Privacy policy
Sunlit Workshop verifies objects, not people. The register is built so a stranger can prove a work is real without telling us who they are. This page is the whole picture — every field we store, every company that touches it, and how to make us delete it.
The short version
- You can verify a work without an account. Tapping a chip or scanning a QR mark never asks who you are.
- No tracking, no advertising, no analytics SDKs. There is no advertising identifier, no third-party analytics library, and no cross-app or cross-site tracking in any of our apps. We do not sell or share personal information.
- IP addresses are sealed, not stored in the clear. Each check stores a keyed HMAC-SHA256 fingerprint for rate limiting, plus an AES-GCM ciphertext of the raw IP under a KMS-wrapped key that only the workshop Desk can unwrap for abuse review.
- Camera and NFC never leave the device as media. The camera decodes a QR mark on-device; NFC reads the chip's cryptographic response. No photo, video, or audio is captured, saved, or uploaded.
- Signing in is for collectors, and it is only ever an email address. There is no sign-up, no password, no profile, and no name — a sign-in exists only for an address the workshop already registered a work to. You can delete it yourself in the app or on the web, in two taps.
1. What this covers
ZDN Enterprises, LLC, doing business as Sunlit Workshop (“Sunlit Workshop”, “we”), operates the authenticity register for its own physical work. This policy covers three products:
- Sunlit Verify (com.sunlitworkshop.verify) — the free iOS and Android app a collector uses to check a work.
- Sunlit Tag Studio — the iOS and macOS bench tool used by workshop operators to program and audit authenticity marks. It requires workshop credentials and is not usable by the public.
- The web register at provenance.sunlitworkshop.com, including public verification pages, the collector account area, and the workshop admin desk.
It does not cover the Sunlit Workshop storefront, third-party marketplaces we sell through, or any site we merely link to.
2. Sunlit Verify (iOS & Android)
Using the app without an account
This is the default and the whole point. When you tap a chip, scan a QR mark, or type a serial, the app sends only what is needed to check the mark, and our server records one row describing the check:
| Field | What it is |
|---|---|
| item_id, tag_id, read_counter | Which work and chip were checked, and the chip's own tap counter. |
| method, verified, failure_code | How it was checked (crypto chip, basic chip, QR, certificate tag, hologram, serial lookup, timestamp proof, or PDF signature) and whether it passed. |
| ip_hash | A keyed HMAC-SHA256 fingerprint of your IP address, used for rate limiting and duplicate detection. |
| ip_ciphertext | The raw IP sealed with AES-256-GCM under a KMS-wrapped data key. Plaintext IPs are never written to the database; only workshop operators can recover them through the Desk for abuse review. |
| user_agent | The browser or app version string sent with the request. Used for debugging and abuse triage. |
| country, region | Coarse country and subdivision code (for example US, CA) estimated from the connection IP using a local location database, or supplied by a trusted network edge. |
| geoip | Approximate country, region, city, timezone, latitude and longitude with an accuracy radius, and network number (ASN) and organization. This describes an IP-derived area, not GPS or a street address; VPNs may show the VPN location. Lookups run locally and do not send your IP to MaxMind. We record the database dates and enrichment time. Older checks may be enriched later from their encrypted IP; this does not establish their location at the original scan time. This product includes GeoLite data created by MaxMind, available from MaxMind. |
| correlation_ref, created_at | A support reference we show you when a check fails, and the timestamp of the check. |
Under privacy law this record is pseudonymous for collectors: on its own it does not name you. The HMAC fingerprint cannot be reversed. The sealed IP can be recovered only with the workshop's KMS-held key, and only for Desk abuse review — not for advertising or profiling. We keep the trail because a provenance register that cannot notice a chip being read from four countries in one hour is not a provenance register.
If you upload a certificate PDF to check its signature, the file is read in memory to verify the PAdES signature and then discarded. We do not store the PDF.
If you sign in
Signing in is for collectors, it is optional, and it only unlocks the “My works” list and your authenticity letters. There is no sign-up. A sign-in exists only for an address the workshop has already registered a work to — enter any other address and no account is created and no link is sent. We collect and store:
- Your email address, used to send a one-time sign-in link and to match you to works registered to that address. There is no password.
- An authentication session (access and refresh tokens), held in the iOS Keychain or Android Keystore via the operating system's secure storage. Signing out deletes it.
- A record of the sign-in attempt — the keyed IP fingerprint described below, the time, and whether the address matched a registered work. This throttles guessing. An address that matches nothing is not stored: the row says only that an unrecognised address was tried.
Sign-in email is handled by our authentication provider, which also records standard sign-in metadata (timestamps and the IP of the sign-in attempt) for account security.
Stored on your device only
The app keeps your most recent verification result and a short-lived verification token in the platform secure store so the result survives an app switch. Neither is transmitted anywhere beyond the checks described above, and both are removed when you sign out or delete the app.
3. Sunlit Tag Studio (iOS & macOS)
Tag Studio is an internal bench tool for workshop staff. It has no consumer sign-up. It stores, on the operator's device:
- A device API token in the system Keychain, obtained by signing in with workshop admin credentials.
- Operator preferences in local app settings — server URL, label dimensions, and chip-handling toggles. No personal data.
In use, it reads and writes Sunlit authenticity chips over NFC and calls the workshop API, where it can see and edit the work records that operators maintain — including a commission client's name, email, and mailing address where the workshop has entered one for shipping and for sending the authenticity kit. That customer data is workshop business record-keeping, entered by us rather than collected from the app's user, and it is never published on a verification page.
4. The web register
Public verification pages
Anyone can open a work's page. Doing so records the same check row described in section 2. One functional cookie is involved:
| Name | Purpose | Lifetime |
|---|---|---|
| sunlit_verify | Proves to the page that you just completed a live chip or QR check, so it can show the strongest tier of proof. HttpOnly, Secure, SameSite=Lax, scoped to /verify. | 5 minutes |
| Session cookies | Keep you signed in to the collector account area or the workshop admin desk. Set only after you sign in. | Session |
These are strictly necessary cookies. We set no advertising, analytics, or cross-site tracking cookies, which is why you see no cookie banner.
Reporting a suspect work
If you use the report form, we store the serial, the category you chose, the message you write, the contact detail you give us (usually an email address), and a keyed IP fingerprint for rate limiting. We read these by hand and reply to you.
Workshop records
To register a work and mail its certificate, the workshop keeps ordinary commerce records: the buyer's name, email, mailing address, and order reference, plus the photos and description of the object. These are business records under our own control, retained as long as needed to support the work and to meet tax and accounting duties.
5. Device permissions, and exactly what they do
| Permission | Why | What leaves the device |
|---|---|---|
| Camera | Decode the signed QR mark on a work or its certificate. The frames are processed on-device by the system barcode scanner. | Only the decoded token and signature from the QR mark. No image, video, or audio is recorded, stored, or uploaded. |
| NFC | Read the authenticity chip. Tag Studio additionally writes to chips during programming. | The chip's identifier, tap counter, and cryptographic message code — the values that let the server prove the chip is genuine. |
Both apps decline the permission gracefully: Sunlit Verify still works for serial lookup if you refuse the camera, and you can revoke either permission at any time in system settings.
6. What we never collect
- No advertising identifier (IDFA / GAID), and no App Tracking Transparency prompt because we have nothing to track you with.
- No third-party analytics, attribution, crash-reporting, or advertising SDK in either app.
- No precise or background location. No GPS. Country and region come from the network edge, not the device.
- No contacts, calendar, health, financial account, or biometric data.
- No photo library access, and no microphone.
- No sale of personal information, and no sharing for cross-context behavioral advertising, under any definition in US state privacy law.
- No profiling or automated decision-making that has legal effect on you.
7. Why we hold each thing
| Data | Purpose | GDPR / UK basis |
|---|---|---|
| Check record, keyed IP fingerprint, user agent, country | Deliver the verification result; rate-limit and lock out brute-force guessing; detect a cloned or shared mark; keep an audit trail for the register. | Legitimate interests — running a counterfeit-resistant register and protecting it from abuse. |
| Email address and session | Sign you in and show the works registered to you. | Performance of a contract, at your request. |
| Report form contents | Investigate a suspect work and reply to you. | Legitimate interests; consent for the contact detail you volunteer. |
| Buyer name, address, order reference | Register the work, ship it, and send its authenticity kit. | Performance of a contract; legal obligation for tax records. |
8. What is public and permanent
A provenance record is meant to outlive us, so parts of it are deliberately permanent and world-readable: the serial, title, description, edition, creation date, photographs of the object, its certificate of authenticity, its X.509 item certificate, and its cryptographic timestamps — including a hash of the signed record filed in the Sigstore Rekor public transparency log, and a hash anchored into the Bitcoin blockchain through OpenTimestamps. Neither publication can be withdrawn once made.
Emails, addresses, and full names stay private. A public verification page describes the object. It does not show the collector's email, address, or purchase price, and it does not show the country or IP fingerprint of anyone who checked the work. Initials or a workshop-chosen display name may appear on the ownership chain when a transfer is recorded. The check history on a page shows only the method and the timestamp.
Because the anchored data is a hash of the record about the object, no personal data of yours is written to any blockchain.
9. Who else touches the data
We use a small set of processors, each contractually bound to handle data only on our instructions and to protect it at least as well as we do. We sell data to no one.
| Provider | Role | Data involved |
|---|---|---|
| Fly.io | Application hosting and the register database (primary region: San Jose, US). | Everything described above. |
| Cloudflare | DNS, CDN edge, and object storage for certificates, photos, and proofs. | Request metadata; stored artifacts. Supplies the country and region codes. |
| Supabase (self-hosted by us) | Authentication for collector accounts. | Email address, sign-in metadata, session tokens. |
| Resend | Transactional email delivery. | Recipient email address and message contents — sign-in links, authenticity kits, and chip announcements. |
| Timestamp, transparency log, and certificate authorities | RFC 3161 timestamping, OpenTimestamps anchoring, filing record hashes in the Sigstore Rekor public log, and issuing per-item X.509 certificates. | Cryptographic hashes and object metadata only. No personal data. |
| Apple, Google | App distribution. | Whatever the store collects when you download or update the app, under the store's own policy. We receive only aggregate, non-identifying install counts. |
We will also disclose data if compelled by valid legal process, and to establish or defend a claim of forgery — the situation this register exists for. If the business is ever sold, the register transfers with it under this policy.
10. Retention
| Data | Kept for |
|---|---|
| Verification check records (including keyed IP fingerprint) | The life of the work's record. They are the tamper-evidence history — a gap in them is a gap in the proof — and they never contain an IP address or a name. |
| Public provenance record, certificates, timestamps | Indefinitely, by design. See section 8. |
| Account email and session | Until you ask us to delete the account, or you sign out (session only). |
| Reports of suspect works | Until resolved, then up to 3 years as a counterfeiting record. |
| Buyer and order records | As long as required for support, tax, and accounting — generally 7 years. |
| The 5-minute verification cookie and on-device last result | Minutes; cleared on sign-out or app deletion. |
11. Your rights, and how to delete your data
Wherever you live, you may ask us to show you what we hold, correct it, delete it, hand it over in a portable form, or stop a particular use. If you are in the EEA, UK, or Switzerland you have those rights under the GDPR, including the right to object to processing based on legitimate interests and to complain to your supervisory authority. If you are in California, Colorado, or another US state with a privacy statute, you have the equivalent rights to know, delete, correct, and opt out — and we do not sell or share your personal information, so there is nothing to opt out of. We will not treat you differently for exercising any of this.
Deleting your sign-in and your data
You can do it yourself, immediately, in either place:
- In Sunlit Verify — Account → Delete account.
- On the web — your account page → Delete this account.
Either one removes your email address, your sign-in, and every session it owns on the spot. Or email zach@sunlitbytes.com from the address you signed in with and we will do it by hand within 30 days. Verifying works never requires signing in, so this costs you nothing but the “My works” list.
Two honest limits. First, we cannot delete a work's public provenance record or its blockchain-anchored timestamp — that record is about the object, contains no personal data about you, and destroying it would break the authenticity guarantee the work was sold with. Second, we keep the pseudonymous check history, which contains no name, email, or IP address; if you believe a specific record can be linked to you, write to us and we will look at it individually.
We answer requests within 30 days and may need to confirm you control the email address before acting on one. You are welcome to use an authorized agent.
12. Children
These apps are not directed to children. We do not knowingly collect personal information from anyone under 13 (or under 16 in the EEA and UK), and Sunlit Verify asks for nothing at all unless you choose to sign in. If you believe a child has given us an email address, write to us and we will delete it.
13. Security
- Everything travels over TLS. The apps talk only to our own origin.
- Tokens live in the iOS Keychain or Android Keystore, never in plain application storage.
- IP addresses are stored as a keyed HMAC fingerprint plus an AES-GCM ciphertext under a KMS-wrapped data key; only workshop Desk credentials can unwrap the plaintext.
- Signing keys and per-item private keys are held encrypted, and item private keys are sealed to a separate encryption certificate.
- Admin and workshop tooling requires separate credentials with scoped permissions.
No system is perfect. If you find a vulnerability, please write to zach@sunlitbytes.com before disclosing it, and we will work with you.
14. International transfers
We are a United States business and our servers are in the United States. If you use the apps from outside the US, the data described here is processed in the US. Where the GDPR applies, transfers rely on the European Commission's Standard Contractual Clauses with our processors, and the volume of personal data involved is deliberately tiny.
15. Changes
When the apps change what they collect, this page changes with them, and the date at the top moves. Material changes are announced in the app release notes. Continuing to use the apps after a change means you accept the updated policy.