Privacy Policy

Last updated: September 24, 2026

Draft for legal review. PureProof is in development. Before publication as a final policy, the operator must confirm its legal identity and contact details, hosting and service providers, applicable jurisdictions, lawful bases, retention periods, and any international data transfers. This draft is not legal advice.

1. Who is responsible

The operator of PureProof is responsible for personal information described in this policy. Its full legal name, address, privacy contact, and any applicable data-protection representative must be added here before the Service launches. The operator's role may differ for a future transaction depending on who determines why and how information is processed.

2. The website today

This is a static informational website. It does not currently provide account registration, identity checks, document upload, biometric enrollment, or business registration. The website source does not include an analytics or advertising integration. The hosting provider may process technical request data, such as IP address, time of request, browser or device information, and security logs, to deliver and protect the Site. The operator must confirm what its hosting provider actually records, for how long, and where that information is stored.

Please do not send identity documents, face images, biometric information, passwords, or other sensitive personal information through this Site.

3. Data minimization and zero-knowledge proofs

Some planned PureProof flows use zero-knowledge proofs. In simple terms, a proof can allow a verifier to confirm a statement such as "the user is over 21" without revealing or requiring the verifier to receive the underlying birthdate. PureProof's intended design is to disclose only the credential claim or result needed for the selected transaction.

A zero-knowledge proof does not mean that no information is ever processed. The application, issuer, verifier, hosting provider, and other participants may handle the minimum account, credential, security, and technical information needed for their roles. The actual flow, attributes, retention, and providers must be confirmed in the just-in-time notice before launch.

4. Information a future verification service may process

If the Service launches, and only as described in its just-in-time notices, it may process categories such as:

• Account and contact details, such as an email address and account security information.
• Identity-document images and information read from them, such as name, date of birth, document type, expiry date, or issuing authority.
• Face images, face-matching measurements, or other biometric information if a specific verification flow uses them.
• Verification outcomes or digital claims, such as whether an age threshold was met, and security events related to issuing or presenting a proof or QR code.
• Technical metadata needed to operate, secure, and troubleshoot the Service, such as IP address, device type, operating-system version, application version, timestamps, network information, and basic crash or diagnostic logs.

The actual data collected, whether a biometric template is created, whether source documents are retained or deleted, and whether information is processed on-device or by a provider have not been established by this website. These details must be made accurate before enrollment begins. Do not treat planned product features as current data-handling commitments.

5. Biometric and device security

Supported mobile flows may use Face ID, Touch ID, Android biometrics, Secure Enclave, Android Keystore, or comparable operating-system security features to unlock a device-held wallet or credential. The biometric comparison is intended to occur locally within the operating system or hardware security boundary. PureProof does not receive or store the biometric template used by the operating-system prompt.

Where a flow captures or processes face geometry, fingerprints, or other biometric information beyond an operating-system unlock prompt, the operator must provide a separate, conspicuous notice and obtain any consent required by applicable law, including applicable biometric privacy laws. That notice must state the purpose, method, retention period, deletion process, and withdrawal process before collection.

6. Purposes and legal grounds

A future Service may use information to verify age or identity, create or present a digital proof, secure accounts, prevent fraud, provide support, maintain the Service, and meet legal obligations. Depending on the jurisdiction and activity, the operator must identify and document an applicable legal ground, such as providing a requested service, legitimate interests, legal obligations, or consent. Where consent is required for biometric or other sensitive information, the relevant flow must request valid, informed consent before processing and explain how to withdraw it.

7. When information may be shared

The current Site has no registration or verification flow. If the Service launches, information may be shared only as described in its final notice, including with carefully selected hosting, identity-check, biometric-matching, security, and support providers acting under appropriate terms; with a business receiving a verification result when you choose to present it; or with authorities and other parties when legally required or necessary to protect rights and safety. The operator must identify relevant provider categories, roles, locations, and safeguards before launch. We do not describe or promise a particular sharing arrangement until it has been confirmed.

8. Analytics and service providers

The current website source contains no analytics or advertising integration. Before any performance, crash, or usage analytics tool is enabled, the operator must identify it here and in the relevant notice, describe its purpose and retention, and configure it so that personally identifiable information, identity attributes, private keys, seed phrases, and cryptographic secrets are not shared with analytics providers.

Hosting, identity, security, crash-reporting, storage, and other providers may process information under appropriate terms for the purposes described in the final policy. Provider roles, locations, safeguards, and international transfer mechanisms must be confirmed before launch.

9. Retention and security

Personal information should be retained only for a defined, disclosed purpose and period, then deleted or de-identified when no longer needed, subject to legal requirements. Specific retention periods for hosting logs, account records, source documents, biometric data, and verification proofs must be determined and published before the Service collects them. The operator should apply appropriate administrative, technical, and organizational security measures; no online service can promise absolute security.

10. International processing

The operator must confirm where the Site and any future Service providers process or store information. If information is transferred across borders, the final policy must describe applicable transfer safeguards and any rights available under the relevant laws.

11. Your privacy rights

Depending on where you live and the circumstances, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, withdraw consent, or complain to a privacy regulator. These rights are subject to legal conditions and exceptions. Once operator contact details are published, you may use them to submit a request; identity checks may be needed to protect your information. The operator must add any jurisdiction-specific rights and response process before launch.

12. Children and age checks

The planned product concerns age and identity verification and may be intended for people seeking to prove they meet a particular age threshold. It is not currently available through this Site. Before launch, the operator must set an age policy for users, address information about minors in the relevant markets, and explain how age checks operate. Do not submit a child's information to this Site.

13. Cookies and similar technologies

The website source currently contains no analytics or advertising scripts and does not set application cookies. Hosting, security, or delivery infrastructure may use strictly necessary technologies or server logs; the operator must verify its deployment configuration and disclose any additional cookies or similar technologies, including consent choices where required, before enabling them.

14. Identity participants, changes, and contact

Depending on the flow, an issuer may provide a credential, you may hold and present it, and a relying party may request or receive a verification result. Each participant is responsible for its own processing and legal obligations. PureProof does not control how an issuer obtained source information or how a relying party uses a result after disclosure. The final policy and product notices must identify these roles and boundaries for each launch market.

We will update this policy when the Site's practices change or before a future Service begins processing personal information. The updated policy will show its effective date and any notice or consent required by law. The operator's full legal name and a working privacy contact address must be added here before the Service launches.