Privacy Policy

Last updated: June 1, 2026

Who we are

This Privacy Policy describes how Auriginal ("Auriginal," "we," "us") handles information in connection with the Auriginal iOS app and the verification website at auriginal.app and verify.auriginal.app (together, the "Service"). If you have questions, contact us through our contact form.

Information we collect

Auriginal is designed to minimize data collection. We do not require an account, and we do not ask for your name, email, or contacts to use the app. The information we process falls into the categories below.

When you capture media with the app

At the moment you take a photo or video, the app collects a "sensor snapshot" used to assess whether the capture is physically consistent with a real-world event:

• The photo or video you capture, and a short ambient audio signature recorded around the moment of capture.
• Precise location (GPS), used to cross-check against other sensors. Location is not tracked in the background.
• Device motion and environment sensors — accelerometer, gyroscope, magnetometer, barometric pressure, ambient light, depth, and proximity readings.
• Nearby network and device presence — the availability of Wi-Fi, cellular, and Bluetooth, and a count of nearby Bluetooth devices. Network identifiers (such as a Wi-Fi network name) are processed through a one-way hash before they are stored or transmitted, so the original identifier is never retained.
• Device integrity and attestation signals — indicators used to confirm the capture came from an authentic, unmodified Apple device (via Apple's App Attest), and a hashed device identifier. These identifiers are stored as hashes, not in a form that identifies you personally.
• Timestamps and a cryptographic signature created on your device's Secure Enclave that binds the above together.

When you verify media

When you (or anyone) checks a capture on the verification website, we process the media file or verification ID submitted for that check and compute hashes of it solely to compare it against the stored record. We log basic technical request information (such as IP address and a timestamp) for security, rate-limiting, and abuse prevention.

How we use information

We use the information above for one purpose: to perform and deliver media authenticity verification. Specifically, to run the cross-sensor physics-consistency assessment, to generate and verify the cryptographic proof, to create a verification record that can be checked later, and to protect the Service against abuse. We do not use your information for advertising or profiling.

Verification records are designed to be publicly checkable

The entire point of Auriginal is that a verified capture can be checked by anyone who has the capture's QR code or verification ID. When you create a verified capture, a verification record is created and stored, and the captured image and its verification result may be displayed on a public verification page that anyone with the link or QR code can open. Please keep this in mind: do not create verified captures of content you would not want to be independently viewable and verifiable.

How information is stored and protected

• Verification records and uploaded media are stored on our servers and cloud storage (Amazon Web Services).
• Data is encrypted in transit using HTTPS/TLS.
• Device and network identifiers are stored as one-way hashes, not raw values.
• The cryptographic key that signs your captures is generated and held in your device's Secure Enclave; we never receive it.
• Stored canonical media is retained immutably so that a verification can be re-checked over time.

How we share information

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share information only:

• With service providers that host and operate the Service (for example, our cloud infrastructure provider) under obligations to protect it;
• As part of the public verification record described above, when you create a verified capture;
• If required by law, or to protect the rights, safety, and security of Auriginal, our users, or the public.

Tracking and analytics

Auriginal does not use third-party advertising SDKs and does not track you across other companies' apps or websites. Our app's privacy manifest declares no tracking.

Data retention

Verification records and their associated media are retained for as long as needed to provide ongoing verification, which is the core function of the Service. Technical security logs are retained for a limited period. You may request deletion as described below; note that deleting a record will cause its QR code and verification link to stop resolving.

Your choices and rights

• Permissions: You control camera, microphone, location, motion, Bluetooth, local network, and photo access in iOS Settings, and can change them at any time. Some verification features depend on these sensors.
• Access and deletion: Depending on your location, you may have the right to access or request deletion of information associated with your captures. To make a request, use our contact form and include the relevant verification ID(s).
• Do Not Sell / Share: We do not sell or share personal information as those terms are defined under applicable U.S. state privacy laws.

Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will take appropriate steps.

International users

We operate the Service from the United States. If you access it from outside the U.S., you understand that your information may be processed and stored in the United States.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above, and material changes will be reflected on this page.

Contact us

Questions or requests about this policy or your information: reach us through our contact form.