Your content stays in the browser.

What never leaves your device

• The file or text you seal, and its contents.
• Your signing key. It is generated in the page, used once, then discarded.
• Your password and any private fields. They are derived and encrypted in your browser.

What the app does and does not send

• No analytics, no trackers, no beacons. The app depends only on its framework and its own cryptography. No third-party script loads.
• No stored state. Nothing about a seal is written to cookies, localStorage, sessionStorage, IndexedDB, or any cache.
• Same-origin requests only, none carrying your content. Every request goes to this site, never to a third party. There are three application request types (the rest of what the Network tab shows is this site's own page, script and font loads): sealing makes one call for a signed timestamp; opening Verify fetches the published time key (a plain GET that sends nothing) so a record's timestamp can be checked; and choosing “verify a sample” downloads a small sample record from this site. None of them sends any part of your content, and you can check the timestamp call yourself in the Network tab: a POST whose only body is a blinded commitment (a fresh-salted SHA-256 hash that binds the timestamp to this record without revealing it), with no query string and no cookies, whose response carries only the signed time, marked cache-control: no-store. The server signs that commitment without ever seeing what it stands for, and the fresh salt changes the commitment across seals. Connection metadata can still link requests. Its one unavoidable input is the connection metadata every web request carries. What a server keeps is not something a browser can verify, so we do not ask you to take a “stores nothing” claim on faith: that layer is disclosed plainly under Full disclosure below.

Enforced by the browser, not just promised

The site's response headers enforce this at the browser layer, not merely promise it in the code:

• connect-src 'self': a script on the page, even an injected one, can fetch, post, open a WebSocket or send a beacon only to this site; form-action 'self' does the same for form submissions.
• Referrer-Policy: no-referrer: no URL or referrer leaks on navigation.
• frame-ancestors 'none': the seal and verify tools cannot be embedded and clickjacked.
• Camera, microphone, and geolocation are denied outright.

Hosting and request metadata

The time service receives the blinded commitment described above. You can inspect the requests in your browser. Like other public websites, the hosting and CDN layer can passively see standard connection metadata (your IP address and a timestamp) for any request, including the timestamp call. That is connection metadata, not the content of your seal: the server never sees what you are sealing. We state this plainly in the footer of every page.

Data controller and contact

This site is operated by Attested Intelligence Holdings LLC, which is the data controller for the request data described above, including the blinded commitment and connection metadata. Your file or note bytes are not sent by the application. Our host is Vercel Inc. (United States), which receives that metadata and keeps its request logs under its own retention policy, so it may be processed in the United States. We rely on legitimate interest (GDPR Art. 6(1)(f)) to operate and protect the site. You may ask us for access to or erasure of any data about you, and if you are in the EEA or the UK you may also complain to your data protection authority. Last updated: September 30, 2026. Questions about privacy, or about anything on this page: admin@attestedintelligence.com.