our database. To stop abuse, the server holds it in memory for about two minutes to count how many requests come from it, and then forgets it.

If you send feedback, we keep what you sent so we can read and answer it: the message and its category, the page you sent it from, your email if you gave one, and your DigiByte address if you were signed in. When you are signed in, we also keep in-app notifications for you (for example, that your proof is on the chain, or that we replied to your feedback).

If you report a proof, we keep the report: the reason you chose, your message, and your DigiByte address if you were signed in. Not your IP address. Reports and what we did about them are kept, because a report about unlawful content may have to go to the authorities. If we remove a proof after a report, its page stops being public, but we keep its content for the same reason.

Proof runs on our own infrastructure and the DigiByte network. We do not hand off user data to SaaS vendors. The only “third party” your proofs interact with is the DigiByte blockchain itself, which is a decentralized public network.

You can:

• Revoke a proof you own (hides it from the public page; the on-chain stamp remains, since blockchain data is permanent)
• Change or clear your display name and bio at any time
• Sign out at any time to end your session
• Contact us via the feedback form to ask about your data

Proof is not directed at children under 13 and we do not knowingly collect data from them.

If we update how we handle data, we’ll update this page and change the “Last updated” date above. Material changes will be announced on the site.

Questions about privacy? Use the feedback form. Proof is operated by Orange-Hat, LLC.