Privacy Policy

Overview

0byte Lab ("0byte", "we", "us") operates a C2PA certification and signing service for AI-generated content. Stamping signs a spec-compliant C2PA manifest into your file and records a derived fingerprint in a public transparency log; verification reads that evidence back and returns a verdict. This policy covers 0byte.tech, the registry API at api.0byte.tech, the dashboard, the command-line tool, and our Python and TypeScript SDKs (together, the "Service").

This policy is written to be checked against the code, not merely asserted. Where it describes what happens to content you send us, that behaviour is implemented in the registry service and is testable from the outside.

0byte does not publish a browser extension. If you encounter one bearing our name, it is not ours.

The short version

• We do not store the files you send. Content submitted to stamping or verification is processed in memory and discarded once the response is written — it is never saved to disk or to our database.
• Verification is anonymous. It requires no account and no API key, and we do not attach it to one.
• The public site sets no cookies and runs no third-party analytics, advertising, or tracking scripts.
• What becomes public is only what you ask us to publish: the derived fingerprint and the proof metadata you attach to it.
• A fingerprint is one-way. It is a compact perceptual hash of what content looks like; it cannot be used to reconstruct or view the content it came from.

Content you send us

Stamping and verification both take your content as input. Here is what happens to it, in each case:

• Stamping — we decode the content in memory, embed a signed C2PA manifest into it (for formats that support one), derive a perceptual fingerprint, and return the stamped bytes to you. The bytes we return are yours to publish; we keep no copy of the file you sent or the file we produced.
• Verification — we decode the content in memory, read any embedded C2PA manifest, and look the derived fingerprint up in the registry. Nothing about the request is written to the registry: verifying a file creates no record of that file.
• The optional AI-likelihood estimate — if, and only if, you explicitly call the analyze endpoint, your content is additionally sent to our classifier service to produce a statistical estimate. That estimate is never part of a verification verdict. It is opt-in, and if you never call that endpoint your content never reaches the classifier.
• Size limits — we accept up to 10 MB of content in a request body of up to 15 MB. Content over that limit is rejected, not truncated or stored.

What we do store

Persisted records are limited to what the Service needs to function:

• Account data — your name and email address, and your password stored only as an Argon2 hash. We never hold your password in a readable form.
• API credentials — stored only as a SHA-256 hash of the key. We cannot show you a key again after it is issued, and we cannot recover one for you; a lost key is replaced, not retrieved.
• Proof records — for each stamp: the derived fingerprint, the content type, the provider and model you declared, any metadata and creator details you attached, the timestamp, our signature and signing-key identifier, and which API key created it. Not the content itself.
• Usage records — per API key, the endpoint called, HTTP status, latency, and time. These power your dashboard and our rate limits. They contain no request bodies and no IP addresses.
• Waitlist entries — the name and email you submit, plus your role and use case if you choose to give them.
• Command-line sign-in — a short-lived pairing record that includes the IP address the sign-in was started from. It expires within minutes and is deleted with the record.

IP addresses

We read your IP address on API requests to apply per-client rate limits and to detect abuse. Outside the short-lived command-line pairing record described above, we do not write it to our database — it is used for the life of the request and not retained by us.

Separately, our hosting provider captures standard HTTP access logs (source address, request line, status, latency) as part of operating the infrastructure. Those logs sit with the provider under their retention terms rather than in a 0byte-controlled table, and we do not use them to build profiles of individuals.

The transparency log is public by design

Every proof is anchored in a public, append-only Merkle log. That is the point of the product: anyone can independently verify that a proof existed at a given time and that the log's history was never rewritten. Trust comes from the math being checkable by strangers, which requires the entries to be readable by strangers.

This means the fingerprint, proof identifier, provider, model, timestamp, any metadata you attach, and any creator name and URL you supply are public and permanent. They are served to anyone who queries the log or the proof page.

Do not put personal, confidential, or sensitive information in the metadata or creator fields of a proof. Because the log is append-only, an entry cannot be edited or removed after the fact without destroying the verifiability of every proof anchored after it.

Using verification without an account

Verification is free, public, and requires no relationship with us. When you verify a file that way, you are not acting on any customer's instructions and no customer is involved in the request.

For that processing, 0byte is the controller and decides the purpose and means: we check the file you submitted, return a verdict, and apply rate limits to keep the service available. We do not create an account for you, and we do not retain the file or a record of the check.

Cookies, analytics, and tracking

The public site sets no cookies. We do not use Google Analytics or any other third-party analytics, advertising, retargeting, or session-replay service, and there are no third-party tracking scripts on 0byte.tech.

If you sign in to the dashboard, your session token is held in your browser's local storage and sent only to our own API. Signing out removes it. Our internal content-management area at /admin uses a session cookie for 0byte staff; public visitors are never issued one.

How we use information

• To create, anchor, and serve proofs of origin, and to answer verification requests.
• To operate, secure, and improve the Service — including rate limiting, abuse prevention, and diagnosing failures.
• To show you your own usage in the dashboard.
• To contact you about your account, your waitlist position, security matters, or material changes to the Service.

Sharing

We do not sell your personal information, and we do not share it for advertising.

We share data with infrastructure providers that process it on our behalf under contract — principally our hosting and managed-database provider — and where we are legally required to. Email hello@0byte.tech for the current list of providers.

Proof data in the transparency log is, by design, available to anyone who queries it.

Security

Measures currently in place, stated as they are implemented rather than as generic assurance:

• Content is processed in memory only and never persisted.
• Passwords are hashed with Argon2, a memory-hard algorithm; API keys are stored only as SHA-256 hashes.
• All endpoints are served over TLS.
• Accounts and API keys are tenant-isolated at the API layer, with automated tests in our pipeline asserting that one account cannot reach another's data.
• API keys are individually revocable and stop authenticating immediately when revoked.
• The source repository is scanned for leaked credentials on every change.

What we have not yet done

We do not hold a SOC 2 or ISO 27001 attestation, we have not published a third-party penetration-test report, and we do not yet have a formal incident-response runbook. We would rather say so plainly than imply a certification we do not have. If your procurement process needs one of these, tell us where you are and we will tell you honestly whether we can meet it.

Our security policy, including how to report a vulnerability and the safe-harbour commitment that goes with it, is published in the SECURITY.md file of our public repository.

Data retention

• Content you submit — not retained at all; discarded when the request completes.
• Account data — kept while your account is active, and deleted on request.
• Proof records and transparency-log entries — permanent by design. They cannot be deleted without breaking verification for every proof anchored after them, and we will not do it.
• Usage records — kept to power your dashboard and our rate limits, and aggregated over time.
• Command-line pairing records — expire and are deleted within minutes.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal account data, or to object to or restrict certain processing. Email hello@0byte.tech and we will action it; there is no self-service delete button in the dashboard yet, so a request by email is the route.

One limit, stated up front rather than discovered later: entries already anchored in the transparency log cannot be erased. What is anchored is a one-way fingerprint and the metadata you chose to attach — never your content — and the log's integrity guarantee depends on entries being permanent.

If you believe we have handled your data improperly, you may also complain to your local data-protection authority.

International transfers

The Service is operated from infrastructure that may be located outside your country. Where personal data is transferred out of the EEA or UK, we rely on an appropriate safeguard such as the European Commission's Standard Contractual Clauses. Email us for the specifics that apply to your account.

Children

The Service is a developer tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as the Service changes. Material changes are reflected in the "Last updated" date above, and we will notify account holders of significant ones by email.

Contact

Questions about this policy, your data, or a rights request? Email hello@0byte.tech. For data-processing terms as a business customer, ask us for our data processing agreement.