Provenshot Privacy Policy
What the app stores — on your device only
- Sealed photos and evidence records (time, GPS coordinates, address, device model, cryptographic hashes and signatures) are stored in the app's private storage on your phone. They leave the device only when you share or export them.
- Signing keys are generated inside your device's secure hardware (Apple Secure Enclave / Android Keystore) and cannot be exported — by us or by you.
- Settings (watermark template, toggles) are stored locally.
Data that leaves your device, and why
- Map thumbnails: to draw the small map on the watermark, the app requests a map tile from a tile server (OpenStreetMap, or AMap inside mainland China). That request necessarily includes the approximate area of the tile. Tiles are cached on-device so repeat captures often need no request at all.
- Reverse geocoding: converting coordinates to a street address uses your phone's built-in geocoding service (Apple/Google), subject to your OS vendor's privacy policy.
- Purchases: the optional one-time unlock is processed entirely by the App Store / Google Play. We never see payment details.
That is the complete list. The app contains no advertising or analytics SDKs and makes no other network requests.
Permissions
- Camera — to take photos.
- Location — to stamp and seal the capture location. Used on device; never uploaded by us.
- Photo library (add-only / picker) — only to save a copy of a sealed photo when you turn that on, or to open a photo you choose to verify.
The verify page
provenshot.app/verify is a static page. Verification runs entirely inside your browser; the photo you drop in is never uploaded — the page makes no network request with your file. The page's verification code is open source (source & format specification).
Your data, your control
Deleting a photo in the app permanently removes it and its evidence record from your device. Uninstalling the app removes everything. We cannot delete anything for you — we never had it.
Children
Provenshot is a documentation tool, is not directed at children, and collects no personal data from anyone.
Changes
If a future version ever changes any of the above (for example an optional cloud feature), this policy will be updated first and the change will be opt-in.