KolTheia
Privacy notice
Last reviewed 29 October 2026 (the picture note for photos and what can be rebuilt from a note, how long logs and backups are kept, and the certificate check KolTheia makes when you verify a file).
The short version
- KolTheia does not keep your photo or video. The sealed copy is held in memory for up to 15 minutes so your phone can collect it, then deleted.
- For each photo and video KolTheia seals, it also keeps a small note about its pictures: a coarse description (some distinctive points and some small squares of colour and brightness), used to recognise a copy and say what was done to it. It is not a copy of the file and cannot be played, but a coarse, blocky picture can be rebuilt from it: see the table below.
- A file you register never reaches KolTheia: your browser works out its fingerprint and sends only that, with the file's name, size and any description you add.
- Where you were is stored as an area about 5 km across. The exact spot stays on your phone and is never sent to KolTheia for a capture made with the current page.
- Your password is stored only as a scrambled hash, never as the password. Your fingerprint or face, if you use a passkey, never leaves your device.
- No advertising. No analytics. No tracking cookies. We do not sell your data. The typefaces are served by KolTheia itself, so your browser contacts no one else to show a page. (The sign-in pages do load Cloudflare's "are you a person?" check; see below.)
What KolTheia holds about you
| What | Why | How long |
|---|---|---|
| Your email address, and a username if you choose one. Starting to sign up creates an account record for the address typed, before it is confirmed. | To sign you in and send codes and security messages | Until you close the account. An address that is never confirmed stays as an unconfirmed account until it is deleted on request (see your data); it is not deleted automatically |
| Your password (stored only as a hash made with Argon2id) and your passkeys (only the public part of each) | To sign you in | Until you remove them or close the account |
| Your device's name and its public key | To check that a capture was signed by your device | Until you remove the device |
| A record for each capture: proof code, fingerprints of the file, capture time, time received, the area (a map square about 5 km across) and a locked commitment to the exact spot, the device's signature, a label if you add one, and a short device summary (browser and phone model, screen size, language, time zone, which camera) | This is the proof itself | Kept, and written to a public log so it cannot be changed unnoticed (see "The public log"). It holds no photo, video or exact location. Records are not erased; you can ask for a capture to be hidden from your account: see your data |
| A note about the capture's own picture(s). For a video: about 48 distinctive spots of a picture every half second (where each is and a short code describing its surroundings), and, every fifth of a second, small squares covering about half of the picture (blocks laid out like a chessboard that shifts each time), each described by its brightness and colour in a 3 by 3 pattern and how sharp it is (about 800 KB for each minute of video; videos sealed before 20 October 2026 have four squares every fifth of a second, about 180 KB a minute). For a photo: the same idea, made once instead of spread over time — up to 360 distinctive spots spread over the whole picture (photos sealed before 29 October 2026: 48) and one secret scatter of 240 small squares across the single picture (under 20 KB). A coarse picture can be rebuilt from a note. Laying the stored squares back in place gives a grid of 36 by 60 colour blocks: for a photo, about half of that grid; for a video sealed since 20 October 2026, all of it (videos sealed before then: about half). That is far too coarse to read writing or show fine detail, but it shows the layout, the colours and the rough shape of people and objects, and it can be enough to recognise a scene or a person you know (measured 29 October 2026). Research has also shown that rough pictures can be rebuilt from distinctive spots like these; KolTheia has not tested that on its own notes. This is why the note is never shown to anyone and is kept out of the public log | So that anyone who later checks a copy of the photo or video (for example one sent through a messaging app, cropped, resized or with a filter) can be told whether it is a copy of this capture and what was done to it. The note is never shown to anyone, and is not in the public log | Kept with the record, for as long as the record is kept |
| A record for each file you register: its code, the file's fingerprint (SHA-256), its name and size, a description if you add one, your username at the time, when you registered it, and the outside authority's time-stamp over the fingerprint. If the file is later sold through a service that works with KolTheia: who held it and who holds it now, and a link to the sale | This is the proof itself | Kept, and written to the public log (see below). It holds no part of the file. Registrations are not erased |
| The sealed photo or video | So your phone can collect it | Held in memory for up to 15 minutes after sealing, or until you press "delete KolTheia's copy now". While it is being sealed, working copies sit briefly on the server's disk and are deleted when sealing ends |
| Older captures (before 3 October 2026) may hold an exact location | Made before area-only locations | Shown only to you when you are signed in; others see only the area |
| Your account's security activity: sign-ins, failed tries, password and passkey changes, each with the network address it came from. You can see this list on your account page. | To keep your account safe and let you spot anything odd | 12 months, then deleted automatically |
| Emailed codes: stored scrambled (never as the code), with the network address that asked for each | To confirm an email address and reset a password | Deleted within a day (a code stops working after 10 minutes) |
| Server logs, which can include network addresses and error messages | To find and fix faults and abuse | KolTheia's own log keeps each line for at most 30 days, and less when the log is busy: a new file is started every day, files older than 30 days are deleted, and the oldest are deleted sooner if the log passes about 8 MB; the server's system log keeps recent entries up to its size limit and deletes the oldest. The encrypted nightly backups of the database are kept for 7 days |
| Counts of recent requests per network address (rate limits) | To stop guessing and flooding | In memory only, gone when the server restarts |
The public log
Every capture record is added to an append-only public log that anyone can read and check. An entry holds: the proof code, a name for the device, fingerprints of the file, the capture and receipt times, the file format, the label you gave the capture, and the record's seal. It does not hold your email, your username, your password, your photo or video, or your location. Anyone who has a proof code can also see the capture's certificate, which shows your username, the area, and the device summary. Do not put anything private in a label.
A registered file is added to the same log. Its entry holds the registration code, the file's fingerprint, the time and your username: who registered the bytes first is what a registration proves, so it has to be in the record anyone can check. The entry does not hold the file's name or description; those are shown on the registration's certificate to anyone who has its code, or who has the file and checks it. Do not put anything private in a file's name or description before registering it.
What stays on your phone
Your camera settings, your device key, a copy of the file you just sealed (until you leave the result screen), and the exact spot and secret that go with each located capture. These are in your browser's storage. Clearing the browser's data removes them; a lost exact spot cannot be recovered by KolTheia. See cookies and storage.
Photos and videos you check on the Verify page
The file is read, checked and discarded. KolTheia does not keep it. The check compares it with the notes KolTheia holds for sealed photos and videos; nothing from the file you check is added to them. If the file carries Content Credentials, KolTheia's server may ask the issuer of their signing certificate whether that certificate was withdrawn (revoked); that request names the certificate, not you or your file.
Who else receives anything
KolTheia uses these services. None of them is given your photos or videos to keep, and none is paid with your data. Some are in other countries, so your data can be processed outside the country you live in.
- Cloudflare. KolTheia's address is served through Cloudflare, so what you send to KolTheia (including a photo or video you seal or check) passes through Cloudflare's network, which carries it over an encrypted connection to the server. We have not asked Cloudflare to store uploads, and Cloudflare's own terms and privacy policy cover what it does with traffic. KolTheia does not currently run Cloudflare's "are you a person?" check (Turnstile) on any page.
- Resend, our email provider, receives your email address and the message (a confirmation or reset code, or a note that you already have an account).
- Amazon Web Services, our hosting provider, runs the server and the database.
- Have I Been Pwned (a public service for checking passwords against known data breaches). When you choose a password (not when you sign in), a scrambled fingerprint of it is made and only its first five characters are sent. The service cannot tell which password you meant, and it never receives the password.
- A public time-stamp authority (DigiCert by default) receives only the SHA-256 fingerprint of the sealed file, or of a file you register, never the file.
We do not sell your data, do not show advertising, and do not give your data to anyone else unless the law requires it.
Your choices and rights
You can ask for a copy of your data, to correct it, or to delete your account's details. Capture records are not erased, because they are proof and are in the public log described above; on request a capture can be hidden from your account, but anyone who holds the file can still find its record. Where the law gives you more rights (for example in the UK or EU) they apply. The page your data says how to ask. You may also complain to your data protection authority.
Children
KolTheia is not for children under 13. If you think a child has made an account, tell us and we will delete it.
Who is responsible
Njinwi Ngu-Ngwa, an individual, is responsible for your data. KolTheia is not a company or a business. Contact: koltheia@ottxp.com. Changes to this notice are shown here with a new date.