Privacy

Last updated: 20 September 2026 · Operator: Agile Playground LLC, a Delaware (USA) limited liability company · Contact: hello@icalledit.io

What we store, what becomes public, who processes it, and what can and cannot be deleted. This page describes what the software actually does.

What we store

• Account: your email address, a hash of your password (never the password itself), your name if you give one, whether your email is verified, your credit balance, and a Stripe customer ID if you have paid.
• Registrations: the title and description you type, the asset type and certificate style you choose, and — only if you switch those fields on — your full name, date of birth, organisation and custom fields. If you enter an ID or passport number, it is hashed in your browser and we receive and store only that hash, never the number. We store the complete hashed record ("payload"), its SHA-256 hash, the Bitcoin transaction ID and block data, and any project or follow-up links.
• Files: in the Protect flow, an attached file is hashed in your browser and is not uploaded. We receive its SHA-256 hash, file name, size and type. In the Dedicate (gift) flow, the file you attach is uploaded so that it can be included in the email to the recipient; it is processed in memory for that purpose and is not saved in our database.
• Witnesses and dedications: email addresses of witnesses are used to send them a copy of the certificate. For dedications we store the recipient's name, email address and your message.
• Audit log: access to registration content (for example certificate generation or a visit to a verification page) is logged with time, purpose and IP address.
• Chat assistant: conversations with the on-site assistant are stored so we can improve answers. Do not paste confidential ideas into the chat.
• PDF certificates are generated on demand and are not stored.

What is public and permanent

• On Bitcoin: the SHA-256 hash, inside an OP_RETURN output of a transaction sent from our wallet. It is public, permanent and cannot be deleted or changed by anyone. The hash cannot be turned back into your content. Your title, description, name and email are never written to Bitcoin.
• On IPFS: for each registration a small JSON record containing the certificate ID, the title, the hash, the time and the platform name is pinned to the public IPFS network through Pinata. IPFS content is publicly retrievable by anyone who has its content identifier, and copies may persist on other nodes after we unpin it. The description and your personal details are not included. Choose a title that you are comfortable making public.
• On the verification page (/verify/<certificate-id>): the hash, the Bitcoin transaction, its status and dates. Your title and name are shown there only if you opt in with the "Show title and name on the public verify page" switch in your dashboard. Your email address is never shown.

Who processes data for us

• Railway — application hosting.
• Supabase — managed PostgreSQL database.
• Stripe — payments. Card details go to Stripe directly; we never see them.
• Resend — transactional email (verification codes, certificates, witness and gift emails).
• Pinata — IPFS pinning of the small public record described above.
• Anthropic — the language model behind the chat assistant receives the chat messages you type.
• mempool.space API — used to broadcast transactions to the Bitcoin network and read their status. It receives the transaction (which contains only the hash), not your content.
• Ahrefs Web Analytics — cookieless page-view statistics. Google Fonts serves the typeface.

We do not sell personal data and we do not run advertising trackers.

Deletion and your rights

Write to hello@icalledit.io from your account email to request access to, correction of, or deletion of your data. We can delete your account and the registration records held in our database, and unpin the IPFS records. We cannot delete or alter anything on the Bitcoin blockchain, and we cannot guarantee that a record once published on IPFS has disappeared from every node. Because the on-chain data is only a hash, it does not reveal anything about you once our database records are gone. Payment records may be kept where the law requires it. After deletion we can no longer re-issue your certificate, so download your PDF and proof.json first.

Security

Passwords are stored only as hashes, connections use HTTPS, and access to registration content is logged. No system is perfectly secure; if you would rather not share sensitive text with us at all, hash your file locally and register only a neutral title plus the file hash.

Changes

If what the software does changes, this page changes with it. The date at the top shows the latest version.