WHAT THIS APP HOLDS ABOUT YOU

An email address and a password hash, so you can sign in. The password itself is never stored — only a scrypt hash of it, which cannot be reversed.

The one goal you commit to, in your own words, and the evaluation standard written from it at commit time.

Your proof: the text you write, the photographs you take, and the voice recordings you make. This is the most sensitive thing here and it is treated that way.

Timestamps, a hash of your IP address at submission time, and your browser’s user agent string. The IP is stored only as a salted hash and cannot be turned back into an address.

Technical facts extracted from your files — capture time, device make, encoder, duration. These exist to detect faked proof and nothing else.

WHAT IS SENT ELSEWHERE, AND WHAT IS NOT

Your proof is sent to Google’s Gemini API to be evaluated. Text, photographs and voice recordings are all transmitted for that purpose. Requests are made with storage disabled, so Google is asked not to retain them beyond the call.

Nothing is sent to an advertising network, an analytics service, or a data broker. There are none in this application.

Cloudflare sits in front of the site and sees the metadata of your requests, as any network provider would.

Nobody else receives your proof. It is not shared, sold, published, or used to train anything.

WHERE IT IS STORED

On a single server, in a private volume that is not reachable from the web. Files are never placed in a public directory.

A photograph or recording can only be retrieved through an authenticated request that also carries a signed token valid for five minutes and bound to your account. There is no public URL for any of it.

Files are stored under a name derived from their content, not from anything you typed.

HOW LONG IT IS KEPT

Your proof is kept for as long as your account exists, because the point of the product is a record you can look back on.

Delete your account and everything goes with it: goal, proof, files, verdicts, notification subscriptions. It is removed immediately and permanently, not marked hidden.

You can export everything first, as a single JSON file with your files alongside it.

YOUR RIGHTS

You can see what is held about you, take a copy of it, correct it, or have it erased. Those are your rights under the GDPR and they are implemented as buttons in this app rather than as a request you have to send someone.

Export and deletion are both available from your account, without asking permission and without waiting.

You can withdraw consent for notifications at any time; the switch that turned them on turns them off.

If something here is wrong or you want to complain, write to [email protected]. If you are in the EU or UK you may also complain to your national data protection authority.

COOKIES

One cookie, holding your session so you stay signed in. It is httpOnly, same-site, and marked Secure.

There are no tracking cookies, no third-party cookies, and no consent banner — because there is nothing to consent to beyond being signed in.

CHILDREN

This app is not intended for anyone under 16. It records voice and photographs, and it is not built with the protections a service for children requires.