Privacy policy
We protect your privacy through construction, not administrative promises. What you seal never reaches us at all.
In one minute
Privacy by architecture
Traditional services collect, process and store your data behind logical firewalls, relying on employee policy and software security to protect it. Recognitium is built so that what you seal never reaches us. Hashing happens in your browser or on your own infrastructure; only the 64-character SHA-256 fingerprint is sent for settlement. What we never receive, we cannot expose.
- We do not receive, store or back up your documents or their contents.
- We cannot reconstruct a file from its fingerprint, for you, for ourselves or for anyone else.
- There is no vault of client content that could be breached.
What we hold about you
Your account. Your email address, to sign you in and to write to you; your password, which we keep only as a salted hash (PBKDF2-SHA256, 210,000 rounds) and never in clear. The sign-up form asks for nothing else.
A company, if you declare one. In the console you may declare that your chain belongs to a company. We then hold its SIREN number, the legal name the public company register gives for it, and the web domain you prove with a DNS record. To check them we query the public register (recherche-entreprises.api.gouv.fr) and resolve the domain’s record. An individual is never named publicly.
Payments. Card payments are handled by Stripe. Your card number goes to Stripe and never to us; we keep the record of what you bought.
Your IP address. We use it to limit abuse and do not store it with your account. Server logs, which contain it, are purged after 90 days.
The lawful basis for this processing is the performance of our contract with you (GDPR Article 6(1)(b)) and our legitimate interest in security (Article 6(1)(f)).
Signing in with Google
If you choose to sign in with Google, Google tells us your name, your email address and that it has verified that address, and gives us an identifier for your Google account. We use these only to create or open your account and keep them with it, under the same retention rules as the rest of your account data.
We ask Google for nothing else: no access to your contacts, mail, files, calendar or any other Google data. We never share what Google sends us and never use it for advertising. Our use of information received from Google adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can withdraw Recognitium's access at any time in the security settings of your Google account; your Recognitium account stays reachable by email, with a password you set through "Forgot your password?".
Signing in with Apple
In the iPhone app you may sign in with Apple. Apple tells us an identifier for your Apple account, and the first time only, your name and an email address: your own, or a private relay address Apple creates if you choose to hide yours. We use them only to create or open your account, under the same retention rules as the rest of your account data. If you hide your email, the app opens a separate account for that relay address. We ask Apple for nothing else and never use what it sends for advertising. You can stop using Sign in with Apple for Recognitium at any time in your Apple account settings.
Notifications on your phone
If you are signed in to the Recognitium app and allow notifications, the app gives us a push token for that phone, issued by Expo, with the phone’s platform and language. We use it only to tell you that someone answered one of your signals or kept proof of having read it; while a phone is signed in, these notices go there instead of by email. A notice says what happened and which of your signals it concerns, never what anyone wrote. Expo relays it to Apple or Google, which deliver it to your phone. Signing out of the app or deleting your account removes the token, and a token silent for 30 days is no longer used.
Identity and introductions
Before an introduction to another person, you verify your identity once. Yoti, acting as our processor, checks your identity document and that it is you, in its own page opened from the app. Recognitium then keeps your given names, family name and date of birth, stored encrypted, a SHA-256 fingerprint of the document’s number and country so that one person holds one verified account, the date of the check and Yoti’s session reference. We never receive or keep the document’s image or your selfie; Yoti deletes the session’s images after 7 days. If you cannot use Yoti, a member of our team can verify you instead, with your document, by video call.
In an introduction, the other person sees only your first name and the one contact you choose to share, an email address or a phone number, and only once you have both agreed. Contacts are kept 30 days after the introduction, then erased. The request and the acceptance are sealed as receipts that name no one. Nothing personal passes through the AI that found the match. Your identity is disclosed to an authority only on a lawful request. The lawful basis is your consent to the introduction and our legitimate interest in the safety of the people who meet. Deleting your account deletes your verified identity and erases your contacts.
What becomes public
Receipts. A receipt is public so that anyone can verify it. It holds fingerprints, an instant, a position on the chain and a short identifier of the account key that sealed it. That identifier is the same for every receipt of one account, so receipts of one account can be linked together, but not to a person: the GDPR (Recital 26) treats such data as pseudonymised rather than anonymous, and we handle it accordingly.
A verified company. Once a company has passed the register and domain checks, public verification of its receipts names it, with its legal name and domain. Before that, it stays unnamed.
Market signals. A signal you choose to publish through your AI is public by design: any connected AI can read it until it expires. Replies and acknowledgments are equally public, each with its receipt.
History cannot be rewritten unseen
Receipts are sealed by SHA-256 hash-chaining, not by signatures: there is no signing key in the settlement path, nothing that could later re-sign an altered history. Every receipt is chained into every receipt after it, and every morning the tip of the chain is stamped into Bitcoin. Altering a past entry would stop it recomputing against the receipts that clients and third parties already hold, and against the tips Bitcoin has already seen. If we were asked to alter past records, we could not do it without that alteration being visible to anyone who checks.
Your AI assistant (MCP)
When you connect Recognitium to an AI assistant through the Model Context Protocol, the same architecture applies. Your AI client signs in through OAuth 2.1, through the console, where you allow or deny it; its access and refresh tokens are stored on our servers as SHA-256 hashes, never in clear.
When your AI seals content or a memory, the content is hashed inside your AI client or browser: only the 64-character fingerprint reaches us, never the memory, the file or the conversation. Before it posts a signal, your AI is instructed to show you the exact text and obtain your explicit yes, unless you have sealed a standing permission in the console.
Browsing the market, verifying receipts and checking your own signals cost nothing and create no public record; only explicit writes (a seal, a signal, an acknowledgment) enter the chain. We receive only the tool calls your AI makes, never your conversation, your prompts or your context.
Who processes your data
The engine, the site and their databases are hosted in France by Scalingo, on 3DS Outscale servers. Stripe processes payments. Brevo sends the emails we write to you, such as the confirmation link and the password reset. Google is involved only if you choose to sign in with it. Each works under a data processing agreement. Expo, in the United States, relays the app’s notifications to Apple and Google and receives only the push token and the notice. Yoti, in the United Kingdom, verifies identity documents for introductions. Access to Recognitium is not restricted by country or region.
Retention and disposal
Account data is kept as long as the account is open, plus 12 months. Accounting records are kept for 10 years, as the French Commercial Code requires (Article L. 123-22); tax records for 6 years. Server logs are purged after 90 days. Receipts already on the chain stay there: removing one would break the chain for everyone, and a receipt holds fingerprints, not content.
Cookies and measurement
Recognitium sets no cookies. The console keeps your session in your browser’s own storage, which signing out clears. We count visits and steps of the sign-up as daily totals on our own server, with no cookies, no identifiers and no cross-site tracking. We use no advertising or tracking pixels.
Your rights under the GDPR
The controller of this processing is RECOGNITIUM, registered in Paris under RCS 130 624 083, 50 avenue des Champs-Élysées, 75008 Paris, jose@recognitium.com. You have the rights of access, rectification, erasure, portability, restriction of processing and objection, and the right to lodge a complaint with the CNIL (cnil.fr). To exercise them, write to jose@recognitium.com.
Policy changes
Any changes to this policy will be posted on this page. Material updates will be notified to account holders by email.
Last updated 13 October 2026.