Privacy Policy

Your files are never uploaded. Your browser or phone calculates a fingerprint, and only that fingerprint reaches us. A fingerprint cannot be turned back into a file.

Account: your email address, a hash of your password (never the password itself), your plan and optional full name, and the time you accepted the terms.

Proofs: file fingerprints, the times they were created and sealed, and any label you add. For a recorded link, the label is the link itself unless you change it.

Firms: the name of a firm, its members and their roles, invited email addresses, approved supplier domains and API keys, which we store only as hashes.

Security: login sessions stored as hashes, and logs of security events such as logins, with the IP address where relevant.

The contents of your files, the private keys you use for signing, and the pages behind links you record. The email check runs on your device, so the email stays there too.

To provide the service you asked for, keep your account secure, stop abuse and meet legal duties. We do not sell your data and do not use it for advertising.

Our legal bases under the GDPR and the Serbian data protection law are performing our contract with you, our legitimate interest in keeping the service secure, your consent where you choose to show your name, and legal obligations.

Anyone who has the same file or link can check whether a proof exists, when it was sealed and how many accounts recorded it. They see no label and no email address.

Your name appears only on proofs where you turned it on. Labels are visible only to you, or to your firm for proofs made for it. Members of a firm see the firm's proofs.

Only a combined fingerprint for each batch goes on the blockchain. It contains no name, email address or file, and nothing there links back to you once your account is deleted. Those records are permanent and cannot be removed by anyone.

Hetzner hosts our servers and database in Germany. Cloudflare provides our domain name service. Resend delivers our emails when they are enabled. Public blockchain nodes and OpenTimestamps servers receive batch fingerprints, and your browser or phone contacts public blockchain nodes directly when it checks a proof.

We keep your account and proofs until you delete your account. Deleting it removes your account and your list of proofs from our live database. Database backups are kept for about seven days, so deleted data disappears from them after that. Security logs are kept only as long as needed to protect the service.

We use one cookie to keep you logged in and one to remember your language. We use no advertising or tracking cookies.

You can ask to see, correct, delete or receive a copy of your data, and you can object to or limit how we use it. You can change your name and delete your account yourself in your settings. You can withdraw consent to showing your name at any time by turning it off.

To use these rights, write to support@goprovenly.com. You can also complain to your data protection authority, which in Serbia is the Commissioner for Information of Public Importance and Personal Data Protection.

When this policy changes in a way that matters, we will tell you and update the date above. Privacy questions: support@goprovenly.com.