Privacy Policy

Last updated: February 16, 2026

1. Introduction

EvidMark ("we," "us," or "our") operates the EvidMark platform, a proof-of-process service that lets creators capture, seal, and share verifiable evidence of their creative workflows. This Privacy Policy explains what data we collect, how we use it, and how we protect it.

By using EvidMark, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

Account information. When you register, we collect your email address, display name, and authentication credentials.

Uploaded content. Files, images, prompts, and workflow steps you upload to create proof packages.

Proof metadata. Cryptographic hashes, timestamps, workflow structure, and version lineage data generated when you seal a proof.

Usage data. Pages visited, features used, and interaction patterns to improve the service.

Technical data. IP address (hashed for rate limiting), browser type, device info, and referral source.

Waitlist data. Email address, creator type (optional), and UTM/referral parameters when you join the waitlist.

3. How We Use Your Information

• Generate and store cryptographic proof packages of your creative process
• Manage your account and provide customer support
• Send service-related communications (account verification, proof completion)
• Anchor proof hashes to public ledgers when you opt in
• Generate shareable verification links
• Prevent abuse through rate limiting and spam detection
• Improve the platform based on aggregated usage patterns

4. Data Storage & Security

Your data is stored in encrypted cloud infrastructure powered by Supabase (PostgreSQL) with row-level security policies. Files are stored in Supabase Storage with access controls tied to your account.

Cryptographic hashes are generated client-side using SHA-256. Your original files are never shared - only the hash is used for verification and optional ledger anchoring.

IP addresses used for rate limiting are salted and hashed before storage. We do not store raw IP addresses.

5. Proof Data & Blockchain Anchoring

When you seal a proof, a cryptographic hash of your workflow is generated. This hash is a one-way fingerprint - it cannot be used to reconstruct your original content.

If you opt in to ledger anchoring, your proof hash and timestamp are recorded on a public blockchain. Anchored hashes are permanent and cannot be deleted due to the immutable nature of blockchain technology. No personal information is included in anchored data.

6. Data Sharing

We do not sell your personal information. We share data only in these circumstances:

• Shared proofs. When you create a share link, the proof package (files, metadata, hash) is accessible to anyone with the link, subject to the permissions you set.
• Service providers. Supabase (database and storage), Vercel (hosting), and blockchain networks (if you opt in to anchoring).
• Legal requirements. If required by law, subpoena, or to protect our rights and safety.

7. Cookies & Tracking

We use minimal cookies - primarily an authentication session cookie required for the service to function. We do not use third-party advertising trackers.

8. Your Rights

You have the right to:

• Access your personal data and proof packages
• Export your proof packages as standalone archives
• Correct inaccurate account information
• Delete your account and associated personal data

Note: Deleting your account removes your personal data from our systems. However, proof hashes anchored to a public ledger cannot be removed. Shared proof links will also become inaccessible upon account deletion.

9. Data Retention

We retain your data for as long as your account is active. Upon account deletion, personal data is removed within 30 days. Anonymized, aggregated analytics data may be retained indefinitely. Blockchain-anchored hashes are permanent.

10. Children's Privacy

EvidMark is not intended for users under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice on the platform. Continued use of the service after changes constitutes acceptance.

12. Contact Us