Privacy Policy

SynthThinkers, s.r.o., Nové sady 988/2, 602 00 Brno, Czech Republic; company ID 21010404 (“we”), operates Existence Anchor and is the controller of the personal data this policy describes.

Your browser computes a file’s SHA-256 digest on your device (through the API, your own software does) and sends us only the digest, with a label if you add one. We never receive the file. A label is stored as you type it, so put in it only what you want us to hold.

Your account: your email address, a hash of your password (never the password itself), when you confirmed the address, whether we have disabled your sign-in, the account’s name (an individual account is named after its admin’s email address), and its members and their roles.

Sessions: when you sign in, we record when the session began and when it was last used.

Sign-in attempts and email requests: the email address typed and the time — for a sign-in, whether it succeeded; for a request to send you an email (to confirm your address, reset your password, or resend an account-deletion link), which kind — so that we can stop password guessing and stop these forms from being used to flood an address with email.

API keys: who created each key, its prefix, a hash of its secret (we cannot read the secret), when it was last used or revoked, and how many requests it made each day.

Stamps: the digest, its label if you add one, the random nonce we add and the blinded value made from them, the member or API key that made the stamp and how they signed in, when we received it, and once it is anchored its Bitcoin block (height, hash and time).

Receipts and certificates: each prints the account’s name, the email address of the member who made the stamp (for an API key, the member who created the key) and when we received it. We store each certificate and email it, as a PDF, to every member of the account.

Status pages: each stamp has a public page, at a random address, that shows only its state, its digest and when we received it. It names no person or account.

Invitations: the invited email address, which the admin who invites gives us, and when the invitation was sent, accepted or revoked.

Billing: the account’s customer id at Stripe, and each subscription’s plan, status and dates. Card details are typed at Stripe and never reach us.

Emails: we email you to confirm your address, to reset your password, to invite you, to deliver certificates, about your plan and subscription, and about a request to delete your account. Stripe sends its own emails about payments, such as the reminder before a renewal.

Server logs: the server that runs our API logs each request it receives: its time, the address and query requested, and the status of the answer.

Operator console: the console our staff use records each page an operator opens and each change they make, which customer it concerned and the reason given for a change, and what they searched for, which can be a customer’s email address; and attempts to sign in to it. Each entry holds its time and the IP address and browser used.

Error reports: when something fails, we send the error and its technical details to our own error-monitoring service, so we can find and fix the problem. It is configured to leave out personal data: your email address, your IP address, your cookies, and what you submitted.

We count visits to the website and the app with Umami, a web analytics tool that we, SynthThinkers, s.r.o., run ourselves at t.farvexo.com. For each page you open, your browser sends it the page’s address and the address you came from, both without their query, the page’s title, your screen size and your browser’s language; like any website, it also sees your IP address and browser, but it does not store your IP address: its records of visits are anonymous. It sets no cookies, and it counts nothing when your browser asks websites not to track it (Do Not Track).

To provide the service you signed up for: your account, stamps, receipts, certificates, emails and subscription. This is needed for our contract with you (GDPR Article 6(1)(b)). Without an email address and a password you cannot have an account.

To keep the billing and accounting records the law requires of us (Article 6(1)(c)).

To keep the service and its users safe, with the sign-in attempts, the server logs and the console’s record: our legitimate interest (Article 6(1)(f)).

To learn how the site is used, from the analytics: our legitimate interest (Article 6(1)(f)).

Stripe, which takes payments: when an admin first opens Checkout, it receives the account’s name and the admin’s email address, and it holds the card details typed there. Its own privacy policy (stripe.com/privacy) applies to what it holds.

Timestamp servers that use the OpenTimestamps protocol: they receive each stamp’s blinded value, a SHA-256 hash of its digest and nonce, and nothing else of yours.

The Bitcoin blockchain, which anyone can read: it holds one value for many stamps at once, never your digest.

vpsFree.cz, z.s. (Prague, Czech Republic), which hosts the service and its database.

The emails we send go through a mail service that we, SynthThinkers, s.r.o., run ourselves.

We do not sell personal data, and we give it to nobody else unless the law requires us to.

Stripe may process data outside the European Union, under the safeguards its privacy policy describes.

A stamp’s stored .ots proof and certificate, and its label: for 30 days from the stamp and, with a subscription, while it is current and 30 days after; then we delete them.

The rest of a stamp’s record, its digest, nonce, blinded value and anchor, and its status page stay as long as the service runs.

Your account: until you delete it. A session ends when you sign out, 24 hours after it was last used, or 14 days after you signed in.

Invoices, which Stripe keeps for us: at least as long as accounting and tax law requires us to keep them, also after an account is deleted.

Sessions you did not sign out of, sign-in attempts, API keys and their daily counts, invitations, subscription records and the console’s record: we have set no period for these yet, so they stay while the service runs, except what deleting your account erases. Server logs stay as long as the server’s log settings keep them.

The analytics’ records of visits: 90 days.

Deleting your account in the app (Team → Delete your account) signs you out everywhere at once, and we erase your account after 7 days unless you keep it with the link in the email we send. We then erase your email address and password, delete your sign-in attempts and revoke your API keys. If you are the account’s only member, its name, its stamps’ labels, its certificates and its invitations go too, and its customer at Stripe is deleted when you make the request.

What stays: if you are the account’s only member, its stamps, as anonymous records of their digest, anchor and status page, and their .ots proofs until their storage period ends; otherwise the organisation keeps its stamps as they are. What is not erased: certificates already emailed, which stay in their recipients’ mailboxes; an organisation’s certificates that print the address of a member who leaves; invitations other accounts sent to your address; the console’s record; server logs, as long as the server keeps them; invoices, which accounting and tax law requires us to keep, and Stripe’s own records; and, if you leave an organisation, a card you entered for it, with the cardholder name and billing address typed with it, which the organisation keeps paying with until its admin replaces the card.

The site sets these cookies:

stampr_session keeps you signed in. It is set when you sign in and lasts up to 14 days; signing out deletes it.

stampr_csrf protects your requests from being forged by other websites. It is set the first time the app sends a change, such as a sign-in, and lasts 14 days.

Your browser’s local storage also keeps nuxt-color-mode, the pages’ colour scheme setting; it is not a cookie and is never sent to us.

The operator console, which only our staff use, sets stampr_ops_session and stampr_ops_csrf, each for 12 hours.

There are no advertising or tracking cookies, and the analytics sets none. Stripe’s own pages, such as Checkout, may set Stripe’s cookies.

Under the GDPR you may ask us for a copy of your personal data, and ask us to correct it, to erase it, to restrict its use or to give it to you in a machine-readable form; you may also object to what we do on the basis of our legitimate interest.

You can delete your account yourself in the app. For anything else, write to support@existenceanchor.com, from your account’s email address if you have one; we answer within one month.

You may also complain to the Czech data protection authority, the Úřad pro ochranu osobních údajů (uoou.gov.cz).

Existence Anchor is not meant for children, and we do not knowingly hold their data.

We may change this policy. Each new version is published on this page with the date it was last updated.

Questions about your data: write to support@existenceanchor.com.