Privacy

Your files never leave your phone or computer. We only receive the set's fingerprint, a code worked out from the files that can't be turned back into them.

This page says exactly what that means: what stays on your phone, what reaches us, what our hosting company records, and what we keep. Last checked 22 October 2026.

What stays on your phone

Your photos and videos, the notes you add, the names you give your sets, and the receipts. They are kept in your browser's storage on your phone, and in the zip files you save. We can't see any of them. Deleting a set in the app removes it from the browser; the zips you saved are yours to keep or delete.

What your phone sends us

One thing only: the fingerprint of a finished set, a string of 64 letters and numbers. The phone sends it when you finish a set, and again when you open the app while that set's timestamp is still being finished, or its place in the second public record (below) is still to come, for up to two weeks. It never sends a photo, a video, a note, a set name, a file name or a file's own fingerprint. Our server refuses any message larger than 1 KB, far too small to hold a photo.

When you check a set

The checker reads your files in your browser. They are never uploaded. To check the timestamp it asks our server for the public record the timestamp is anchored in, asked for by a record number that says nothing about your set; and, if your copy's timestamp isn't finished or your copy has no second public record yet, for the latest ones, which means sending the set's fingerprint, as your phone already does. To check the second public record it asks our server for that record by its number, which names a batch of many sets, not yours.

Our server fetches the timestamp's public records from two public services, mempool.space and blockstream.info, and the second public record from two others, sepolia.base.org and publicnode.com, and checks each pair agrees. They receive only the record number, and they see our server, not you.

Status links

A status link shows when a set was independently timestamped and how many files it holds. It contains the set's fingerprint, and no photos, notes or names. Opening it asks our server for the set's timestamp and its second public record. The part of the link after the “#” sign never leaves the browser. Status pages ask search engines not to list them.

What we keep

For each fingerprint we receive, four things:

• the fingerprint itself;
• the time it reached our server;
• its timestamp proof;
• whether that proof is finished yet.

For the second public record (below), we also keep which batch each fingerprint went into and its place in that batch; and for each batch, its number, its own fingerprint, and the record of it: the transaction, when it was made and what it cost.

Nothing else: no IP address, no browser details, no account, no name or email. The database itself is built to refuse any other kind of data. It is run for us by Neon, in London. We keep these records so that a timestamp can be finished and checked later. Because nothing in them points to a person, we can't look up “your” records unless you tell us a fingerprint.

Why a fingerprint can't be turned back into a photo

A fingerprint is worked out from the files in one direction only. Working backwards from it to a photo isn't possible. The set's fingerprint also mixes in a random number your phone picks when you start the set, and that number stays in your receipt. So someone who has copies of your photos still can't work out the set's fingerprint, or match it to anything we hold, without your receipt.

The public timestamp services

To have a set independently timestamped, our server passes its fingerprint on to public timestamp services run by other organisations. Before it does, it mixes in more random data, so what those services record publicly can't be matched to your set's fingerprint. Your receipt holds the steps needed to link the two. How this works is on the how it works page.

The second public record

About once an hour, our server gathers the fingerprints that have arrived since the last time into one batch, works out a single fingerprint for the whole batch, and writes that to a second public record, separate from the timestamp services, which anyone can look at. Only the batch's fingerprint and how many sets it holds are written there: never your set's own fingerprint. Your phone later receives the steps that link your set to the batch and keeps them in your receipt, so the link can be checked without us. Our server writes the record through a public service, sepolia.base.org, or publicnode.com when that one is busy, which see our server, not you. It costs a little each time, paid by us: never by you, and nothing is ever asked of you for it.

Our hosting company

The site is hosted by Cloudflare. Like any website host, Cloudflare sees the IP address of every visitor, because it needs it to send the page back. Our own code never reads or stores it.

• Where it runs. Cloudflare receives each visit at its data centre nearest to you, and our server code runs in London, next to our database. Cloudflare acts as our processor. Its privacy notice says it stores data mainly in the United States and the European Economic Area, and may access it from other countries where it operates. Read Cloudflare's privacy notice.
• Our logs. We keep Cloudflare's record of each visit switched off, because it would hold your IP address. Our logs hold only the messages our own code writes, such as the results of the hourly jobs that finish timestamps and write the second public record, and errors. An error message can include the address that was asked for, which for a status page or a pending timestamp contains a set's fingerprint. Cloudflare keeps these logs for three days.
• Limits on sending. To stop one computer flooding the part of our server that receives fingerprints, Cloudflare counts how often each IP address sends to it, over a few seconds, and briefly refuses one that sends too many. The count is kept by Cloudflare, not by us.
• Error reports. If a page fails to load, your browser may send Cloudflare a short error report: the page's address, the address it was trying to reach, the kind of error and how long it took. Cloudflare says it drops your IP address as soon as the report has been received.
• No visitor counts. We don't count visitors or page views, and the site loads no statistics or advertising code.

The one cookie

When you finish a set, our server sets one small cookie, mip_stamps. It holds a count of how many sets this browser has sent in the last hour, so the site can stop one browser sending more than 20, and a signature so the count can't be edited. It holds no ID and nothing about you. It is only ever sent back to the part of our server that receives fingerprints, and it expires within an hour.

What we never do

• No accounts, no sign-in, no email addresses.
• No advertising, no visitor statistics, and no tracking across other websites.
• We don't sell data, and there is no personal data in what we keep to sell.