Your images are yours.

Who we are

Witness is operated by A Labs Inc., a Delaware C-Corporation based in Cambridge, MA. A Labs Inc. is the data controller for the purposes of GDPR and the business for the purposes of CCPA/CPRA. Contact: privacy@witness.vision.

What we collect

• Media you scan: images and videos you upload for analysis. These are analyzed in real time and are not stored— we do not retain your uploaded media after your scan completes.
• Scan results: detection scores and verdicts produced by our models.
• Account data: email and authentication info, if you create an account.
• Usage data:scan counts, feature usage, verdicts/scores, and device/browser type. We use PostHog for product analytics (events and properties only — never uploaded media).
• IP address: collected server-side on each scan request, used for abuse prevention and rate limiting.

We do not collect your contacts, browsing history, or GPS location.

How we handle scanned media

When you scan media, we analyze it to produce a verdict and then discard it. We do not retain your uploaded images or videos, do not use them to train our models, and do not sell or share them. Only the scan result (score and verdict) and basic metadata are kept.

Legal bases (EU/UK users)

We rely on the following lawful bases under the UK/EU GDPR:

• Contract: providing the scan service and managing your account.
• Legitimate interests:abuse prevention, rate limiting, security, and error monitoring — balanced against your rights.

Device identifier & local storage

Witness generates a random identifier (a UUID) and stores it locally on your device — in your browser's localStorage for the web app, or in extension storage for the Chrome extension. This identifier is used solely for rate limiting and does not directly identify you. (Note: under GDPR, a persistent device identifier may still be treated as personal data.)

The Chrome extension additionally stores your authentication session token locally (in Chrome extension storage) if you choose to log in. This token is used only to authenticate your scan requests and is cleared when you log out.

You can delete all locally stored data at any time by clearing your browser or extension data. A new device ID will be generated on your next visit.

Data storage, security, and retention

Data is stored on encrypted cloud infrastructure. Access is restricted to A Labs Inc.

International data transfers

Our infrastructure and service providers are located in the United States. If you access Witness from the EU/UK, your data will be transferred to the US. We rely on Standard Contractual Clauses (SCCs) and equivalent safeguards for these transfers.

Error tracking and analytics

We use Sentryfor error monitoring (crash reports and performance data — never uploaded media) and PostHogfor product analytics (event counts and properties — never uploaded media, no session recordings).

Bot protection is applied to scan requests via an invisible challenge provided by Cloudflare Turnstile, which may process your IP address and device signals for security purposes.

Your rights

You may request access to, correction of, or deletion of your data at any time: privacy@witness.vision.

• EU/UK users have rights under GDPR including access, rectification, erasure, restriction, data portability, and the right to object. You may also lodge a complaint with your local supervisory authority.
• California residents have rights under CCPA/CPRA including access, deletion, and correction. We do not sell your data, and we do not share it for cross-context behavioral advertising.

Children

Witness is not intended for users under 13 (or the minimum age required in your jurisdiction, such as 16 in parts of the EU). We do not knowingly collect data from children.

Changes to this policy

We will notify users of material changes via the app or email. The current version will always be available at this URL with an updated date.

Contact

Questions about this policy? Reach out at privacy@witness.vision — A Labs Inc.