Privacy Policy

Section 01What the app stores, and where

Everything below is stored in the app’s own storage on your device. None of it is sent to us.

• Evidence files: photos, videos, audio recordings and document scans you capture, photos and videos you import, sealed inspection and repair reports, and signature images.
• Certificate details: each file’s SHA-256 fingerprint, its RFC 3161 timestamp token and the name of the authority that issued it, the capture time, the device model and iOS version, the location if you allow it, whether the file was imported, and any label or notes you add.
• Your portfolio: properties and rooms; tenancies and guest stays, including any names, email addresses and phone numbers you enter for occupants, deposit and rent amounts and booking references; inspections with their ratings, notes, meter readings, keys, alarm checks and signatures; compliance documents and their dates; and repair issues with their timelines.
• Settings: the role you chose during setup, reminder and lock preferences, and how many free certificates you’ve used this month. If you set a Witnessed passcode, only a one-way hash of it is stored, not the passcode itself.
• Purchases: how many single certificates you have left, kept in the iOS Keychain on your device. Whether Witnessed Pro is active is checked with the App Store.
• Spotlight: property names and addresses and evidence titles are added to your device’s own Spotlight index so you can find them from iPhone search. That index stays on your device.

Section 02What leaves your device

The app makes as few connections as it can. These are the ones it makes:

• Timestamp authorities: when a file or report is sealed, its SHA-256 fingerprint is sent to DigiCert, or to Sectigo or FreeTSA if DigiCert can’t be reached. See section 6.
• Your iCloud: only if you turn on iCloud backup. See section 5.
• Apple’s geocoding service: if you allow location, the coordinates of a capture are sent to Apple’s location services, built into iOS, to look up a street address for the certificate. Apple handles this under its own privacy policy.
• Apple Maps: the map view of your evidence is drawn with Apple Maps, so the map images are loaded from Apple. Apple receives the map areas being displayed, which can show the general area where your evidence was captured. It doesn’t receive your files or records. If you choose to open a capture’s location in the Maps app, its coordinates are passed to Apple Maps. Apple’s privacy policy is at apple.com.
• The App Store: prices, purchases, subscription status and restores go through Apple. See section 10.
• Our web pages: if you open the privacy policy, terms, support or verify page from inside the app, it loads from witnessed.uk in an in-app browser, as described in section 4.
• Anything you share: certificates, reports, evidence packs, CSV exports and watermarked copies go wherever you send them with the iOS share sheet, together with the details they contain, which can include location and information about other people.

Links and QR codes on certificates open witnessed.uk/verify with the certificate number, fingerprint and time placed after a # in the address. Browsers don’t send that part of an address to a server, so our website never receives it.

Reminders are local notifications, scheduled and delivered on your device. No push notification service is used.

Section 03What we don’t collect

• We never receive your evidence files, your portfolio records or the details you enter about other people.
• There is no account. You don’t give us your name, email address or phone number to use the app. (The launch waitlist on our website is separate, entirely optional, and covered in section 4.)
• The app contains no analytics, crash-reporting or advertising software.
• We don’t collect advertising identifiers or track you across other apps or websites.
• We don’t sell, share or monetise your data.

Section 04The website and waitlist

This website doesn’t use advertising or tracking cookies, and its analytics (below) set no cookies. Like any website, the pages are delivered by our hosting provider, Vercel, which processes technical request information such as IP addresses to serve them, and the site’s fonts are loaded from Google Fonts, which receives your IP address when your browser requests them.

To count visits, the website uses Vercel Web Analytics, which is cookieless and gives us aggregated page-view statistics only: which pages are viewed, the website that referred the visit, any utm_ campaign tags on the link, and approximate location, browser, operating system and device type. It stores no personal identifiers. Visitors are counted using a hash of the request that is discarded after 24 hours, so a visit can’t be tied to you or followed across other websites. Before anything is sent, the site removes the part of the address after a # and every query parameter except utm_ tags. We use it on the basis of our legitimate interest in knowing how the website is used.

The verify page works entirely in your browser. Files you check there are read and fingerprinted on your own device and are never uploaded.

The one place the website collects personal data is the launch waitlist. If you choose to submit your email address there:

• What we collect: your email address, when you signed up (and when you last submitted the form, if you submit it again), and how you found us: any utm_ tags on the link you arrived by, the address of the website that referred you (without its query string) and the first page you landed on. Your browser keeps those last three in session storage on your device until you close the tab, and they are only sent to us if you join the waitlist. We don’t ask for your name, we don’t store your IP address, and we don’t profile you.
• Why: to confirm you’ve joined, to send you a single email when the app is released, and to see which of our links and posts bring people to the waitlist. We won’t add you to a newsletter or send you marketing about anything else.
• Lawful basis: your consent, given by submitting the form. You can withdraw it at any time by emailing support@witnessed.uk, and we will delete your address.
• Where it goes and who can read it: your details are stored by Vercel, acting as our data processor. The store is private — it can’t be read without our credentials — and it is located in London, in the United Kingdom. We don’t sell it, share it or pass it to advertisers.
• Sending the emails: the confirmation and the launch email are sent through Resend, an email delivery service acting as our data processor, which receives your email address and the message. Resend stores message and delivery records in the United States for up to 30 days. That transfer is protected by the UK Addendum to the standard contractual clauses in Resend’s data processing agreement, and by its participation in the UK Extension to the EU–US Data Privacy Framework. The emails contain no tracking pixels or tracked links.
• How long we keep it: until the launch email has gone out, or until you ask us to remove you, whichever comes first. There is no other use for it and we don’t keep it “just in case”.

Section 05iCloud backup

iCloud backup is optional and off until you turn it on in the app’s Settings. When it’s on, your evidence files, certificates and portfolio records are copied to a private database in your own iCloud account using Apple’s CloudKit, so you can restore them on another device signed in to the same Apple ID.

That data is subject to Apple’s iCloud terms and protected by Apple’s security. It sits in your private iCloud database, which Witnessed, as the developer, cannot open, read or retrieve.

Turning backup off stops new copies being made; copies already in your iCloud stay there until you delete them. Settings → Delete all data in the app removes them while backup is on.

Section 06Timestamp authorities

To seal a photo, video, recording, scan or report, the app calculates its SHA-256 fingerprint on your device and sends that fingerprint, in a standard RFC 3161 request, to an independent timestamp authority. The authority signs it together with the current time and sends back a token, which is stored with the certificate.

• Which authority: DigiCert is tried first. If it can’t be reached, Sectigo, then FreeTSA.
• What they receive: the fingerprint and the standard fields of the request, plus your IP address, as with any internet request. They never receive the file, its location, your name or anything else from your records. A fingerprint can’t be turned back into the file.
• How it’s sent: DigiCert’s timestamp service only accepts plain HTTP, so requests to it aren’t encrypted in transit. The response is signed by DigiCert, so it can’t be forged on the way back, and the request contains nothing but the fingerprint. Requests to Sectigo and FreeTSA use HTTPS.

Each authority handles requests under its own policies: DigiCert, Sectigo and FreeTSA.

Section 07Location

Location is optional. If you allow it, Witnessed reads your location only while the app is in use, at the moment of a capture, and records the coordinates, their accuracy and a street address on that item’s certificate. It never tracks you in the background, and no location is recorded for photos or videos you import.

A capture’s location is included in the certificates, reports and packs you share. You can turn location off at any time in iOS Settings, and Witnessed will keep working without it.

Section 08Permissions

• Camera: to capture photo and video evidence and scan documents.
• Microphone: to record audio evidence and the sound on video.
• Location (while using the app): to record where each capture was made. See section 7.
• Photo Library: to import existing photos or videos, which are marked as imported, and to save a copy to your library only when you choose to.
• Face ID or Touch ID: to lock the app, if you turn that on. Biometric checks are handled entirely by iOS and never leave your device.
• Notifications: for deadline reminders and to tell you when pending items have been sealed. These are scheduled on your device.

Every permission is optional and requested only when it’s needed. Declining one limits the related feature but doesn’t stop you using the rest of the app.

Section 09Information about other people

Letting involves other people. You may record tenants’, guests’ and contractors’ names, contact details and signatures, and your photos and videos may show people or their belongings.

That information is stored in the same way as the rest of your records: on your device, and in your private iCloud if backup is on. We never receive it. If you use Witnessed in the course of letting or managing property, you decide what is recorded and who it’s shared with, so you are responsible for handling it lawfully under data protection law, including telling people how their information is used.

Section 10In-app purchases

Purchases and subscriptions are processed by Apple under Apple’s privacy policy. The app receives confirmation of a transaction from Apple on your device, and checks whether Witnessed Pro is active the same way. We never see your payment details or your Apple ID. Apple provides developers with sales reports, which don’t identify you.

Section 11Legal basis & your rights (UK GDPR)

Where the UK GDPR and the Data Protection Act 2018 apply, the limited processing described above is carried out to provide the service you asked for (performance of a contract): sealing files you choose to seal and backing up to iCloud if you turn it on. The launch waitlist relies on your consent, as described in section 4.

You have the right to access, correct, export or erase your personal data, and to object to processing. Because your records are held on your own device and in your own iCloud rather than by us, you can exercise most of these rights directly and immediately:

• Access and export: open any item in the app, or use Settings → Export all evidence or Export CSV.
• Correction: edit labels, notes and portfolio records in the app. Sealed details such as the file, fingerprint and timestamp can’t be changed, because that is the point of sealing them.
• Erasure: delete items in the app, or use Settings → Delete all data. We hold no copy to delete.

If you want to exercise a right that you can’t action yourself, such as removing your email address from the waitlist, contact us using the details in section 15 and we will respond within one month. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

Section 12Keeping and deleting data

• On your device: your records stay for as long as you keep them. Deleted evidence goes to Recently Deleted and is removed after 30 days, or sooner if you empty it.
• Delete all data: Settings → Delete all data removes your evidence, properties, inspections, tenancies, documents and issues from the device, and their copies in iCloud if backup is on.
• Deleting the app: removes the app’s data from that device. Copies in your iCloud stay until you delete them, and single-certificate credits in the Keychain may remain on the device.
• Timestamp authorities: may keep records of the requests they receive, which contain only fingerprints, under their own policies.
• Things you’ve shared: stay with whoever you sent them to. We can’t recall or delete them.

Section 13Children’s privacy

Witnessed is not directed at children under the age of 13. We do not knowingly collect personal information from children.

Section 14Changes to this policy

We may update this policy, for example when the app changes what it does. Changes will be posted on this page with a new “last updated” date.

Section 15Contact

If you have questions about this privacy policy or how your data is handled, contact us at support@witnessed.uk. We aim to reply within two working days.

See also our Terms of Use and Support page.