Privacy
Prooflume keeps what it needs to show you the evidence, and sends each outside service only what that service needs. This page describes the service as it works in early access.
What we store
- Your account: email address, display name and a password hash (or your sign-in provider's identifier).
- Each case: the text you submitted, the indicators read from it, the checks that ran, their evidence, the event timeline and the report.
- Email addresses found in a submission are stored as their domain only; the part before the @ is not kept as an indicator.
Who receives what
- The model provider receives the submitted text only when you turn on live AI for that case.
- A reputation provider such as IPQualityScore receives only the single phone number or IP address you approve, for that one lookup.
- Websites linked from a submission see a request from Prooflume's isolated fetcher, not from you.
- DNS and registration lookups go to public resolvers and registries.
- Cloudflare Turnstile runs a human check when you start an investigation. Cloudflare receives signals from your browser to tell people from bots; it never receives what you submit.
Cookies
- One session cookie that keeps you signed in. It cannot be read by scripts.
- No advertising or analytics cookies. The only third-party script is Cloudflare Turnstile, and it loads only on the page that starts an investigation.
Exports and retention
- Exports are redacted on a best-effort basis. Review a file before you share it.
- How long cases are kept is set by the operator of the deployment you use. Ask them to delete your data if you need it removed.