Digital Trust Passport ("we", "us") operates a checker that verifies public facts about a website — domain age, archive history, business registration, tracker presence, and similar — and publishes the results on a public verify page. This policy covers what we collect from you as an account holder, and what we collect about the domains you register.
What we collect from you
Account: your email address and a bcrypt hash of your password. We never store your password in plain text, and there is nothing else in your account record — no name, no payment details, no OAuth tokens (we never request OAuth access from anyone, including you).
Domains you register: the domain name, a display name you choose, and — only if you provide one — a business registration number (e.g. a Brazilian CNPJ) you're asserting applies to that site.
Domain-ownership verification token: a random string we generate so you can prove control of a domain via a DNS TXT record or an uploaded file. This token is not secret — it's designed to be published publicly as proof.
Session tokens: a signed JWT stored in your browser's local storage after you log in. A short-lived record of failed login attempts and logged-out tokens is kept in Redis (an in-memory store) purely to enforce login-lockout and session invalidation — this data expires automatically and is never used for anything else.
What we collect about a registered domain
Every check we run queries a public source — a domain registry (RDAP), the Internet Archive's Wayback Machine, certificate transparency logs, a Brazilian business registry (publica.cnpj.ws), or the live page itself (TLS handshake, HTML source, a headless-browser page load). None of this requires — or requests — any access to the site's backend, hosting account, or admin panel. The scan results (plain JSON) are stored, hash-chained, and independently timestamped via RFC 3161 against FreeTSA, a third-party timestamp authority — FreeTSA receives only a cryptographic hash, never any of your data.
What we don't do
- We do not sell or share your account data with data brokers or advertisers.
- We do not run analytics or advertising trackers on this site.
- We never request OAuth, API-key, or admin-panel access to any site we check — from you or from anyone.
- We do not use your data to train any model.
What this service publishes about your domain
Once you verify ownership, your domain's scan results, findings, and (if you choose to write one) your operator's pledge become publicly visible on that domain's verify page. This is the point of the product — it exists to make evidence public, not to keep it private. Don't register a domain you don't want scan results published for.
Retention
Scan evidence is append-only and kept indefinitely — that's what makes the hash chain meaningful (a gap or deletion would be detectable). Your account and registered domains persist until you ask us to delete them.
Your rights
Contact admin@provadeconsentimento.com.br to request a copy of your data, a correction, or account deletion. Deleting your account removes your login credentials; published scan evidence for domains you verified may be retained as a historical record, consistent with the append-only design described above — ask us if you need a specific domain fully removed instead.
Changes to this policy
We'll update the date at the top of this page when this policy changes. Material changes will be noted on the site.