This policy is brief because our knowledge is.

Effective September 2, 2026 · Version 1.0.

What we hold. Your name and email address. The result of identity assurance — not the documents used to verify you. Payment and subscription records from our payment processor — not your card number. Your entries as ciphertext we cannot read. File fingerprints, timestamps, ledger records, and the limited technical records necessary to operate and secure your account and the service. That is what Double Turnstile is designed to know.

What we cannot see. We cannot read your entries or see the files you fingerprint. Your entries are encrypted on your device with keys we do not possess. Your files never leave your device. Their fingerprints are not copies of the files and do not contain their contents.

Who processes what. Our identity provider processes the information required to verify your identity. Our payment processor processes your payment information. Independent timestamp authorities process the information necessary to timestamp your attestations. Our infrastructure providers process or store only what is necessary to provide their part of the service. None receives the keys required to decrypt your entries from us.

What we never do. We do not sell your information. We do not use your entries or files for advertising, profiling, or training models. We disclose information only as necessary to operate and secure the service, at your direction, or when legally required.

No tracking. We use no third-party advertising trackers, analytics scripts, or tracking pixels. Cookies and local storage are limited to what is necessary to operate and secure the service. We measure our own advertising with first-party counts, not third-party tracking.

Retention. Your ledger is intended to persist while you maintain it. If you close your account, you may export your ledger and request deletion of the ciphertext and personal information we are not required to retain. A trial that does not become a subscription is different: its ledger is deleted, as the Terms describe. Independently anchored fingerprints and timestamps may not be capable of withdrawal. They contain neither your entries nor your files.

Legal process. We comply with valid legal process. We can produce only what we possess: encrypted ciphertext and associated records such as fingerprints, timestamps, account information, and service metadata. We do not possess the keys required to decrypt your entries.

Changes. We may revise this policy with notice. Any material expansion of the information we collect, use, or retain will be disclosed before it takes effect. Double Turnstile will not acquire the keys required to decrypt entries created under this privacy model.