We collect nothing. You do not have to take our word for it.
What never leaves your device
- The file or text you seal, and its contents.
- Your signing key. It is generated in the page, used once, then discarded.
- Your password and any private fields. They are derived and encrypted in your browser.
What the app does and does not send
- No analytics, no trackers, no beacons. The app depends only on its framework and its own cryptography. No third-party script loads.
- No stored state. Nothing about a seal is written to cookies, localStorage, sessionStorage, IndexedDB, or any cache.
- Same-origin requests only, none carrying your content. Every request goes to this site, never to a third party. There are three, and this is all of them: sealing makes one call for a signed timestamp; opening Verify fetches the published time key (a plain GET that sends nothing) so a record's timestamp can be checked; and choosing “verify a sample” downloads a small sample record from this site. None of them sends any part of your content, and you can check the timestamp call yourself in the Network tab: a POST whose only body is a blinded commitment (a fresh-salted SHA-256 hash that binds the timestamp to this record without revealing it), with no query string and no cookies, whose response carries only the signed time, marked cache-control: no-store. The server signs that commitment without ever seeing what it stands for, and the fresh salt means it cannot be correlated across seals. Its one unavoidable input is the connection metadata every web request carries. What a server keeps is not something a browser can verify, so we do not ask you to take a “stores nothing” claim on faith: that layer is disclosed plainly under Full disclosure below.
Enforced by the browser, not just promised
The site's response headers enforce this at the browser layer, not merely promise it in the code:
- connect-src 'self': the page cannot open a connection to any origin but its own, so even an injected script cannot fetch, post, or beacon data to another origin.
- Referrer-Policy: no-referrer: no URL or referrer leaks on navigation.
- frame-ancestors 'none': the seal and verify tools cannot be embedded and clickjacked.
- Camera, microphone, and geolocation are denied outright.
Verify it yourself, in about a minute
- Open your browser's developer tools and select the Network tab.
- Go to the Seal page and seal a note or a small file.
- Watch the requests. You will see only same-origin requests to this site, plus one call for a signed timestamp whose body is a blinded commitment (a salted hash that reveals nothing about your content). No third-party origins, and nothing carrying your content.
For the strongest guarantee, download the offline verifier and run it with your network disconnected. It makes no requests at all, enforced by a stricter policy that blocks every connection.
The one thing we disclose
The application takes nothing from you to collect: every request it makes is listed above, and you can watch each one carry none of your content. Like any site on the public internet, the hosting and CDN layer can passively see standard connection metadata (your IP address and a timestamp) for any request, including the timestamp call. That is connection metadata, not the content of your seal: the server never sees what you are sealing. We state this plainly in the footer of every page.
Data controller and contact
This site is operated by Attested Intelligence Holdings LLC, which is the data controller for the little this page describes: the connection metadata disclosed above. The application itself collects nothing. Questions about privacy, or about anything on this page: admin@attestedintelligence.com.