Witness privacy policy

Effective 11 October 2026.

Witness proves that the video on a live call comes from a specific enrolled camera belonging to a passport-verified person. Most of what makes that work never leaves your machine. This page says what does, who else touches it, and for how long we keep it.

Who we are

The short version

• Your camera's fingerprint, the frames of your calls, your passport and the face comparison all stay on your own devices. What reaches us is proof, plus a small sealed picture of your face for the person you are calling, which we cannot open.
• We hold your email address, the public half of your passkeys, a pseudonymous identifier derived from your passport, the name your passport states, and the labels your devices give themselves.
• Call records are sealed on disk. Their keys are destroyed after the retention period below, so old server backups cannot open them. Receipts already saved by a viewer or filed for a workspace remain readable.
• We do not sell data, run advertising or profile anyone. There are no analytics scripts on any page.
• You can export everything and delete your account from the account page, without asking us.

What stays on your device

• Your camera's sensor fingerprint is stored on your Mac and never transmitted. At enrolment your Mac sends us a cancellable template made from it, which we use once to check the enrolment and do not keep. The registry we run holds a cryptographic commitment to it, a Poseidon2 hash, which reveals nothing about the fingerprint.
• Every frame of your calls. Frames are checked on your machine, inside the camera extension. No video or frames are sent to us. The one image that leaves your Mac is the small picture of your face described under Calls below, and it leaves sealed under a key we never hold.
• Your face. If you turn on the passport-photo comparison, it runs on your Mac, between your passport photo and your camera. Your phone sends the photo to your Mac sealed, through our service, which cannot open it; the photo and the measurements then stay on your Mac.
• Your work sign-in. To prove a work address, the Mac app signs you in with Google and turns the signed token into a proof on your machine. The token, and the address inside it, never reach us. We receive the domain after the @ and the proof.

What we hold, and why

Account

Your email address, the public half of each passkey and when it was registered, and, if you sign in with Google or Apple, the identifier that company gives us for you. If you sign in with Apple and choose Hide My Email, the address we hold is the one Apple gives us, which forwards our mail to you. No passwords exist. Sign-in tokens are stored only as digests we cannot reverse, and they expire after 30 days.

Identity

A passport-derived pseudonymous identifier (a nullifier), your name as your passport states it, and commitments to your enrolled devices with the labels they give themselves ("Alex's MacBook Pro"). The name is the point of the product: it is what a call's viewers see verified, and you choose on each call whether to show it. We do not receive a readable copy of your passport document or chip photo. During first enrolment, our verifier briefly receives your name and document number from the proof, uses the number to calculate a digest, then discards the number. We retain the digest, identifier and disclosed name, not the raw document number, date of birth or machine-readable zone.

When your phone presents a passport proof to set up your identity, to move it to a new phone or to recover it, we keep a one-way fingerprint of the proof, the time the proof says it was made, a one-way fingerprint of the key of the device that signed the request or that the request named, and whether the request went through. We keep these for about half an hour: until 30 minutes after the proof's own time, and then they are removed from the live service within about a minute. They are there so that a proof already presented cannot be used again by anyone else. A fingerprint cannot be turned back into the proof or the key. Earlier copies in backups follow the backup schedule below.

Each time your phone reads your passport, it also compares your face with the photo in the chip and asks you to turn your head, so that a photograph of you cannot be used instead. This is biometric data, so your phone asks for your explicit consent before it reads the passport. The comparison happens only on your phone, nothing from it is kept, and only the result reaches us.

Work address

If you prove a work address, we hold the domain of that address and a proof that a valid Google-signed token for an address at that domain existed when you proved it. Not the address, not the token. The domain is shown on a call only when you choose to show it.

The passport-photo comparison

This is optional, and it runs only with your explicit consent, which your phone asks for before it reads your passport for it. We rely on that consent for this processing (UK GDPR Articles 6(1)(a) and 9(2)(a)). It is for adults only: your passport proof must show that you are 18 or over. It is not offered to people who live in Illinois, Texas or Washington State, and your phone asks you to confirm that you do not. Saying no, or turning it off later, changes nothing else: your calls still show that your camera is the one you enrolled.

When it is on, the reference photo is read from your passport's chip by your phone and sent to your Mac sealed to your Mac's key. It passes through our server as ciphertext we cannot open. Your Mac can collect it for up to 24 hours. We remove it from the live service when your Mac collects it or you turn the check off; if it remains uncollected, our service clock removes it shortly after that 24-hour period. Older copies in server backups expire under the backup schedule described below. On the service we hold a digest of the document number, the outcome of the check as a short status, and one key on your identity. Your phone makes that key from a summary of your passport photo and a random secret that stays on your phone and your Macs, so we cannot turn it back into a face or test a face against it. Your passport proof includes it, so your Mac can check it is comparing with your passport and not another photo. It stays the same from call to call until you scan your passport again. The comparison and the photo stay on your Mac.

Organisations

If you create or join one: its name, your membership and role, invitations (the invited address and status; invitation tokens are stored as digests and expire after seven days), API key labels and digests, the seat count, and the organisation's billing status and trial dates.

An organisation is our customer, and where this deployment keeps its customer records in HubSpot we copy a little there so we can look after it. The copy holds the organisation's name, its plan, how many members it has and our identifier for it, and the email address of each of its administrators. Nothing else about an administrator's account goes. Nothing at all goes about members who are not administrators, about people an organisation asks to verify, or about an account with no organisation. While the service is running it compares the copy with its own records about every ten minutes. When you delete your account or stop being an administrator, your record there is permanently deleted at the next comparison, which HubSpot says can take it up to 30 days to purge from its own systems. A comparison that cannot finish, because our service or HubSpot is unavailable, is tried again until it does. A comparison that would remove more than ten records, and more than half of all the records we keep there, removes none until we have checked that our own records are right. When an organisation goes, or has no administrator left, its record is removed, and HubSpot keeps a removed company in its recycling bin for up to 90 days.

Covered verification

If a workspace covers your verified calls within one of its processes, the invitation says so before you accept. While coverage is active we file the receipt of each verified call you make in that process, together with the workspace's name and the process, for the workspace to read and download. The workspace sees those receipts and nothing else about your account. Your calls carry a line naming the workspace while coverage is active. Either side can end it at any time. We remove the workspace's copies of receipts from the live service after 90 days, counted from the earliest of the covered period's end, the process's scheduled end, your withdrawal, or the workspace ending the process early. The cleanup runs about every ten minutes while the service is running. Earlier copies in backups follow the backup schedule below; copies downloaded by others remain with them.

If a workspace asks you to take part by email before you have an account, we keep your address only while that invitation can still be used: it is deleted once you claim it or it expires.

Billing

Payments are handled by Stripe. We store your Stripe customer and subscription identifiers, your plan, and any prepaid balance. Card details never reach us. Stripe is a separate controller for payment data.

Email

Verification and notification mail is sent through Postmark. Message content is limited to what the mail itself shows you. Once a day the service also emails us, through Postmark, a list of the accounts opened since the last list, with each address, when it signed up and how far its set-up has got. Deleting your account does not remove it from a list already sent. We delete each list from our mailbox within 30 days of receiving it.

Rooms

Rooms are off. Witness does not match meeting attendees or exchange picture keys between Macs through rooms.

Calls

You need an account to start a call; the service keeps no call without an account. When the last app using your camera lets go of it, Witness stops showing your picture and holds the call for ten minutes, then shows it as ended. Your next call has a new code. An overlapping handover between two apps is not a camera break. If the camera stays on, Witness also pauses to ask whether you are still on the same call, at least every hour.

A call's verification record contains checkpoints, proof receipts and any identity claims you chose to share, but no video or sensor fingerprint. Call records, their proof files and call-specific action rows are sealed at rest under a separate key for each call. The service holds that key in memory only; your Mac keeps its copy in its device-only keychain. The small readable envelope includes an expiry rounded up to the hour, not exact call times. After a restart the service needs the sender's Mac to unlock the record; until then the page shows a generic reconnecting status.

Records are normally available for 24 hours after the call ends so viewers can save receipts. The Mac destroys the key 24 hours after the latest of the recorded end, the ten-minute hold deadline, or eleven minutes after its last accepted post. The service's expiry is no later than that key deadline. Once both copies of the key are gone, sealed records in server backups are unreadable. This protects stored records, not against an operator of the live service, which reads them in memory. The promise does not hold against someone with both the sender's Mac and a backup of that Mac made while the key still existed.

Workspace receipt documents, members' last-call times and account-level action rows are organisation records and stay readable on disk and in backups. Workspace receipts follow their separate retention period above; ordinary action rows are kept for 24 hours, while an account's latest call revocation marker remains to prevent old backups restoring stopped calls. The service's automatic volume snapshots are kept for up to 30 days after they are taken. Deleting a live record does not erase an older snapshot. A viewer's browser keeps received receipts locally, including across reloads; a saved receipt remains until its holder deletes it. Witness cannot erase copies someone else saved.

The sealed picture

While a verified call runs, the camera extension cuts a small picture of your face, 128 pixels square, from the very frames it checked, a few times a second while a face is in frame. Each picture is encrypted on your Mac under a key derived from the call's code, which we never hold, and sent to us sealed. We keep the sealed pictures in memory only, never on disk, for the most recent stretch of the call (about ten minutes), and they are gone the moment the call ends or the service restarts. Only a person holding the call's code or link can open them, in their own browser; we cannot. Your Mac deletes each picture the moment it is sent and discards any older than ninety seconds. The pictures exist so the person you are calling can compare the face on their call with the face your camera actually produced.

The call code

The twelve-letter code you read out is minted on your Mac and never sent to us. We hold a one-way lookup derived from it, which finds the call when the other person types the code at our address, and nothing else: we cannot recover the code from it, and we cannot open a picture with it. The other person's browser derives the picture key from the code they typed, and the code never leaves their browser either.

Receipts you save

A saved call receipt is a file on your own device, or your counterparty's. We do not hold it and cannot delete it. It is yours, or theirs.

Transparency log

Enrolments, revocations and recoveries append entries to a public, append-only log, so changes to identities cannot happen silently. Entries are blinded: they contain no email, name or fingerprint. The log is permanent by design; see deletion below.

Calendar

The Witness app reads your calendar on your machine to know when meetings start. Event titles and attendees are processed locally and never reach us.

Your Mac's security check

On macOS 27 your Mac asks Apple to confirm that the Witness app is ours, unmodified, and running with the Mac's security settings on (App Attest). We keep what that needs for each of your Macs: the key Apple attested, its public half and counter, Apple's receipt, and which enrolment and calls it vouched for. If a Mac's key is replaced, for example after a restart, we note which key replaced which. We delete these with your account or when a device is retired, and keep only a one-way digest of each retired key, with no owner or date, so that a retired key cannot be used again.

Security and abuse

We hold the address your connection came from (for IPv6, only its first 48 bits) in memory only: for a few minutes to limit how fast requests can arrive, and while a call is live to notice many calls starting from one network. It is gone when the call ends or the service restarts. Actions our staff take on your account are written to a private log, kept for two years.

Why we are allowed to

• To give you the service you signed up for (UK GDPR Article 6(1)(b), contract): your account and sign-in, your passport identity and enrolled devices, calls, their pictures and receipts, and billing.
• With your explicit consent (Articles 6(1)(a) and 9(2)(a)): the face comparison your phone makes when it reads your passport, and the passport-photo comparison on calls if you turn it on.
• Our legitimate interests (Article 6(1)(f)) in keeping the service secure and honest: your Mac's security check, the addresses held during calls, the staff action log, and the public transparency log. In knowing which organisations are our customers and who administers them. And, where an organisation covers your calls, in filing those receipts for it, which the invitation tells you before you accept.
• The law (Article 6(1)(c)): the billing records we must keep for tax.

Who else touches it

Our servers run in London. A short list of other companies process data for us, each for one job: hosting, email, payments, and, on deployments that switch them on, error reporting and customer records. The list, with what each one receives and where it runs, is on the sub-processors page. Nobody outside that list receives anything, and we update it before adding a name, not after.

Where error reporting is switched on, a report carries the error and where in our own code it happened, the release, the browser or macOS version, and a request identifier that matches a line in our logs. It never carries your address, your IP address, anything about a call, any link or any frame; a report whose text mentions any of those is discarded rather than trimmed. Nothing is ever sent from the verification page.

Some of those companies process data outside the United Kingdom. Where they do, the transfer rests on the mechanism their own data processing terms state: the UK extension to the EU-US Data Privacy Framework, or the UK's international data transfer addendum to the standard contractual clauses.

What we do not do

We do not sell data, run advertising, build profiles, or move data beyond what is listed here. There are no analytics or tracking scripts on any Witness page. A counterparty checking your call gets a cryptographic answer and the sealed picture, not your identity document. We receive nothing from your meeting app: no meeting identifiers, no tokens from Zoom, Meet or Teams, nothing about who else is on the call.

How long we keep things

Your rights, and how to use them without asking

• See and export everything we hold about your account: the Export button on the account page produces a file.
• Delete your account from the account page. It needs your passkey, not just a signed-in session.
• Withdraw from the passport-photo comparison by turning it off in your Mac's Witness menu. That deletes the reference and the secret from your Mac and the key from your identity on our service; your phone deletes its copy of the secret the next time it connects. Your Mac keeps a note of the withdrawn key, which cannot be connected to your face without the deleted secret, so that it never takes that reference back.
• Ask us anything else, including correction, restriction or objection, at support@apertrue.photo. We answer within a month, as UK data protection law requires.
• Complain to the Information Commissioner's Office (ico.org.uk) if you think we have handled your data wrongly. We would rather hear it first, but that is your right either way.

Deletion, precisely

Deleting your account removes your email, passkeys, Google linkage, sessions and billing linkage at once. For each sign-in session that was still open, a scrambled fingerprint of its random sign-in token and the date the session would have expired are kept, without the account's identifier, for up to that date, which is at most 30 days, only so that your own devices can be told the account is gone and remove what they hold. They are then removed, and the removal is retried if a write fails. In any workspace, your membership and open participations end, and the workspace's records, including the billing and usage records we must keep, then refer to you only by a random stand-in that we cannot connect back to you. This normally happens at once; if it cannot, the service retries it automatically until it does. Receipts of your covered calls, which can show the name you chose to share, still leave on the 90-day schedule above. If you are the only admin of a workspace that still has other members or a paid plan, make someone else an admin first. If you stay the only admin, remove the other members and cancel any paid plan before deleting your account. It also erases your passport identity, unless another account of yours still uses it: your name as your passport states it, the document digest, your claims, your devices and their keys, the passport-photo comparison key and any photo in transit. Your devices are retired in the registry. What remains is a marker: the pseudonymous identifier and the organisation it was bound under, so the same passport cannot be used to make a second identity. It names nobody. To erase the identity while keeping an account, write to support@apertrue.photo. Entries already published to the transparency log are append-only and cannot be erased, but they are blinded and identify nobody; an erasable integrity log would protect nobody. An organisation you solely administer must first hand its admin role to someone else, or dissolve if you are its only member, which happens automatically. Your enrolment lives on your own Mac: uninstalling the app and the camera extension removes it.

Changes

This page is dated at the top. When it changes in a way that matters, we email account holders before the change takes effect. The page is kept in the same repository as the code, so a change to what the service holds and a change to this page happen together.