Privacy Policy

Effective October 2026. Short version: in Content-Blind mode we mathematically cannot read your drafts — we store rhythms and hashes, never words.

Data-minimization commitments: no keystroke-content logging · no clipboard reads · no window-title/URL capture · no behavioral identification · per-document consent · blind-by-default for institutions.

1. What we collect

Account: email, plan, billing metadata (via Stripe — we never see card numbers).
Recording (blind mode): event timestamps, edit classes (key/delete/paste), length deltas, SHA-256 digests. No readable text.
Recording (full-playback, opt-in per doc): additionally timestamped text snapshots you explicitly enable.
Verification logs: cert ID, timestamp, coarse outcome — to detect registry abuse.

2. What we never do

Sell data; advertise against drafts; train generative models on your text; fingerprint writers across documents; enable third-party surveillance of non-consenting subjects.

3. Retention

Raw replay frames: auto-purge per your setting (default 13 months; institutions may set 90 days).
Hashes, certificates, chain heads: 10-year registry (the point of a notary).
Account deletion: purges frames + PII within 30 days; registry hashes remain as anonymous attestations unless law requires removal.

4. Your rights (GDPR / state laws)

Access, export, correction, deletion, restriction, portability: privacy@originproofs.com. EU users: our DPA is available for institutions (DPA template). Students: FERPA-aligned school configurations keep education records under institutional control.

5. Security

TLS 1.3, AES-256 at rest, HSM-backed signing, append-only evidence store, SOC 2 Type II in progress (see control matrix). Breach notification within 72 hours.

6. Contact

OriginProof, Inc. · privacy@originproofs.com · Data Protection Officer on request for institutional customers.