Privacy & Transparency
Last updated: February 2026
Apertrue proves photos are authentic without compromising your privacy. Our architecture is designed so that we cannot access your content — not “choose not to”, but technically cannot.
This page explains exactly what we store, what we never store, and how your data flows through the system. No legal jargon, just facts.
What we never store
Client-side encryption
Before your photo leaves your browser, it is encrypted with a unique AES-256-GCM key generated locally. The key is stored in your browser's IndexedDB and never sent to our servers.
The server stores only encrypted ciphertext. Without your browser's key, the data is meaningless — even to us. If you clear your browser data, the key is gone and the ciphertext becomes permanently unreadable.
Encryption flow
What we store server-side
Our server stores the minimum required to operate the platform. All data is hosted in UK data centres.
Account data
Username, display name, email (optional), passkey credential ID. Password is stored as a bcrypt hash if set.
Encrypted media files
AES-256-GCM ciphertext stored on Cloudflare R2 (EU jurisdiction). We cannot decrypt these — only your browser can.
Perceptual hashes (PDQ)
A 256-bit perceptual hash of your image, computed client-side before encryption. Used to check against known illegal content databases (content policy). Cannot be reversed to reconstruct the image.
Zero-knowledge proofs
Cryptographic proofs that your photo came from a trusted camera or AI tool. These prove authenticity without revealing any details about your device, location, or identity.
Disclosed metadata (your choice)
Before uploading, you choose what metadata to share: location precision (hidden / continent / country / city), time precision (hidden / month / date / full), and device information. Only your chosen disclosure level is stored.
Verification status
Whether the image is verified as camera-captured, AI-generated, or unverified. The camera make/model is stored only if you chose to disclose it.
On-chain data (Aztec)
Verified proofs are anchored on the Aztec blockchain — a privacy-first encrypted execution layer. On-chain data is immutable and cannot be deleted.
Here is exactly what goes on-chain:
No user IDs, no image content, no metadata, no wallet addresses appear on-chain. Each upload batch gets a unique diversified address — there is no way to link batches to each other or to a user.
What stays in your browser
Critical secrets live only in your browser's IndexedDB, protected by your device's passkey (biometric or PIN). These are never sent to our servers.
Encryption keys
AES-256-GCM keys for each upload session
Wallet private key
Aztec account key derived from your passkey
Passkey credential
WebAuthn credential bound to your device
Decrypted gallery
Your photos, decrypted locally for viewing
Clearing your browser data deletes these keys. If you haven't backed up your wallet, your encrypted media becomes permanently inaccessible. Use the wallet backup feature in Settings to protect against this.
Your rights
Under UK GDPR and the Data Protection Act 2018, you have the right to:
- Access — request a copy of all data we hold about you
- Rectification — correct inaccurate personal data
- Erasure — delete your account and all associated data. Media files, proofs, hashes, and metadata are permanently removed. On-chain commitments are immutable but contain no personal data or content.
- Portability — export your data in a machine-readable format
- Object — object to processing of your data
You can delete individual media items or your entire account from Settings. Deletion removes all server-side data including CDN files, database records, proofs, and hashes.
Data location
Apertrue is a UK company. All user data is stored in UK data centres:
- Database — UK-region PostgreSQL
- Media storage — Cloudflare R2 (EU jurisdiction)
- Blockchain — Aztec network (decentralised)
We do not transfer personal data outside the UK unless required by law enforcement under a valid legal process.
Deletion & erasure
When you delete media or your account:
- Encrypted file removed from CDN storage
- Thumbnails deleted
- Database records removed (proofs, hashes, metadata)
- Verification index entries cleared
- Nullifiers retained (prevents replay, unlinkable to you)
On-chain commitments cannot be removed (blockchain is immutable), but they contain only cryptographic hashes — no content, no user identity, no metadata. Without the corresponding off-chain data, on-chain commitments are meaningless.