1. Who we are
This policy is provided by PROOFDESK team (projectteamforyou) ("we", "us"). You can reach us at projectteamforyou@gmail.com.
2. Scope
This policy covers the website at proofdesk-8ql.pages.dev and the PROOFDESK desktop application ("the app").
3. The app processes your files locally
PROOFDESK is local-first. Evidence files, hashes, metadata, case data, notes, reports and audit logs are processed and stored on your own device. We do not receive them, and the app does not require an account.
Core features work without an internet connection. If a future feature needs a network connection, it will be clearly labeled and described in this policy before it is released.
4. Optional OpenAI features
Some optional features can generate explanations using the OpenAI API. They run only when you explicitly start them in the app. Before anything is sent, the app shows you the data that would be transmitted.
By default only a structured, non-sensitive summary is sent, not your original files. These requests go from your device to OpenAI using an API key you configure; we do not receive the content. OpenAI processes it under its own terms and privacy policy. AI-generated text is labeled as such and is never stored as evidence.
5. ORIGMA reports
Importing an ORIGMA report reads a file you exported yourself. PROOFDESK does not upload files to ORIGMA or to us.
6. Website analytics (cookieless)
To understand how the website is used, we record anonymous page views. For each page view we store:
- the page path (without query string)
- the referring website's host name, if any
- the site language
- your country, derived from a Cloudflare request header
- a coarse device class (desktop, mobile, tablet or other)
We do not store IP addresses, full user-agent strings or cookies, and we do not build profiles or fingerprints. To count unique visitors per day, we compute a truncated SHA-256 hash of a random daily salt combined with the IP address and user agent. Only the truncated hash is stored. The salt is rotated daily and deleted after two days, so hashes cannot be recomputed or linked across days.
Clicks on the download button are recorded in the same anonymous way. If your browser sends a Do Not Track or Global Privacy Control signal, no analytics are recorded. Analytics events are kept for up to 400 days.
7. Hosting and service providers
The website runs on Cloudflare Pages, and analytics are stored in Cloudflare D1. Cloudflare processes technical request data, including IP addresses, to deliver and protect the website, under its own privacy policy. A download link may point to a third-party host such as GitHub Releases, whose policies then apply.
8. Storage in your browser
The website sets no cookies. It stores your theme and language preferences in your browser's local storage and uses a service worker cache so pages can work offline. You can clear both at any time in your browser settings.
9. Legal bases and your rights
Where data protection laws such as the GDPR or Korea's Personal Information Protection Act apply, we process anonymous analytics based on our legitimate interest in operating and improving the website, and optional app features based on your explicit request.
Because we do not store identifiers, we usually cannot link analytics records to you. You may still contact us to ask about access, correction, deletion or objection, and you may lodge a complaint with your local data protection authority.
10. Children
The website and app are intended for professional and adult users and are not directed at children.
11. Security and international processing
Connections use HTTPS, and administrative statistics require a secret access token. Cloudflare operates a global network, so request data may be processed outside your country.
12. Changes to this policy
We may update this policy. The effective date below will change, and material changes will be highlighted on this page.
13. Contact
Questions about privacy: projectteamforyou@gmail.com.