Privacy notice
What we collect, why, and how long we keep it.
Verifying a certificate
You do not need an account to verify a certificate, and we do not set an analytics cookie to do it. We increment a counter on the certificate and record the lookup in our audit log with the requesting address, so we can detect enumeration attempts against the register. Addresses in abuse reports are stored as a keyed hash, not in the clear.
Publisher accounts
We store your email address, display name, optional studio name, and a hash of your password. Passwords are hashed with Argon2id where the host supports it, bcrypt otherwise. We never see the plaintext.
If you enable two-step verification, your TOTP secret is encrypted at rest with a key derived from the application key, and your recovery codes are stored only as hashes.
Submitted builds
Uploaded artifacts are stored outside the web root with restrictive permissions and are readable only by the review process. We do not redistribute them. They are retained for the life of the associated certificate plus twelve months, so that a later dispute can be settled against the exact file we reviewed.
Audit log
Privileged actions (sign-ins, issuance, revocation, role changes) are written to an append-only log with the acting account, address and user agent. This log is retained for two years. It exists so that a certificate can always be traced to the analyst who signed it.
Cookies
One session cookie, set only once you sign in. It is HttpOnly, SameSite=Lax, and marked Secure over HTTPS. Your theme preference is stored in your browser's local storage and never sent to us. There are no third-party trackers on this site, and no external scripts or fonts are loaded.
Who we share with
Nobody, except where we are legally compelled, or where a build is confirmed malicious and we notify the platform distributing it. In that case we share the artifact hash and our findings, not your account details.
Your rights
You can request a copy of your data, correct it, or ask for deletion by writing to legal@backprobe.org. Deleting an account does not erase issued certificates from the public register, whose value depends on it being historically complete. We will unlink them from your personal details.
Security reports
If you find a vulnerability in this service, please report it to legal@backprobe.org before disclosing it publicly. We will confirm receipt within two business days.