Your data stays on your device.

What we don't collect

The interactive features on this site are client-side by architecture. When you drop a photo into the Living Proof page, run the forensic examiner, or paste a receipt into the verifier, that content is processed locally and discarded when you leave. Your images, files, and receipts are never among the things the page sends out: its only outbound requests are the cookieless page beacon, a short list of content-free interaction signals, and content-free security signals (all described below), and the page's network policy (connect-src) permits no other destinations.

What the server sees

The site is served from Cloudflare's edge. As with any website, our hosting provider processes standard request metadata (IP address, user agent, requested URL, timestamp) to deliver pages and protect against abuse. We do not use this for advertising or profiling, and we do not sell it.

Retention, subprocessors, and region

• Retention. Cloudflare's standard request logs follow Cloudflare's own retention policy (short, on the order of days). Our own content-free event and security data is retained for roughly 90 days, then ages out. Email correspondence is kept until your request is resolved or the business need ends.
• Subprocessors. Cloudflare (hosting, edge, cookieless Web Analytics, and the content-free event/security store) and our email provider for correspondence. No advertising or analytics third parties.
• Region. Coherence Energy Labs is a United States entity; the site is served from Cloudflare's global edge. Design partners may sign a separate Data Processing Addendum and security addendum.

Analytics -- cookieless and content-free

We measure how the product is used so we can improve it -- without cookies, and without ever touching your content. Two first-party signals, nothing else:

• Page views, via Cloudflare Web Analytics: cookieless, no cross-site identifiers, no fingerprinting -- aggregate counts, referrer, and country.
• Content-free interaction events, sent to our own endpoint: an allowlisted signal that something happened (for example, a proof was run or a receipt was downloaded) -- never the image, the receipt, or its contents, and never an identifier for you.
• Content-free security signals, sent to our own endpoint: if your browser blocks something suspicious (a Content Security Policy violation) or our in-page integrity monitor detects hostile activity (for example an injected script, or an attempt to send data to an unapproved destination), the page reports the type of event, the blocked destination's host, and the page -- so we can detect and respond to attacks. Never your content, and never an identifier for you.

These are first-party (our own Cloudflare), so there are no third-party trackers. We honor Do Not Track and Global Privacy Control: if your browser sends either, the interaction events are not sent at all. The content-free security signals are sent regardless, because they carry no identifier and exist only to protect the site from attack.

Email you send us

If you email us (for example to become a design partner or report a security issue), we keep that correspondence to reply and follow up. Nothing more.

The design-partner form

If you submit the design-partner form, we store the answers and contact details you provide (name, email, organization, and your responses) first-party in Cloudflare D1, used only to follow up about a partnership. This is the only place the site collects personal details; we never sell them or use them for advertising, and you can ask us to delete them at any time.

Your choices

• Use the tools without an account -- there is nothing to sign up for.
• Request a copy or deletion of any correspondence you've sent us.
• Block scripts entirely; the verifier and analyzers simply won't run, and still nothing is sent.

Changes

If this policy changes materially, the effective date above changes and the update is noted in the changelog.

Contact

Questions about privacy: josh@coherenceenergylabs.com.