Privacy Policy
In force since 21 October 2026. Operated by Zevlat Intelligence.
- No ads, no tracking, no analytics cookies, and we never sell data.
- Verifying a document happens in your browser. The file never leaves your device.
- What an institution records in public fields is public and permanent. The institution decides what goes in it and answers for it.
- Officials are not public. The record shows each signer's code, title and department, never their name. Names are kept privately for their institution, visible only to its own people.
- Beyond that we keep the minimum: billing details through Stripe, public keys, and an IP address for one minute to stop abuse.
The summary helps; the numbered sections below are what binds.
1. Who is responsible
Zevlat Intelligence (zvlint.com) operates HardState and is responsible for the personal data described here. This policy applies the Zevlat Intelligence privacy-first policy to HardState and is the one that applies to it. Contact: hello@hardstate.net.
2. Two roles: ours, and the institution's
- We decide how to handle the data needed to run HardState: signers' public keys, codes and titles, institutions' billing contacts, support emails and technical data.
- The institution decides about its officials' names: we keep them on its behalf, as its processor, and show them only to its own people.
- The institution decides what it records in its HardState Log. For that content we act on its behalf, as its processor. To exercise your rights over a record, contact the institution that made it; we help it respond.
3. What we handle, why, and for how long
| Data | Why | Kept |
|---|---|---|
| Institution profile: name, country, city, map position, website | To identify the issuer of each record, publicly | Permanently, in the public log |
| Signers: public key, a code derived from it, their title and department, and a salted fingerprint of their name that reveals nothing by itself | To show which accountable key signed each step, without exposing the person | Permanently, in the public log. Revoking a key stops new signatures but keeps the history |
| Officials' names, with the salt that opens that fingerprint | So the institution's people see who is who, and the institution can prove who held a key if an auditor or a court asks | Private, never in the log. Read only by the institution's own signers, through a signed request; deleted when the institution asks |
| Passkeys: public key and credential id only | To check signatures | As above. Fingerprints, faces and PINs never leave your device |
| Records: public fields and salted document commitments, chosen by the institution | To provide the Service | Permanently (append-only) |
| Published documents, only if the institution publishes them | To let anyone download and check them | Until the institution asks us to remove the file; its hash stays |
| Billing: legal name, billing email, address, tax id, purchase order, plan and payment status. Card details go to Stripe, never to us | To charge, invoice and meet tax law | While the plan lasts, then as long as tax law requires |
| Rejected writes: institution, claimed key id, reason, time. No IP address and no content | To help institutions find failing integrations | 30 days |
| Technical data: IP address and request details | To serve the Service and stop abuse. Our rate limiter keeps an IP in a one-minute counter; Cloudflare's request logs are kept for a few days | Minutes to days |
| Signed admin requests (billing, express anchors): a one-time nonce | To block replays | Deleted after a few minutes |
| Emails you send us | To answer you | As long as the conversation needs, then deleted |
Legal bases: performing our agreement with the institution, our legitimate interest in a secure and accountable service, legal obligations (tax, for example) and, where the law requires it, consent.
4. What stays in your browser
- Documents you verify or stamp are hashed on your device. Verifying sends nothing. Stamping sends only the 32-byte hash.
- Receipt links carry the document salts after the "#", which browsers never send to any server.
- Session keys (IndexedDB), receipts you saved, your sign-in state and your theme (localStorage) live only on your device. Clearing your browser's site data removes them.
HardState sets no cookies and uses no analytics. Because nothing non-essential is stored, there is no cookie banner.
5. Every third party involved
| Who | What for | What they get |
|---|---|---|
| Cloudflare | Hosting, database, file storage, network | Everything the Service stores; request IPs |
| Stripe | Payments, invoices, tax, Customer Portal | Billing details and payment methods, under Stripe's own privacy policy |
| Bitso | Buying bitcoin for anchoring fees | Nothing about you: only our own account and the anchoring address |
| Bitcoin network; mempool.space and blockstream.info | Anchors, and the Bitcoin data verifiers check | Merkle roots only. Your browser contacts the explorers directly when it verifies |
| OpenTimestamps calendars | Free timestamping of batches | Hashes only |
| OpenStreetMap (Nominatim and map tiles) | Placing an institution on the map when it registers; the Coverage map | The city typed at registration, and your IP when the map loads, contacted by your browser |
| Google Fonts | The typefaces of the app | Your IP when your browser fetches the fonts |
We add to this list before any new party receives data, and record the change in the history below.
6. What we never do
- Sell, rent or trade personal data.
- Show ads, build profiles or track you across sites.
- Use records, documents or personal data to train AI models.
- Read the documents behind commitments. We can't: we only hold salted hashes.
7. Your rights, and the one thing nobody can do
You can ask to:
- access, rectify or delete your personal data;
- object to or restrict its use;
- take a copy (portability);
- withdraw consent.
Under Mexican law these include the ARCO rights; under the GDPR and similar laws, the equivalent rights. Write to hello@hardstate.net from the address we know you by, and say what you need. We answer within 20 business days.
You can also complain to your data protection authority. In Mexico, that is the authority that LFPDPPP designates.
Entries in a HardState Log and anchors on Bitcoin cannot be erased or edited, by us or by anyone.That is the guarantee the system exists to give. When you ask us to remove something from the record, here is what we can and cannot do:
- The institution can record a correction or revoke a key.
- We can remove a published file.
- Where the law requires it, we can stop displaying a field in our own explorer.
- Copies already in the log, in proofs and in independent verifiers remain.
This is why personal data must never go in public fields, and why a signer's title never includes their name: the name goes only to the institution's private directory.
8. Security
There are no passwords to steal: every write is signed by a passkey or a key the institution controls, and our servers never hold private keys. Traffic is encrypted, access is limited to what each part needs, and we publish a responsible-disclosure policy. If a breach affects your data, we tell you without undue delay.
9. International transfers
Cloudflare and Stripe may process data outside your country, including in the United States, under their contractual safeguards (for example, the EU Standard Contractual Clauses). Public records are, by nature, available worldwide.
10. Children
HardState is a service for institutions, and children don't have accounts. Institutions that handle matters about minors must never put a minor's personal data in public fields.
11. Changes
We announce material changes at least 30 days ahead, on this page and by email to the admins of paying institutions. Every change appears in the history below. See also the Terms of Service.
Change history
Every change to this page is listed here, with its date. Earlier versions are kept and sent on request.
- 2026-10-21 · First version.