Privacy Policy

This Privacy Policy describes how the individual developers operating the Witness application ("we," "us," or "our") handle information when you use the Witness iOS app ("App"), when you make content public through Public Mode, and when you participate in the Witness Verified Creators certification program ("Verification Program"). Witness is not a corporation, LLC, or other formal legal entity. By downloading or using the App, you agree to this policy. Your use of the App is also governed by our Terms of Service, which include disclaimers, limitations of liability, and indemnification provisions. If you do not agree to this policy or the Terms of Service, do not use the App.

1.What We Collect

Almost everything Witness handles stays on your device and never leaves it. The exceptions are your account identifier from Sign in with Apple, content you choose to make public through Public Mode (Section 4), and information you submit to join the Verification Program (Section 5). Here is a complete list of what the App accesses and stores:

Stored on your device only

• Photos and videos you capture with the App. These are never uploaded to any server unless you explicitly choose to share them - by posting to X/Twitter, or by turning on Public Mode (see Sections 3 and 4).
• Audio recorded as part of videos you capture. Audio is embedded in video files stored locally on your device and is never uploaded to any server unless you explicitly share the video (to X/Twitter or through Public Mode).
• GPS location, if you grant permission. Your location is embedded in the verification metadata attached to each photo or video and stored locally. It is not sent to our servers unless you choose to make that media public (see Sections 3 and 4).
• Device information used to generate verification metadata: device model, operating system version, app version, and Apple's identifierForVendor (a device identifier that resets if you uninstall the app). This is embedded in verification records but not transmitted to us except as part of media you choose to make public.
• Cryptographic keys generated by the App. These are created and stored entirely within your device's Secure Enclave and Keychain. They never leave your device under any circumstances.
• C2PA content credentials (Content Authenticity Initiative metadata) may be embedded in your photos. This includes a self-signed digital certificate and metadata about the App and capture details. This data is embedded directly in image files and will be included in any photo you share or export.
• User profile information you optionally enter: display name, bio, avatar image, X (Twitter) handle, and personal links. All optional. All stored locally on your device.
• Organization information you optionally create or join: organization name, description, avatar image, invite code, and membership data. All stored locally on your device.
• X (Twitter) access tokens, if you connect your X account. Stored in your device Keychain.

Your Witness account

• Sign in with Apple. Using the App requires a Witness account, which you create with Sign in with Apple. Apple provides us a unique account identifier that we store on our servers to maintain your account and to associate it with any content you choose to publish. We request no name or email from Apple, so we do not receive your name or email address through sign-in. You can delete your account and its server-side data at any time from within the App (Profile → Delete account); see Sections 7 and 8.

What the App does NOT collect

• We do not collect your name, email address, phone number, or password. Your account is created with Sign in with Apple using only an Apple-provided identifier (see above); we request no name or email. (The Verification Program, which is optional and separate, does collect an email and name - see Section 5.)
• We do not set or use cookies within the App. When connecting to X/Twitter, the App uses your device's web authentication session, which may use cookies already present in your browser.
• We do not send push notifications.
• We do not use Google Maps. The App uses Apple's MapKit for any mapping functionality.
• The App does not respond to Do Not Track signals because it does not track users.

2.How We Process Your Information

All capture processing happens locally on your device. The App uses your camera, microphone, and location to create verified media. It generates cryptographic hashes of your photos and videos to produce tamper-evident proof of authenticity. We do not process this information on our servers except where you choose to publish media (Public Mode, Section 4) or use the X posting feature (Section 3).

3.Third Parties

The App communicates with the following external services in limited, specific circumstances. We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act (CCPA).

4.Public Mode and the Live Map

By default, everything you capture stays private on your device. Public Mode is an optional, opt-in feature that lets you add a specific photo or video to the public Witness live map and feed, where anyone can view it and newsrooms may embed it. This section applies only to media you deliberately choose to publish.

What becomes public when you opt in

• The photo or video you select, along with its verification metadata: the capture timestamp, the GPS location where it was taken, and the cryptographic proof details (hashes, signatures, C2PA credentials, and device attestation).
• Optionally, the display name, handle, or organization you have chosen to attach to your public content.

Removal

You control what you publish. You can remove content you posted to the public map at any time from within the App or by contacting team@witnesshq.com; we will take it down from the public feed. Two things cannot be undone: (1) the SHA-256 hash anchored to the Bitcoin blockchain (see Section 6), and (2) copies that others may have made while the content was public.

5.Creator Verification Program

Witness offers an optional certification program for creators ("Witness Verified Creators"). Unlike the App, which is local-first, the Verification Program necessarily involves information you submit to us directly. This section applies only if you apply for or hold creator certification.

What we collect

• Application and scheduling information: your name, email address, and the public account handles and links you ask us to certify.
• The live interview: certification is earned through a live 1:1 video interview with the Witness team, conducted over a third-party video service. During the interview we assess, by human judgment, that a real person is appearing live and matches the public content of the account being certified. We may keep interviewer notes. If an interview is recorded, we will tell you before recording begins, and recordings are retained for no longer than 12 months.
• No automated biometrics: the liveness and identity assessment is performed by a human interviewer. We do not create, extract, or store biometric identifiers or templates (such as faceprints or voiceprints).

What we publish

Certified creators receive a public verification page and may be listed in a public creator directory. Public information is limited to: display name, certified handle(s), badge status (active or revoked), certification date, verification method, and an optional photo you provide. This information is public by design - the purpose of certification is that anyone can check it - and is published with your consent as part of the program.

Retention and removal

You may request decertification and removal of your public verification page at any time by contacting team@witnesshq.com. Upon request, your page will be removed or marked as revoked, and we will delete your application information within 30 days, except records we need to retain for fraud prevention or legal compliance.

Third-party services used by the program

Interview scheduling and the video call itself are provided by third-party services (such as a scheduling tool and a video conferencing provider). Information you provide to those services is governed by their privacy policies.

6.Important Disclosures

Bitcoin blockchain permanence. When you capture a verified photo or video, the App submits a SHA-256 hash (a mathematical fingerprint - not the media itself) to public OpenTimestamps servers, which anchor it to the Bitcoin blockchain. This hash becomes a permanent, immutable public record. It cannot be deleted, recalled, or modified - by you or by us - once submitted. By using the App, you accept this.

Public Mode is public. Any media you publish through Public Mode, including its capture location, is visible to anyone and may be embedded or copied by third parties while public. See Section 4.

Location data in shared media. Your GPS location is embedded in verification metadata. If you share a verified photo or video with another person, or publish it, that person or the public may be able to see the location where it was captured. You are responsible for deciding what to share and with whom.

Device identifier in verification metadata. Apple's identifierForVendor is included in verification metadata. This identifier is specific to your device and resets if you uninstall and reinstall the App.

C2PA content credentials in shared photos. The App may embed Content Authenticity Initiative (C2PA) metadata directly into your photo files. This metadata includes capture details and a self-signed digital certificate. When you share a photo, this embedded data travels with it and can be read by any C2PA-compatible tool. You cannot selectively remove this metadata after it has been embedded.

7.Data Retention

All data the App creates - photos, videos, verification metadata, profile information - is stored locally on your device. We do not retain copies of this data on our servers, with the exceptions below.

Deleting the App removes all photos, videos, verification metadata, and profile information stored in the App's local storage. Some items stored in your device's Keychain (such as X access tokens and cryptographic key references) may persist after app deletion due to how Apple's Keychain works. You can revoke X access through your X account settings and reset Keychain items by erasing all content and settings on your device.

Public Mode content you choose to publish is stored on our servers so it can be displayed on the public map, and remains there until you remove it or ask us to remove it. Verification Program information is retained as described in Section 5.

Your account. The account identifier from Sign in with Apple is stored on our servers for as long as your account exists. When you delete your account from within the App (Profile → Delete account), we delete your account and its associated server-side data, revoke any connected X authorization, and unlist content you published to the public map. Hashes anchored to the Bitcoin blockchain remain permanent and cannot be deleted (see below).

The one exception that no one can delete is Bitcoin blockchain records: SHA-256 hashes submitted to the Bitcoin blockchain are permanent and cannot be deleted by anyone.

When you use the X posting feature, your photo and access token are transmitted to api.witnesshq.com to facilitate posting. We do not store your photos or access tokens after the post is completed.

8.Your Rights

Because almost all data is stored on your device, you have direct control over it. You can delete any photo, video, or profile information within the App at any time, and remove any content you published through Public Mode.

You can permanently delete your Witness account at any time from within the App (Profile → Delete account). This removes your account and its server-side data, revokes any connected X authorization, and unlists content you published to the public map.

We cannot fulfill requests to delete data that was submitted to the Bitcoin blockchain, as that data is outside our control and permanently recorded by a decentralized network.

If you have connected your X account and wish to revoke access, you can do so within the App or directly through your X account settings.

California and State Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you specific rights regarding your personal information.

Categories of personal information collected: device identifiers (identifierForVendor and your Sign in with Apple account identifier), precise geolocation, photos and videos, audio, cryptographic hashes, internet activity (interactions with OpenTimestamps servers and api.witnesshq.com), any media and location you choose to publish through Public Mode, and - for Verification Program applicants - your name and email address.

We do not sell or share your personal information as those terms are defined under the CCPA.

Your rights: You have the right to know what personal information we collect, to request deletion of your personal information, to correct inaccuracies, and to not be discriminated against for exercising your rights. Because almost all data is stored locally on your device, you can exercise most of these rights directly by deleting data within the App, removing public content, or deleting the App. For data submitted to the Bitcoin blockchain, deletion is not possible as described in Section 6 above.

Residents of other US states with consumer privacy laws (including Virginia, Colorado, Connecticut, and others) may have similar rights. To submit a verifiable consumer request or exercise any privacy right, contact us at team@witnesshq.com.

9.Children's Privacy

The App is not directed at children under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you are under 13, do not use the App. If we become aware that we have inadvertently collected information from a child under 13, we will take steps to delete it. If you believe a child under 13 has used the App, please contact us at team@witnesshq.com.

10.Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. This policy is effective as of the date listed above. Continued use of the App after changes are posted constitutes your acceptance of the revised policy.

11.Governing Law

This Privacy Policy is governed by the laws of the State of California, United States, without regard to conflict of law principles. Any disputes arising under this Privacy Policy are subject to the dispute resolution provisions in our Terms of Service.

12.Contact

If you have questions about this Privacy Policy, contact us at: