Privacy policy

Who we are

This policy explains what the TimeWitness app and the public site at timewitness.dev collect about you, why, how long we keep it, and what you can ask us to do with it.

The controller is Fountech.ai Limited. Company number: HE 372766. Registered office: Evripidou 12A, Agia Zoni, 3031 Limassol, Cyprus. You can reach us at privacy@timewitness.dev.

1. What we collect

Only what the Service needs to run, and what comes with the feedback you choose to send us:

• Your account: your email address, your GitHub id and username if you sign in with GitHub, and the moment you turned off the letter about what changed, kept while it stays off.
• Your passkeys: each one's public key, its identifier, and when it was last used. Never a private key.
• Signing in: a hash of each session and each emailed sign-in link, never the link or the session itself.
• Organisations: the organisation's name, who belongs to it, and in what role, and the addresses of people invited to it.
• Machines: the names you give machine credentials, the public keys you enrol, and the domains you prove you hold.
• Receipts: the receipts your machines file, with the event and the repository they state. A receipt carries the hash of what was stamped, never the thing itself.
• Payments: your plan, its state, and the payment provider's identifiers for you and your subscription, with each event the provider sends us about it.
• Feedback: what you send through the feedback page on the public site. That is the kind you pick, the title, the description, the two answers asked when something is broken, your email address if you give one, and a screenshot if you attach one. With it we keep when you sent it, the page you came from, the build of the site, your browser and operating system as your browser states them, and the source named in the link you followed if it named one. Your account is put on it only where you are signed in to the app in the same browser and the address you give is that account's.
• The host: request logs, including IP addresses, kept on the host's own rotation.

There are no tracking pixels, no advertising, and no analytics in the app or on the public site.

2. Why we use it

• To provide the Service you signed up for, under our contract with you.
• To keep the Service secure and to fix it, which is our legitimate interest.
• To keep accounting records, which the law requires of us.
• To email you about the Service: sign-in links, a welcome, invitations, each payment received, a payment that did not go through, a plan changed, a plan cancelled, the notices about a lapsed plan, and the letter about what changed. This is our legitimate interest. The letter about what changed says what has changed in TimeWitness and may say what is coming. It is for everybody with an account who has not turned it off. Each letter has a link at its foot to stop it. Your account page turns it off or back on. The letter is the only email the app sends that is not about signing in, your account, an organisation, or a payment.
• To read your feedback, to act on it, and, if you gave an email address, to tell you when your point is dealt with. Giving an address there adds you to no mailing list. This is our legitimate interest.

3. What we do not do

• We don't sell your data.
• We don't show ads.
• We never receive the thing you stamp.
• We use your receipts only to run the Service for you.

4. What is public by design

The key log is public and permanent. Each entry names a public key, what it is for, a label, the window it is valid in and, for a certificate, the organisation's identifier and the way the key was enrolled. It never names the organisation, a person, or an email address.

An entry cannot be deleted, including on request, because the log only ever grows and a receipt's standing depends on the entry for its key. When an account or an organisation is deleted, its keys are retired by a new entry, and the earlier entries stay.

5. Who processes data for us

These companies process data for us, each only for the role named:

• Vercel: hosting the app and the public site.
• Amazon Web Services: running the app's database.
• Resend: sending the app's email.
• Stripe: taking payments. Card details go to Stripe and never to us.
• GitHub: signing you in, only if you choose to sign in with GitHub.

Where data goes outside the UK or the EEA, the transfer relies on recognised safeguards, such as standard contractual clauses or the EU-US Data Privacy Framework and its UK extension.

6. How long we keep it

• Your account and your passkeys: until you delete your account.
• Sessions: 14 days. Emailed sign-in links: 15 minutes, and each works once. Invitations nobody accepts: 7 days. Each is deleted once its time is up, the next time anybody signs in to the app or asks for a link.
• An accepted invitation is kept as the organisation's record of who joined it. When that person deletes their account, their address is taken off it.
• Receipts: for the organisation's retention period where one is set, and otherwise until the organisation is closed. A receipt removed by retention leaves its hash and its dates, never its bytes.
• Feedback: until you write to privacy@timewitness.dev and ask us to delete it. Feedback with your account on it is also deleted when you delete your account.
• Counts of checks, of invitations and of sign-in links: for the hour they are counted in, except the counts of invitations and of sign-in links sent across the whole app, which name nobody and are kept for a day, and the count of letters sent to one address, which is kept for a day under a keyed fragment of the address that a great many addresses share, never the address itself. The others name an organisation or a person by an identifier, never an address.
• Counts of feedback sent: for a day. One is kept under a keyed fragment of the sender's network address that a great many addresses share, never the address itself. One is kept under the account's identifier where the account is on the feedback. It goes when the account is deleted. Two are kept across the whole app and name nobody.
• Payment events: kept as accounting records.

Deleting your account does not remove accounting records, the key log, the record that a receipt was removed by retention, emails already sent, the payment provider's own records, or feedback sent without your account on it. Where that feedback has your account's address, the address is taken off it.

7. Your rights

Under the UK GDPR and the EU GDPR you can ask us for access to your data, and to correct it, delete it, restrict it, or move it. You can also object to what we do on the basis of legitimate interest.

The app lets you download a copy of your account at any time, from your account page. The copy has your email address, your GitHub username, when each passkey was added and last used, the organisations you belong to, whether you get the letter about what changed, and the feedback sent with your account on it.

To ask for anything else, write to privacy@timewitness.dev. You can also complain to a data protection authority. In Cyprus, where we are registered, that is the Commissioner for Personal Data Protection. In the UK it is the Information Commissioner's Office.

8. Cookies

The public site sets no cookie.

The app sets only the cookies it needs to work, so there is no cookie banner:

• __Host-tw_session keeps you signed in, for 14 days. When you send feedback from the public site, it is also read to see whether you are signed in.
• __Host-tw_github_state is set for 10 minutes while you sign in with GitHub, and only then.
• __Host-tw_wall is set only while the app is open to a named list of people rather than to everybody, and lets them past its entry page, for 7 days.

9. Security

Everything is encrypted in transit. Sign-in links, sessions, and machine credentials are stored only as hashes. There are no passwords anywhere, and signing keys never leave your machines.

If a breach affects your data, we tell you as the law requires.

10. Children

The Service is for people 18 or over.

11. Changes to this policy

A change is posted here with a new date. A material change is also flagged in the app.

12. Contact

Questions about this policy, or about your data, go to privacy@timewitness.dev.