ProofStow privacy

Effective 31 October 2026

Operator and contact

ProofStow is operated by Matthew James Neudegg. Contact proofstow@outlook.com. Public privacy and support destinations are https://proofstow.site/privacy and https://proofstow.site/support.

Local workspaces and hosted accounts

You can capture in a protected local workspace without registering online. For cross-device recovery, create a ProofStow account with your name, email address, password and a single-use email verification code. The service stores an encrypted name and email, a salted scrypt password verifier, account identifiers and hashed session tokens. It never stores a readable account password. Sign-in on a new device requires a password and email code. Codes expire in ten minutes, allow five attempts and cannot be reused. Password reset uses an email code and revokes previous sessions. Rate limits use temporary keyed abuse-prevention counters rather than raw IP logs.

Email delivery and support

SMTP2GO processes the recipient email address and verification-message content to deliver account codes. The service uses the existing verified SMTP2GO transport sender with the ProofStow display name; replies go to proofstow@outlook.com. SMTP credentials are kept only in a restricted server environment file and never distributed in the iOS app. If you contact support, we receive what you choose to send and use it to respond. Outlook and the mail transport providers process that correspondence under their own services. Review attachments before sending them. Never send passwords, MFA codes, device passcodes or encryption keys. Contact support to request correction or removal of support correspondence; removing a workspace does not recall email.

Evidence and complete workspace backup

Local data can include your workspace and organisation names, site addresses, projects, visits, notes, photographs, videos, audio, documents, optional location, original sensor files and calibration, thumbnails, analysis, face/privacy previews, editable meshes, reports, audit history, replicas and archives. Face previews or captured content may contain sensitive information. On-device analysis runs locally. Enabling cloud backup is a separate explicit authorisation to store the complete selected workspace, including sensitive content, on the ProofStow server. Upload only material you are authorised to store. A workspace is bound to its account and cannot be reassigned merely by signing in as someone else.

Protection and recovery limits

Cloud transfers use HTTPS/TLS. Persisted identity fields, metadata and backup payloads use server-side authenticated encryption. The service holds the decryption key: this is not end-to-end encryption. Authorised service administration can access data to operate the service and respond to support or lawful requests. No advertising, tracking, sale of evidence or analytics service is enabled. Device-only replicas and archives use a workspace encryption key in Keychain. A protected copy of that workspace replica key is included in the authorised cloud backup so another device can recover its replicas. Device biometric templates, device unlock credentials, device manifest-signing private keys and cloud session tokens are never included in workspace backups.

Foreground backups and conflicts

Backups run by explicit request and when a linked workspace closes while ProofStow remains open. A device must finish verification before its latest changes are recoverable elsewhere. Backgrounding, cancellation, memory pressure, thermal pressure, Low Power Mode, unavailable storage or network interruption can stop a transfer. The previous verified backup remains available. Limits are 5 GiB per account, 4 GiB and 10,000 files per snapshot, 2 GiB per file and 20 workspaces. Exceeding a limit refuses the complete transfer rather than silently omitting files. Signing in restores missing verified workspaces; an existing local workspace is never automatically overwritten. Conflicting device backups are retained for deliberate review. The service is not a promise of disaster-proof or indefinite storage: preserve independent exports appropriate to your organisation.

Sensors, previews, device unlock and location

Camera measurements, rear LiDAR and separate front TrueDepth capture run only when requested. Front depth is a camera-local snapshot, not a Face ID template or a fused room scan. Face detection, OCR, image labels and pose analysis run on device. Creating face/privacy previews requires its local consent; enabling complete cloud backup separately includes saved previews and scan data. Withdrawing local preview consent removes derived local previews, without rewriting originals or recalling a previous cloud snapshot or export. Use account deletion to remove hosted snapshots. Face labels do not identify a person or establish consent to publish their image. Apple performs Face ID, Touch ID or device-passcode authentication; ProofStow cannot read biometric templates. Optional location is off by default and is attached only when enabled by workspace policy and system permission. Offline maps retain OpenStreetMap attribution and the ODbL license. Capture stops when its view closes or the app leaves the foreground and does not restart automatically.

Retention and deliberate removal

Closing or locking a workspace retains data. Signing out removes the local session token and closes workspace access; downloaded evidence remains protected by the device lock for offline use. Pause automatic backup in Account & Cloud Recovery to stop future automatic uploads; verified hosted copies remain. Individual evidence deletion requests record a review date (30 days by default); that date alone does not erase files. Settings > Data & Workspace Removal explains export and explicit local workspace removal. Local removal erases that workspace's originals, replicas, archives, previews, survey/calibration files, editor copies, queue, metadata, audit records and local encryption key, and preserves other workspaces. It does not remove hosted backups.

Hosted account deletion

Because ProofStow now offers hosted accounts, account deletion applies to this release. In Account & Cloud Recovery, request deletion with your current password and email code, then confirm DELETE. On confirmation the service revokes sessions, removes your hosted identity, all owned snapshots, staged uploads and backup files, and removes linked local workspaces on the requesting device. Confirmed local removal resumes after interruption. Other devices' offline caches, device backups, exports, emails and organisation-controlled copies require separate removal. Microsoft accounts are not deleted. Content-free random account deletion receipts and timestamps may be retained to prevent restoration of deleted accounts from administrative backups; they contain no email, name or evidence. The service keeps the current and one previous verified revision per workspace, uncompleted uploads for up to 24 hours, and at most three pending/conflicting backups per workspace until discarded or the account is deleted. No additional organisational evidence-retention period is imposed by the service. Agree external retention with your administrator before uploading or erasing work. Logical removal does not guarantee overwriting flash storage or historical device backups.

Microsoft, Files and previous apps

Microsoft sign-in and SharePoint sync are disabled in this release and are not needed for ProofStow email accounts or local capture. Exports leave the app only through your chosen Files/share destination. Recipients and external providers control their own copies. ProofStow uses the separate com.atcom.proofstow identity. An installed SiteProof or SpatialScan app and its data remain intact; any transfer is explicit through that app's Files/export workflow.

Unexpected termination and approximate measurements

After an unexpected foreground end, ProofStow resets navigation and active work and asks you to continue safely, without erasing evidence. This heuristic can include a crash, memory termination or force quit and is not a diagnosis. Measurements and geometry remain approximate; validate important dimensions with independent physical references.

proofstow@outlook.com