Privacy
This page lists every piece of information CertifiedCopy handles, who holds it, and for how long. It is written to be checked rather than trusted: the application's content security policy is enforced by your browser, the source and the database schema are public, and what travels is asserted by the test suite on every change.
Reading and exporting: nothing leaves your machine
Your messages, your backup, your phone's contents and every document you export are read and written on your own machine, in the page or in the Mac app. No server receives them; there is no server that could. The browser's policy for the application names only your own machine, the notary and the account service as places a request may go, and the two services are asked only when you tick a box that says so.
The Mac app asks this site once a day which version is current, by fetching a public file
that is the same for everybody. It carries nothing about you. Set
CERTIFIEDCOPY_NO_UPDATE_CHECK=1 to stop it.
The notary: a document, when you ask, and a count
When you tick have the notary witness this document, the finished PDF is sent once
to notary.certified.sh, read in memory, signed, and dropped. The same happens
when you verify a copy on the verify page. The notary keeps
no document, no digest, no token and no filename. It keeps a count of
documents and bytes per period against your account — or, without one, against a
pseudonym of your network address that only the notary can compute — because that is
what its tiers meter. Counts are kept for the period they belong to
and the one after.
Accounts: what an account is made of
- Your email address, as the account's name, kept until you delete the account.
- Sign-in links: the SHA-256 of the link's secret, the address it was sent to, and whether it was used; deleted fifteen minutes after issue.
- Sessions: the SHA-256 of the cookie's secret and the account it belongs to; deleted thirty days after sign-in, or when you sign out.
- Passkeys: the credential id, the public key and a counter. Never a private key, which never leaves your device.
- Billing: a Stripe customer id, and the tier a subscription set. Card details are entered on Stripe's pages and held by Stripe, never here.
Sign-in forms carry Cloudflare Turnstile, which decides whether a request is a person's; its script runs on the account page only, under that page's own policy, and on no other page of this site.
Who holds it
The site, the notary and the account service run on Cloudflare (Pages, Workers, D1) in
Cloudflare's data centres; Cloudflare keeps its own edge logs of requests, as any host does.
Payment is Stripe's. Sign-in mail is sent by Cloudflare's own email service, from
sign-in@certified.sh. Nobody else receives anything.
Your rights
Everything held against your account can be shown, and the account deleted, from the account page itself, signed in, without asking anybody. Deletion removes the account, its sessions, its passkeys, its credit and its counts at once. For anything else, or if you cannot sign in, write to privacy@certified.sh from the account's address and a person will answer. Security reports go to security@certified.sh, as security.txt says; anything else, including legal notices, to contact@certified.sh and legal@certified.sh. The data controller is Avarok.
Changes
This page changes when the product does, in the same commit, and its history is public in the repository. Last revised 13 September 2026.