Privacy Policy
How Cothenticity handles your information — written plainly, because a product about honesty cannot have a dishonest privacy policy.
The short version. Cothenticity watches how you work, not what you write. The capture engine runs entirely in your browser and records structural metadata — where an edit happened, how long it was, when, and whether it came from you, an AI, or a paste. Your actual words never leave your device unless you press Seal & publish. If you never publish, we never receive anything at all.
1. Who we are
Cothenticity is operated by Sam Squared Softwares ("we", "us"). We are the responsible party under South Africa's Protection of Personal Information Act (POPIA) and, where the GDPR applies to a user in the EU/EEA or UK, the data controller.
2. What is captured, and when
2.1 Before you publish — nothing reaches us
While you work in the Studio, everything is held in your browser's memory. We operate no telemetry, no analytics beacons, and no error reporting on that content. Closing the tab without publishing destroys the session permanently — we cannot recover it, because we never had it.
2.2 When you press "Seal & publish"
At that moment, and only then, you transmit a receipt to us. A receipt contains:
| Data | Why |
|---|---|
| Edit events: position, characters inserted/deleted, timestamp, origin (human / AI / paste) | This is the proof itself — the hash chain is computed over it |
| Document snapshots (the text of your work at intervals) | Powers the making-of replay. This is your actual content. |
| Title and author name, as you typed them | Displayed on the public receipt |
| Aggregates: active time, keystrokes, revisions, human/AI/paste ratio | The headline metrics |
| SHA-256 hash chain and its head | Tamper-evidence and the receipt's identity |
| A SHA-256 hash of your one-time manage token | Proves ownership without us ever storing the token |
Read this twice. Because snapshots are included, publishing a receipt publishes the text of your work to anyone holding the link. Do not publish receipts for confidential, client-privileged, personal, or embargoed material. There is no "private receipt" in version 1.0.
2.3 If you create an account
An account is optional for reading and verifying, and required to publish beyond a small trial. Creating one stores:
- Your email address — the only identifier we hold. It is used to send you sign-in links and, if you buy a plan, to reach you about it. We do not send marketing email.
- A session record — the SHA-256 of your session cookie, its expiry, and your browser's user-agent string, so you can see and end sessions. We store the hash, never the cookie value.
- Sign-in tokens — the SHA-256 of each emailed link, valid once and for 15 minutes.
There is no password, anywhere, for anyone — so there is none to leak, reset, or reuse.
2.4 Cookies
One cookie: coth_session, set only after you sign in. It is
HttpOnly, Secure and SameSite=Lax, holds a random value
with no personal information in it, and exists solely to keep you signed in. It is strictly
necessary for that purpose. We set no advertising, analytics, or third-party cookies of any
kind, and nothing on this site tracks you across other sites.
2.5 What we never capture
- No passwords — the product has none.
- No advertising or third-party analytics trackers.
- No clipboard contents from outside the editor (a paste is recorded as a length and an origin, not as sourced text).
- No IP address is ever written to our database. Addresses are used to rate-limit sign-in requests and trial publishes; what is stored is a salted SHA-256 hash of the address, which is a counter, not an identity. Hashes attached to trial publishes are deleted after 90 days.
3. Public by design
A published receipt is public to anyone with the link. It is not indexed by us, but links can be forwarded, and search engines may index a link that someone else publishes. Treat a receipt link exactly as you would treat a public web page.
4. Your manage key
Publishing issues a one-time manage token, stored in your browser's local storage. We store only its SHA-256 hash and therefore cannot recover, reset, or email it to you. If you clear your browser data without saving the key, the receipt becomes permanently unrevokable by anyone, including us. The app shows you the key and warns you for this reason.
5. Deleting your data
Press Unpublish on a receipt you own. This is immediate and permanent: the stored process data and snapshots are erased, the link returns HTTP 410 Gone forever, and that exact session can never be republished. We retain only the receipt's identifier and the fact of its revocation, so a withdrawn link cannot be silently reused.
If you have lost the manage key, contact us with the receipt ID. We can only act on a request we can reasonably verify, and we may be unable to verify ownership without the key.
To delete your account, email us from the address on the account. We erase the account record, its sessions and its sign-in tokens. Receipts you published stay published unless you unpublish them first — deleting the account only unlinks them from you. One thing we cannot erase: a receipt's entry in our append-only ledger, which records that a receipt existed and when. That record is what makes a receipt provable, and it deliberately contains no document content. See section 7.
6. Where data lives
Receipts and account records are stored in Cloudflare D1, hosted in Cloudflare's Western Europe region, and served through Cloudflare's network.
Our sub-processors are:
- Cloudflare — hosting, database, and content delivery.
- Resend — delivery of sign-in emails. Resend receives your email address for that purpose only.
Where personal information leaves South Africa, we rely on POPIA section 72 on the basis that the recipient is subject to comparable safeguards.
7. Retention
Published receipts are retained indefinitely, because a receipt whose link stops working defeats the purpose of the product. You control this: unpublish at any time.
| Receipt content and snapshots | Until you unpublish — then erased immediately |
| Ledger entries | Permanent, and cannot be edited or deleted by anyone, including us |
| Account record | Until you ask us to delete it |
| Sessions | 30 days, or immediately when you sign out |
| Sign-in tokens | 15 minutes, single use |
| Rate-limit hashes | 90 days |
The ledger is deliberately split from receipt content so that erasure and provability do not have to fight each other: unpublishing erases everything you wrote, while the permanent record keeps only identifiers, timings and hashes — never your document.
8. Your rights
Under POPIA and, where applicable, the GDPR, you may request access to, correction of, or deletion of your personal information, object to processing, and lodge a complaint with a regulator — in South Africa, the Information Regulator; in the EU/EEA or UK, your local supervisory authority. For most Cothenticity data, unpublishing is the fastest and most complete route.
9. Children
Cothenticity is not directed at children under 18 and we do not knowingly collect their information.
10. Changes and contact
Material changes will be reflected in the version and effective date above. Questions, or to exercise any right: cothenticity@sam-squared.com.
The responsible party (POPIA) / data controller (GDPR) is Sam Squared Softwares (Pty) Ltd, registration number 2026/536077/07, registered office 84 Donovan Street, Glen Austin, Midrand, Gauteng, 1685, South Africa.