1. Scope and operator
This notice applies to the SaveProof website, installed web app, Verification Pages, accounts, Certificates, and Protected Package release services. SaveProof is operated by a private individual who is responsible for server-side personal data. Contact the operator at privacy@saveproof.app. The service is available to users worldwide.
2. What stays on your device
Files, entered text, the ordered composition, Encryption Passphrases, Protected Packages, Encrypted Bundles, and decrypted content are processed in your browser by default. SaveProof does not receive or store those contents. A Certificate or Protected Package that you download is held and shared by you.
Ordinary Certificate PDFs and ordinary SaveProof Packages contain readable notes and original files. Anyone with the file can read or extract them. Large ordinary packages are written directly to a file you deliberately select; SaveProof does not automatically stage their plaintext in browser storage. Clearing this tab does not erase files you have saved. SaveProof cannot recover those files.
You may deliberately save verified attachments together as a ZIP created locally in your browser. After opening protected content, this ZIP contains decrypted originals. SaveProof does not receive the exported contents, and closing the tab does not erase the ZIP you saved.
Your browser may use session storage, local storage, cache storage, or temporary device storage to support drafting, installation, and large local operations. The separate Cookies and Local Storage notice explains these uses.
3. Data SaveProof receives
Proof records
SaveProof receives the Document Fingerprint and stores the Verification ID, signed canonical Proof payload, registration time, signature and Public Key references, Certificate fingerprint, complete ordinary PDF or package fingerprint and byte length, format, and an account ownership link when you create the Proof while signed in. Public Verification Pages expose the public Proof record needed for verification.
If you enter an optional Proof name, SaveProof stores it as public metadata and displays it on the Verification Page, including for Protected Packages. It is also used in the downloaded filename. It cannot be renamed after creation and is not included in the Certificate contents or signed Proof payload. Do not enter private information in this public field.
Account data
If you sign in with Google, SaveProof stores the Google account subject identifier, current email address, display name, optional profile image URL, your chosen interface language and reminder email language if you set them, session metadata, and links to Proofs and Protected Packages created by that account. SaveProof requests the OpenID Connect identity, email, and profile scopes and does not keep Google access or refresh tokens.
When you choose an interface language, SaveProof also stores that choice in a first-party browser cookie. If you are signed in, the same choice is saved in your account so it works on other devices. Your browser's language may guide the initial display of some pages, but it is not saved as an account preference by itself. The installed offline reader also stores only the chosen language code on your device so it can display that language without a network connection.
If you choose a reminder email language in your account, SaveProof stores it separately from the interface language. Without a choice, reminder emails are in English. The language of a reminder is fixed when its first delivery attempt begins, so retries use the same language even if you change the setting later.
Protected Package data
SaveProof stores the package identifier, Release Policy and timing, public commitments and signatures, carrier fingerprints and sizes, release and delivery events, and the minimum protected key-release material required to enforce the policy. It does not store the Protected Package, Encrypted Bundle, plaintext content, Encryption Passphrase, or a complete content-decryption key for a passphrase-protected package.
Package access subscriptions
If you explicitly subscribe to package access notifications, SaveProof stores the private link between your account and that package, your email consent, and notification history. The package owner cannot see your subscription. Confirmation checks the matching package authorization and fingerprints; it does not upload the file or store its bearer capability. Signing in alone does not subscribe you. Email uses your Google-verified address and notification language.
If you separately enable browser notifications, we store an encrypted push endpoint and its subscription keys, a keyed endpoint digest, per-package browser consent and delivery status. Google, Mozilla or Apple push services receive the browser endpoint and an encrypted generic notification; the message does not identify a package or include your email or file. Signing out or switching accounts detaches this browser’s push consent while email remains active. Removing a browser deletes its registration and targets. Disabled registrations are cleaned up after 90 days; terminal push content is cleared immediately and delivery metadata after 30 days.
Technical and security data
Requests to the service may include an IP address, browser and device information, request time, requested route, and security or abuse signals. Infrastructure providers may process this data to deliver and protect the service. SaveProof must not log document content, Management Tokens, private keys, complete Document Fingerprints, or other secrets without a documented operational need.
4. Why data is used
Server-side data is used to:
- create, sign, register, and publicly verify Proofs;
- provide accounts and owner-restricted controls;
- show the interface in your chosen language;
- enforce Release Policies and record Key Release Events;
- send Renewable Hold deadline reminders;
- secure, diagnose, and operate the service; and
- comply with applicable law and resolve disputes.
Depending on the applicable law, these activities may rely on performance of the service contract, legitimate interests in security and reliable verification, legal obligations, or consent where consent is specifically requested.
5. Service providers and disclosures
SaveProof's server-side application and database are hosted in Germany. Infrastructure, network, security, and email-delivery providers may process the limited server data described in this notice on the operator's behalf. Google processes the optional sign-in flow under its own terms. For a Renewable Hold reminder, the email provider receives the owner email address, package identifier, deadline, and reminder text.
For an access notification you request, the email provider receives your email address, Verification ID, policy condition or cancellation, relevant timing, and notification text.
Data may also be disclosed when required by law, to protect the service or its users, or in connection with a lawful transfer of the service. SaveProof does not use account or Proof data for targeted advertising and does not sell it. A public Proof record is public by design and should not contain secret material.
6. Retention
Public Proof records, signatures, and the Public Keys required to verify historical Proofs are intended to remain available for the verification lifetime of those Proofs. Finalized Protected Package policy and event records may need to remain available to enforce irreversible release decisions and prevent replay or ambiguity.
SaveProof account sessions expire after 30 days. Google sign-in transaction cookies expire after 10 minutes. The language cookie lasts up to 365 days unless you clear site data. An account language setting is removed when the account is deleted. Unfinished Protected Package preparations expire after 24 hours, although security and integrity records may be retained longer. Confirmed deletion from the Account page normally takes effect immediately. Data may be retained longer where it is needed for legal obligations, security, dispute resolution, or the continuing verification of a public Proof or finalized Release Policy.
Subscription confirmation requests expire after 10 minutes. Pending email content is encrypted on the server and cleared when an attempt reaches a terminal result; terminal delivery metadata is cleaned up after 30 days. Subscription history retains the outcome until you remove it or delete the account. Unsubscribing stops future sends but keeps history. Removal deletes the subscription and its delivery metadata. An active send can briefly delay removal or account deletion, and a message already sent may still arrive. Provider-side records follow the provider's retention policy.
7. Your choices and rights
You may use Create Proof and Verify without an account. You may sign out to revoke the current session, clear local browser data, and change the interface or reminder email language. You may also choose not to create a Protected Package. Delete your account from the Account page. To request access, correction, or export of other account data, email privacy@saveproof.app. Depending on where you live, you may also have rights to restrict or object to processing and to complain to a data protection authority.
Some public Proof and finalized release records cannot be removed without breaking verification, key continuity, or the safety of an already established Release Policy. The operator must explain any refusal and the legal basis that applies to a request.
8. Security and international processing
SaveProof uses signed, versioned records, secure HTTP-only cookies, encrypted short-lived sign-in state, hash-only session storage on the server, and strict separation between local content and server metadata. No system is completely secure. Server data is hosted in Germany, so using SaveProof from another country may involve international processing. Google and other necessary providers may also process limited data in other countries under their applicable safeguards.
9. Changes and contact
This notice may change as SaveProof changes or legal requirements develop. Material changes should be announced before they take effect when reasonably possible. Questions and privacy requests can be sent to privacy@saveproof.app.