Effective date: 2026-09-21 · Applies to the Trustamp Android app (com.trustamp.camera) and the trustampcamera.com website.
Trustamp is built privacy-first. Most of what you do happens entirely on your phone, and you can use the core watermark camera without an account. Membership checks and optional online services send the data described below. This policy explains exactly what leaves your device, when, and why.
Trustamp does not require you to sign up or provide a name, email, or phone number. The app uses a device identifier to associate witness records and membership with your device. It is sent when requesting credentials, checking membership, or binding a subscription. Subscription records may be linked to this identifier. It is not an advertising identifier.
Watermark mode (free):
Photos are captured and watermarked entirely on your device; the images are not uploaded to us. When the app checks membership, including at startup, it sends your device identifier to our server to retrieve your membership status and expiration time, even if you have not subscribed.
"Witness" mode (when you choose to make a photo verifiable):
Witnessing anchors when and where a photo was taken to our server. We send the following to record it:
We do not receive your photo, and we do not receive a hash or fingerprint of it. Image tamper-evidence is handled separately, by C2PA, below.
C2PA Content Credentials (optional, off by default):
If you turn on C2PA signing, the app embeds a tamper-evident Content Credential in the photo. This is created and cryptographically signed entirely on your device — the credential lives inside the image file, and our servers are not involved in it. Nothing about your image is sent to us to produce it.
Optional Google Play subscriptions:
If you subscribe, the app sends your device identifier and Google Play purchase token to our server to verify the purchase with Google and assign membership to your device. We also receive subscription notifications from Google to keep membership current after renewals, cancellations, expiration, refunds, or revocations.
We use these records to provide and maintain membership, process device binding or migration, and investigate purchase-related support requests. Google processes payments under its own Privacy Policy. We do not receive your full payment card number or security code. You can use the free features without purchasing a subscription.
Crash diagnostics:
We use Google Firebase Crashlytics to detect and fix crashes. If the app crashes, Crashlytics may collect a crash log (stack trace), diagnostic information about the device and app state at the time, and a Crashlytics installation identifier. This helps us keep the app stable and is not used for advertising.
The website does not require an account. The data deletion page lets you enter a device ID to prepare an email request locally; the form itself does not submit the ID to our server. If you send that email, we receive your email address and the information you include to handle your request. Downloads happen through Google Play under Google's own terms.
We do not sell your data or share it for advertising. We use the following services to run Trustamp:
A credential is designed to be checkable. When you share a credential's verification URL, anyone with that link can view the credential details (time, location, and verification status). You control who receives the link. Don't share a verification URL if its details are sensitive.
We retain witness records to provide verification and subscription records to maintain membership and handle purchase-related support. Subscription records are not automatically deleted at expiration. To request deletion of records associated with your device, email [email protected] with your device ID (available in the My tab), or use our data deletion page. We process deletion requests within 30 days, including associated subscription records and device bindings. We may ask for information needed to verify the request or locate a purchase; do not send payment card details or raw purchase tokens.
Deleting a device binding can remove membership access on that device. Deleting Trustamp data does not cancel a Google Play subscription or request a refund. Manage or cancel renewal in Google Play subscriptions. Google retains its own records under its policies. Continued use of the app or subsequent Google notifications may create new records. If any records must be retained to meet a legal obligation, we will explain the affected records, reason, and applicable retention period when responding to your request.
Trustamp is a tool for work and professional documentation and is not directed to children under 18. We do not knowingly collect data from children.
Trustamp serves a global audience. Data may be processed on Cloudflare and Google infrastructure in countries other than yours, with safeguards appropriate to the transfer.
We'll update this policy as the app evolves (for example, if a future version adds optional photo upload). Material changes will be reflected by a new effective date on this page.
Trustamp · [email protected]