Privacy Policy & Terms

Validag Solutions Ltd, a company registered in the Republic of Cyprus, operates the Captilo app, captilo.app and real.gallery, and is the controller for the personal data described here.

Validag Solutions Ltd, company no. HE 488187
Karaolis Imperial Court, Office 1002, 60 Agias Zonis Street, 3090 Limassol, Cyprus
contact@captilo.app

Photos, their proof records (including location, device details and your username), certificates and app settings are stored in the app on your phone. Your 12-word recovery phrase and signing keys are kept in the phone’s secure storage. On Android, Captilo’s data is excluded from automatic device backups, so the app’s own backup is how you keep a copy.

Backups and certificates you create contain photos and their full records. Where they go, whether saved to your phone or shared through another app, is your choice. If you email yourself your recovery phrase from the app, it is stored by your email provider, and anyone who has the phrase can recreate your signing key.

Everything below is what the Captilo app sends when you use a feature. Optional features only send data when you use them.

Our web servers log requests, including the app’s, with a shortened IP address (its last part removed), time, the address requested and the browser or app user agent. Error entries can contain the full IP address. These logs are deleted after 14 days. In our application logs your pseudonymous ID is replaced by a short code that cannot be traced back and changes whenever the server restarts. We use logs to keep the service secure and to fix faults, never to profile you.

Publish Online is optional and puts a page for one photo at real.gallery/<Proof ID>. The app sends the original photo, its signed proof record, your public key and a signature to Captilo’s servers, which check them against the Sonic blockchain and pass the page to real.gallery. The page shows the original file exactly as it was captured, including technical data the camera wrote into it; when it was taken and in which time zone; its blockchain record; and what the phone checked at capture. Where it was taken, and your Captilo ID, appear only if you switch them on when publishing; both are off by default. Your username and device are never stored with the page, and your public key only as the Captilo ID, if you switch it on.

A published page is public. Anyone can open it with its Proof ID, which is printed on shared photos and, because every photo’s fingerprint is written to the public Sonic blockchain, can also be worked out from the blockchain. real.gallery has no list or search of pages, tells search engines not to index them and limits lookups: that makes collecting pages in bulk hard, not impossible. You can take a page down in the app at any time. Its files are deleted and only the Proof ID and the date remain, so its address can say it was taken down, unless the page had been reported to us.

Your pages, and any exports you host, are also listed on your site on real.gallery, at an address made of random characters that only you hand out, as a link or a QR code from the app. Nothing links to it, there is no list of sites and search engines are told to stay out. It names nobody unless you set a display name. You can hide single photos, replace the link or switch the site off. The site is the one place real.gallery knows which pages belong together, under the key the app uses for Real Gallery, never your name or device.

Exporting a photo with Content Credentials (C2PA Export) is a separate option. To create the Content Credentials, the app sends a copy of the photo resized to 1080 pixels and its signed proof record to Captilo’s servers, along with your username, your public key and signature, and your pseudonymous ID. The proof record includes the capture location, but the location is written into the exported file only if you switch on location sharing when exporting. It is off by default.

The C2PA manifest in a C2PA export always includes the device model, platform and OS version, capture time and time zone, camera facing, the integrity-check result, the biometric commitment hash and authentication type, and the title “Photo by @username”. An optional watermark adds @username to the image itself. The C2PA signature is time-stamped by Sectigo, which receives only a hash.

Hosting the export on real.gallery is a further choice, off by default. A hosted copy is stored there with your username, the proof’s IDs and hashes, and a perceptual hash of the image. Hosted photos are public by default: they are listed on your site and can be found by a visual-similarity search, which returns only their link. You can change their visibility or delete them from the app. Deleting removes the image, its view history and everything that links it to you. Only the export ID and the date of deletion remain, so its link can show that the photo was deleted. If the photo had been reported to us, we also keep what we need to handle the report: the username, public key, proof IDs and hashes. The blockchain registration of the proof behind an export is permanent and includes a hash of your public key, which links your proofs to one another.

Certificates uploaded to real.gallery from the Partner Hub before 16 September 2026 keep the details chosen then, which can contain location, device details and trust score. New certificate uploads are no longer possible. If you sign in on real.gallery, your login token and public key are kept in your browser’s local storage. real.gallery’s web server logs keep a shortened IP address and the page requested, with usernames and keys in the address masked, for 14 days; error entries can contain the full IP address. To delete a real.gallery profile, email us.

Captilo never receives fingerprint or face data. Your phone’s operating system performs the check and tells the app only whether it succeeded, not which enrolled finger or face was used. The biometric commitment in each proof is a one-way SHA-256 hash of an anonymous ID, a single-use code and the photo hash. It cannot be reversed, cannot identify you, and is not biometric data under Article 9 GDPR.

• Verifying a certificate. A file you upload is saved temporarily under a random name, checked, and deleted as soon as the check finishes, including when it fails. To look the proof up on the Sonic blockchain, our server sends only the proof ID printed on the certificate to Captilo’s proof registry service; the comparison with the file happens on our server, and nothing else from the certificate is sent anywhere.
• Requesting a proof. A photo that carries the Captilo label is examined in your browser and not uploaded: only the 12-character Proof ID it found is sent. The request holds that ID, its status and the date — no IP address, no account, no cookie, nothing about the photo itself. It is then public: the list of open requests is readable by anyone at captilo.app/requests, and Captilo apps fetch the same list and compare it against the proofs they hold, on the phone. That is what makes the request work without anybody being told who holds what. To limit abuse, requests per IP address are counted in memory for up to an hour, and the list has a ceiling. Our access logs record the ID lookups without the ID; error entries can still contain the full address and are deleted after 14 days like all logs.
• Contact form. Your name, company (optional), email address, use case and message are sent to us by email together with your IP address. They are not stored in a database or written to our server logs.
• Server logs. A shortened IP address, time, the page requested, referrer and browser user agent, kept for 14 days for security and troubleshooting.
• No cookies or tracking. captilo.app sets no cookies and uses no analytics or tracking tools. Your light or dark theme choice is saved in your browser’s local storage and never sent to us.

• Contract (Art. 6(1)(b) GDPR): creating and anchoring proofs, credits and plans, publishing, teams, checking a certificate you upload, requesting a proof and answering a request, and answering your enquiry.
• Legitimate interests (Art. 6(1)(f) GDPR): keeping the service secure and preventing fraud and abuse, through device attestation, rate limits and server logs. Our interest is an evidence service that cannot be misused. You can object at any time.
• Legal obligation (Art. 6(1)(c) GDPR): payment, tax and accounting records.
• Consent (Art. 6(1)(a) GDPR): access to your location, and including the location in a published page or a C2PA export. You can withdraw it at any time in your phone’s settings or when publishing or exporting.

We do not sell personal data or share it for advertising. These parties receive data to provide the service:

Contabo GmbH (Germany)

Hosts the servers for Captilo, captilo.app and real.gallery.

Google

Play Integrity device checks and Google Play billing.

Apple

App Attest device checks, for the iOS app.

Stripe

Payments for web and business customers.

APED (Greece)

eIDAS qualified timestamps. Receives hashes only.

Sectigo

Timestamps for the C2PA signature on C2PA exports. Receives hashes only.

Sonic blockchain network

Public ledger that stores proof hashes, event IDs and capture times.

Expo (650 Industries, Inc., USA)

Delivers app updates.

Our email provider

Delivers messages sent through the contact form.

Authorities and courts

Only where the law requires us to disclose data.

Our servers are in Germany. Google, Apple, Stripe and Expo may process data in the United States; where they do, transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. Blockchain data is replicated by network nodes around the world; it contains hashes, IDs and times, never photos.

Single-use capture codes

Minutes after they expire

Duplicate-submission checks (event ID only)

48 hours

Payment webhook events

7 days

Web server logs

14 days

Application logs (no IP addresses or pseudonymous IDs)

Overwritten as newer entries arrive

Hashes and pseudonymous ID of a proof being anchored

Until it is anchored or has failed, usually seconds

Event ID, anchoring result and timestamp of a proof

Kept, so the app can collect them

Credit account and plan

While you use Captilo; free accounts unused for 6 months are deleted automatically

Credit history

Kept anonymously, with no link to you

Subscription records

Link to you removed about a day after the subscription ends

Device registration

While you use Captilo; deleted on request

Payment records

Kept by Google Play and Stripe as long as tax and accounting law requires

Pages published with Publish Online

Until you take them down; then only the Proof ID and the date, unless the page was reported

Photos hosted on real.gallery with Content Credentials

Until you delete them; then only the export ID and date of deletion, unless the photo was reported

Team data (mostly encrypted)

Until the team is deleted, plus 30 days; a member’s public key and key access until they leave

Proof requests (the Proof ID printed on the photo, its status and the date — nothing about who asked)

Public while open: 30 days from the last ask, 90 days at most, deleted a month after it expires; an answered request a month after the answer

Contact-form emails

As long as needed to handle your enquiry and any business relationship that follows

Blockchain records and timestamp tokens

Permanently

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time. The app’s backup export gives you your photos and proof records directly.

To exercise a right, email contact@captilo.app. Because the app has no accounts with names or email addresses, we will ask for something that lets us find your records, such as the Google Play order ID of a current plan or your real.gallery username, and confirm that the request is yours.

Some data cannot be erased: blockchain records and timestamp tokens are permanent by design, and we must keep payment records for as long as the law requires. Fraud screening and the capture grade are automated, but they make no decisions with legal effects about you; they label a proof for whoever reviews it.

You can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the data protection authority where you live or work.

Camera

Required to take photos. Photos stay on your phone.

Biometrics

Required to open the camera. Biometric data never leaves your phone.

Location

Optional, and it strengthens a proof. Without it, proofs have no location and a lower capture grade.

Internet

Required to anchor proofs and time-stamp them.

Storage

Used to save backups and certificates where you choose.

Captilo is not directed at children under 13, or the higher minimum age that applies in your country. We do not knowingly process children’s data. If you believe a child has used Captilo, contact us and we will delete what we hold.

Connections to our servers use TLS 1.3. Every proof is signed on the phone, and signing keys are kept in the phone’s secure storage. We protect our servers with access controls and keep the data we hold to a minimum. No system is perfectly secure, and we cannot guarantee that data will never be exposed.

We do not sell personal information or share it for cross-context behavioral advertising. California residents can ask which categories and specific pieces of personal information we hold, where they come from, why we use them and who receives them, by emailing us.

When we change this policy, we update the date at the top of this page. For material changes, we also tell you in the app before they take effect.

By using the Captilo app or captilo.app you agree to these terms. If you use Captilo for an organization, you confirm that you may accept them on its behalf. If you do not agree, do not use Captilo.

Captilo creates cryptographic proofs of photos taken in the app, anchors them on a public blockchain, obtains qualified timestamps, and lets anyone verify them. Features may change, and the service may occasionally be unavailable.

Creating a proof or a C2PA export uses one credit; publishing a page and PDF certificates are free. Each plan includes a monthly credit allowance. Paid plans bought in the app are billed by Google Play, which handles renewal, cancellation and refunds under its own terms; you can cancel at any time in Google Play. Business plans may be invoiced through Stripe.

Your 12-word recovery phrase is the only way to restore your signing key on a new phone. We never have it and cannot recover it for you. Keep it private: anyone who has it can create proofs in your name.

• Do not use Captilo to create false, misleading or fraudulent evidence, including by photographing screens, prints or staged scenes and presenting them as genuine.
• Do not try to circumvent, disable or interfere with Captilo’s security features, signatures or fraud checks.
• Do not use Captilo for any unlawful purpose, or to infringe anyone’s privacy or rights.
• Do not reverse engineer, decompile or disassemble the app, except where the law expressly allows it.
• Keep your device secure and up to date. You are responsible for activity on your device and in the app.
• Back up your own data. Photos and records on your phone are lost if the phone or the app is lost and you have no backup.

You keep all rights in your photos. When you publish a photo or host a C2PA export, you allow us to host, display and distribute it on real.gallery until you delete it. The blockchain registration of its proof, made when the photo was taken, is permanent. Publish only what you have the right to publish. We never delete your published photos ourselves, except where we must remove illegal content after it has been reported to us.

Verification confirms that a file’s hashes match a record anchored on the blockchain, and that the record carried by a certificate has not changed since it was signed. The eIDAS timestamp and the blockchain anchor independently fix when the proof was created.

A Captilo proof does not, on its own, establish:

• who pressed the shutter: authentication is device-level and does not identify a person;
• that the scene in front of the camera was not staged;
• that the location and device details reported by the phone were accurate, only that they have not changed since they were signed;
• that fraud screening caught every manipulated or AI-generated image. A screen-photo warning is a prompt for human review, not a verdict, and the absence of a warning is not proof of authenticity.

A Captilo record can support a chain-of-custody argument (see how it works), but it is not complete chain-of-custody documentation and is not a substitute for legal authentication, expert testimony, forensic examination, court-ordered verification or legal advice. We make no representation that a record will be accepted as evidence in any court, arbitration, insurance claim or other proceeding.

Verification depends on third parties: the Sonic network and its public endpoints, the qualified timestamp service (whose responses are occasionally delayed), and correct submission by Captilo. You are responsible for interpreting results, for complying with the laws that apply to your use, and for consulting qualified professionals where needed.

Captilo is provided “as is” and “as available”, without warranties of any kind, express or implied, including fitness for a particular purpose, accuracy of verification results, and uninterrupted availability. Nothing in these terms limits rights you have as a consumer that cannot be limited by law.

To the extent permitted by law, Validag Solutions Ltd, its directors, employees, partners and suppliers are not liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, data or goodwill, including damages from: loss of data on your device; a record not being accepted as evidence; errors or gaps in fraud screening; blockchain, timestamp or network unavailability; or device failures.

To the extent permitted by law, our total liability is limited to the greater of the amount you paid us in the twelve months before the claim and one hundred US dollars (USD 100).

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, for intent or gross negligence, or any other liability that cannot be limited by law.

If you use Captilo for business purposes, you agree, to the extent permitted by law, to indemnify Validag Solutions Ltd against claims, damages and reasonable costs arising from your misuse of Captilo or your breach of these terms.

We are not liable for failures or delays caused by events beyond our reasonable control, including natural disasters, war, government action, power or internet outages, blockchain network failures, cyberattacks and failures of third-party providers.

Before starting formal proceedings, please contact us at contact@captilo.app and give us thirty days to resolve the dispute informally.

These terms are governed by the laws of the Republic of Cyprus, and the courts of Cyprus have jurisdiction. If you are a consumer in the EU, you can also bring proceedings in the courts of your country of residence, and you keep the protection of its mandatory consumer laws. Where the law allows, claims may be brought only individually, not as part of a class or representative action.

If any provision is found invalid, the rest remains in force. These terms, together with Part A, are the entire agreement between you and us about Captilo. Not enforcing a term is not a waiver of it. We may update these terms; we will update the date at the top of this page and tell you in the app before material changes take effect.

Questions about this page or your data: contact@captilo.app