Privacy Policy - C2PA Viewer

1. Introduction

Welcome to C2PA Viewer. We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website and services. Our core privacy promise is simple: we do not store your files. All C2PA data processing happens directly in your browser, unless you explicitly choose to create a shareable report — that sends your file to our server once for one-time re-verification, which is never stored, and we retain only the resulting verification data — see below.

2. Data We Collect

C2PA Viewer is designed to respect your privacy from the ground up. Here's a breakdown of the data we handle:

Uploaded Files: We do not upload, store, or transmit your files to our servers. When you select a file, it is processed locally in your web browser and never leaves your device — unless you explicitly choose to create a shareable report, in which case your file is sent to our server once for one-time verification and immediately discarded; see Shareable Reports below.
C2PA Data: The C2PA manifest data extracted from your file is also processed locally. We do not log, store, or analyze this information, unless you use the Shareable Reports feature described below.
Shareable Reports: If you choose to click "Create shareable report," your file is sent to our server one time so we can independently re-verify its C2PA credentials — this exists so a shared report reflects what our server actually verified, not just what your browser claimed. Your file is processed in memory only, is never written to disk or any persistent storage, and is discarded immediately once verification finishes. We then store only the resulting C2PA manifest data and validation result — not the file, and no images or thumbnails — on our servers, accessible to anyone who has the report's link. This is entirely optional and only happens when you explicitly request it. You choose how long the report is kept (7, 30, or 90 days), after which it is automatically deleted. You're also given a one-time delete link at creation to remove it earlier. Report links are unauthenticated and unlisted (not indexed by search engines), meaning anyone with the link can view the manifest and validation data — there is no login gate. The site operator can also view and delete any report at any time, independent of the creator's delete link, for moderation and support purposes. A manifest can occasionally include location data (e.g. GPS coordinates embedded by a camera) or other identifying details if the original file's creator chose to include them — review what you're sharing before creating a report. For files larger than our direct upload limit, your file is instead uploaded directly to Vercel Blob, our cloud storage provider, so it can bypass a hard platform limit on how much data our server can receive in one request. In that case, the file sits briefly in Blob storage under an unguessable, unlisted URL, while our server retrieves it for the same one-time verification described above, then our server deletes it from Blob immediately afterward, whether verification succeeds or fails. We use Vercel Blob only as this transient waypoint for large files, never as a place your file is meant to remain (see Third-Party Services below for details on Vercel Blob and our existing Upstash Redis infrastructure). Our browser verifier and our server verifier occasionally disagree, since they run different versions of the underlying verification engine; when that happens for your report, we send both derived manifests to PostHog so we can review the difference, in addition to the analytics events described in Third-Party Services below.
URL Inspection: When you paste a link instead of uploading a file, our server (acting as a proxy) fetches the file and streams it to your browser, which verifies it locally, exactly like an upload. We never store the file's bytes, and verification never runs on our server. For security audits and abuse prevention, we do save the URL you submit for inspection, together with a hashed, non-reversible form of your IP address, the response size, and a timestamp. These records are retained for 30 days. If you would rather not have a URL recorded, download the file and upload it directly; that path never touches our server.
Usage Analytics: We use PostHog to collect anonymous usage data such as pages visited and interaction events (e.g., file type uploaded, whether a C2PA manifest was found). File names are never sent to analytics. PostHog is configured with memory-only persistence, meaning no cookies or local storage are used — analytics data exists only in browser memory and is discarded when you close the page. IP address collection is disabled. This data is processed by PostHog Inc. and subject to their privacy policy.

3. How We Use Your Data

The limited data we collect is used for the following purposes:

To provide and maintain our service, allowing you to view C2PA metadata from your files.
To improve our website and services by understanding how users interact with our tool.
To ensure the security and stability of our platform.

4. Data Security

We do not store your files, and all processing occurs on the client-side (your browser) by default, which is the most secure way to handle sensitive file information, minimizing the risk of a data breach. The one exception is Shareable Reports: if you opt in to that feature, the resulting C2PA manifest data is stored on our servers for your selected retention period, and a manifest can occasionally include personal data, such as GPS coordinates, an author name, or the software used, if the original file's creator embedded it (see Shareable Reports above). For large files sent through the Shareable Reports feature specifically, the original file also touches Vercel's Blob storage for a brief window, measured in seconds, strictly for the duration of server-side verification, and is deleted immediately after. We implement standard security measures to protect our website, that stored manifest data, and any anonymous analytics data we collect.

5. Your Rights

You have the right to understand how your data is used. For the default browser-only experience, we do not collect personal information, so many data protection rights (such as access, rectification, or erasure) are not applicable in the traditional sense. The exception is Shareable Reports: if you opt in to that feature, the stored manifest data may include personal data (see Shareable Reports above and Data Security below), and the rights below apply to it. You have the right to:

Use our service with the assurance that your files are not being stored.
Delete a shareable report you created at any time using the one-time delete link provided when you created it, or by contacting us if you no longer have that link. Reports are also deleted automatically after their selected retention period (7, 30, or 90 days).
Opt out of analytics tracking by using your browser's built-in ad/tracker blocking features or any content blocker extension.
California residents (CCPA/CPRA): You have the right to know what personal information is collected about you, to request deletion, and to opt out of sharing your data with third parties. Our analytics use memory-only persistence with no cookies and no cross-site tracking; we never store your raw IP address, though for the Shareable Reports and URL Inspection features a salted, non-reversible hash of it is used for abuse prevention and rate limiting. If you have concerns, please contact us.

6. Third-Party Services

We use PostHog (provided by PostHog Inc.) to understand how visitors use this site. Our PostHog integration is configured with the following privacy-preserving settings:

No cookies or local storage: Analytics use memory-only persistence. No data is saved to your device.
No raw IP storage: We never store your raw IP address. For the Shareable Reports and URL Inspection features, abuse prevention and rate limiting are keyed on a salted, non-reversible hash of it instead.
No session recording: We do not record screen activity or user sessions.
No autocapture: Only explicitly defined events are tracked.

In addition to this browser-side analytics, our server independently sends its own events to PostHog for the Shareable Reports and URL Inspection features (for example, when a report is created or rejected). These server-side events carry the same salted, non-reversible IP hash described above, never your raw IP address. In the rare case a Shareable Report's browser verification and server verification disagree, we also send both derived manifests to PostHog as part of that event, so we can review exactly what each side found and improve our verification code. This is the one exception to keeping manifest content off PostHog, and it only happens for that specific report.

We do not share data with advertisers. PostHog's privacy policy is available at posthog.com/privacy.

We use Upstash (Upstash, Inc.) as our Redis data store. It holds rate-limiting counters for abuse prevention, and — only if you create one — the manifest/validation data for a shareable report, until it expires or you delete it. Upstash's privacy policy is available at upstash.com.

We use Vercel Blob (Vercel Inc.) as temporary storage for large files submitted through the Shareable Reports feature, when a file exceeds the size our server can accept directly. A file placed there is stored under an unguessable, unlisted URL, and is deleted the moment our server finishes verifying it, typically within seconds. In the rare case an upload is started but never completed (for example, if you close the tab partway through), a routine cleanup process removes any leftover file within about a day. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.

7. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically for any changes.

8. Contact Us

If you have any questions about this Privacy Policy, please contact us.