1. Who we are
This policy is provided by Projectteamforyou (CEO Yusang Lee) ("we", "us"). You can reach us at [email protected].
2. Scope
This policy covers the website at proofledge.com and the ProofLedge desktop application ("the app").
3. The app processes your files locally
ProofLedge is local-first. Evidence files, hashes, metadata, case data, notes, reports and audit logs are processed and stored on your own device. We do not receive them, and the app does not require an account.
Core features work without an internet connection, and the app sends no telemetry. The app connects to the internet only (a) when you click “Check for updates” in Settings — it then sends your app version, operating system and architecture to our update server on Cloudflare and, if a newer version exists, downloads a signature-verified installer — and (b) for the optional AI-assisted explanation described in section 4. If a future feature needs a network connection, it will be clearly labeled and described in this policy before it is released.
4. Optional AI-assisted explanations (OpenAI)
The app can optionally ask the OpenAI API to explain automated findings in plain language. This feature is off by default. It works only after you turn it on in Settings and enter your own OpenAI API key, which is stored in the Windows Credential Manager on your device and is never sent to us.
A request is made only when you click "Explain findings". The app first shows you the exact data that would be sent, and nothing is sent until you confirm. That data contains only:
- the detected file type and file size
- the automated findings (codes, severity, wording and limitations)
- the number of metadata fields and the kinds of timestamp sources
It never contains file contents, file names, paths, metadata values (such as EXIF, GPS or author), hashes or examiner notes.
The request goes directly from your device to OpenAI; we do not receive it. OpenAI processes it under its own terms and privacy policy, and API usage may be charged to your OpenAI account.
The audit log records only the model, the prompt version and hashes of the request and the response, not their text. Responses are labeled AI-assisted and are never stored as evidence. You can turn the feature off or delete the key in Settings at any time.
5. ORIGMA reports
Importing an ORIGMA report reads a file you exported yourself. ProofLedge does not upload files to ORIGMA or to us.
6. Website analytics (cookieless)
To understand how the website is used, we record anonymous page views. For each page view we store:
- the page path (without query string)
- the referring website's host name, if any
- the site language
- your country, derived from a Cloudflare request header
- a coarse device class (desktop, mobile, tablet or other)
We do not store IP addresses, full user-agent strings or cookies, and we do not build profiles or fingerprints. To count unique visitors per day, we compute a truncated SHA-256 hash of a random daily salt combined with the IP address and user agent. Only the truncated hash is stored. The salt is rotated daily and deleted after two days, so hashes cannot be recomputed or linked across days.
Clicks on the download button are recorded in the same anonymous way. If your browser sends a Do Not Track or Global Privacy Control signal, no analytics are recorded. Analytics events are kept for up to 400 days.
Installer downloads started by the app's update check are counted the same way.
The footer shows the total number of visits (counted once per visitor per day) and how many visitors are online now. While a page is open and visible, your browser sends a heartbeat about once a minute; we keep only the same daily hash and the time of the last heartbeat, and delete it after 10 minutes. The heartbeat is not sent when Do Not Track or Global Privacy Control is on.
7. Hosting and service providers
The website runs on Cloudflare Pages, and analytics are stored in Cloudflare D1. Cloudflare processes technical request data, including IP addresses, to deliver and protect the website, under its own privacy policy. A download link may point to a third-party host such as GitHub Releases, whose policies then apply. Installers are served from Cloudflare R2.
8. Storage in your browser
The website sets no cookies. It stores your theme and language preferences in your browser's local storage and uses a service worker cache so pages can work offline. You can clear both at any time in your browser settings.
9. Legal bases and your rights
Where data protection laws such as the GDPR or Korea's Personal Information Protection Act apply, we process anonymous analytics based on our legitimate interest in operating and improving the website, and optional app features based on your explicit request.
Because we do not store identifiers, we usually cannot link analytics records to you. You may still contact us to ask about access, correction, deletion or objection, and you may lodge a complaint with your local data protection authority.
10. Children
The website and app are intended for professional and adult users and are not directed at children.
11. Security and international processing
Connections use HTTPS, and administrative statistics require a secret access token. Cloudflare operates a global network, so request data may be processed outside your country.
12. Changes to this policy
We may update this policy. The effective date below will change, and material changes will be highlighted on this page.
13. Contact
Questions about privacy: [email protected].