Privacy Policy

1. General Information & Data Controller

This Privacy Policy informs you about the nature, scope, and purpose of personal data processing when using the VerifyShot Chrome Extension, our Authenticity Verifier tool, and our website (https://verifyshot.fibo-exe.workers.dev/).

Data Controller pursuant to Art. 4 No. 7 GDPR (DSGVO):
Fabian Weißpflog
Dr.-Neideck-Str. 2
09212 Limbach-Oberfrohna
Germany
Email: fibo.exe+verifyshot@gmail.com
For detailed legal representative information, please consult our Legal Notice (Impressum).

2. Local Processing of Screenshots (Zero-Knowledge Architecture)

When you take a full-page or visible web capture using VerifyShot:

• No Image Uploads: Captured tab tiles are rendered and stitched using standard HTML5 Canvas APIs strictly within local browser RAM.
• No Remote File Storage: Neither full screenshots, cropped portions, nor underlying HTML DOM trees are ever sent to our servers.
• Local Exports: When choosing PNG, JPG, or PDF downloads, file generation and download triggering occur completely on your device.

3. Cryptographic Verification & Public Registry

If you choose to authenticate a capture, VerifyShot registers cryptographic metadata in our database (hosted via Supabase):

• SHA-256 Checksum: A one-way mathematical hash (64 hex characters) computed from the binary image file. This hash cannot be reverse-engineered to reconstruct the original image.
• Audit Metadata: NTP synchronized timestamp (UTC), capture URL, viewport dimensions, and an anonymous Audit ID.
• Public Verification: The hash registry is accessible so that anyone holding your exported file can verify that its SHA-256 checksum matches the record registered at capture time.

Legal Basis: Art. 6(1)(b) GDPR (performance of contractual utility requested by the user) and Art. 6(1)(f) GDPR (legitimate interest in providing cryptographic integrity verification).

4. User Accounts & Authentication

If you register for an account (e.g., Early-Adopter Beta):

• Data Collected: Email address and encrypted password hash.
• Service Provider: Authentication and user profile management are processed via Supabase Inc. (infrastructure hosted in compliant EU/AWS data centers).
• Purpose: Managing your early-adopter tier, quota allocations, and session state.

5. NTP Time Synchronization & Network Calls

To establish tamper-evident time metadata, the extension queries atomic Network Time Protocol (NTP) servers and trusted time APIs (such as timeapi.io). Only standard IP network packets required to complete the HTTP/HTTPS request are transmitted. No browser history or browsing activities are tracked.

6. Hosting & Cloudflare Edge

Our website and static assets are delivered via Cloudflare edge infrastructure. When accessing our web pages, technical server log data (such as anonymized IP address, user-agent, request timestamp) may be temporarily processed to protect against DDoS attacks and ensure server stability (Art. 6(1)(f) GDPR).

7. Chrome Web Store Policy Compliance

VerifyShot complies strictly with the Google Chrome Web Store Developer Program Policies, including the Single Purpose and Minimal Data Collection requirements. Permissions requested by the extension (activeTab, scripting, storage) are utilized exclusively to capture the requested screenshot and store your local settings.

8. Your Rights Under GDPR (Betroffenenrechte)

Pursuant to the European General Data Protection Regulation (GDPR), you possess the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): Inquire about personal data stored about you.
• Right to Rectification (Art. 16 GDPR): Correct inaccurate data.
• Right to Erasure (Art. 17 GDPR): Request deletion of your account and registered email.
• Right to Restriction of Processing (Art. 18 GDPR).
• Right to Data Portability (Art. 20 GDPR).
• Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests.

To exercise any of these rights, please contact us at fibo.exe+verifyshot@gmail.com.