Privacy notice

Beta version · last updated 13 November 2026

Proof (useproof.fyi) helps designers share artwork with clients, collect comments and record approvals. This notice explains what we store, why, where, for how long, and how to ask us to see or delete it. It's written for the personal data protection laws of Malaysia, Singapore and Thailand (PDPA).

What we store

If you're a designer with an account:

• Your name, studio name (optional) and email address.
• Your password, only as a one-way scrambled value (a hash). We can't read it.
• The projects, cards, files, comments and handover pages you create, and how much storage they use.
• Your email preferences and the Inbox of client activity.

If you're a client reviewing through a link:

• The name you type when you open the link. No account, no email address.
• Your comments and replies, and when you made them.
• When you press Revise or Approve: your name, the time, your browser type, and a scrambled (hashed) version of your IP address. We keep this as the approval record, so both sides can rely on it later. The real IP address is never stored.

Why we store it

• To run the service you asked for: sharing, reviewing, approving and handing over.
• To keep accounts and links secure, and to stop abuse (spam, bots, overloads).
• To send designers emails about client activity. You can turn these off with the link in any email or in Account settings.

We don't sell your data, show ads, or use your files or comments to train AI models.

Cookies

• A login cookie for designers (30 days).
• A reviewer cookie for clients, valid only for the one link you opened (90 days).
• Small preference cookies on your device (collapsed columns, thumbnails on/off, sidebar).
• Cloudflare Turnstile on sign-up, log-in and the name screen, to tell people from bots.

No advertising or tracking cookies.

Where it's kept and who helps us

• Cloudflare: hosting, the database and file storage (with an Asia-Pacific location preference), bot checks, and forwarding email sent to our address.
• Resend: sending notification and password-reset emails (Tokyo region).

Files are private. They're only shown through short-lived links made by the app, and original files only become downloadable after the client approves.

How long we keep it

• When a designer deletes a card, its files are removed straight away. When a designer deletes a project, it disappears at once and its files, comments, decisions and reviewer names are permanently erased within 30 days.
• Accounts are kept until you ask us to delete them.

Your rights

• See your data: designers can download everything about their account from Account settings → Download my data.
• Correct it: change your name and studio in Account settings; designers can edit or delete their cards and projects.
• Delete it: email us to delete your account. Clients who want their name removed from a project can ask the designer, or email us with the project link.
• Withdraw consent: you can stop using Proof and ask us to delete your data at any time.

Write to hello@useproof.fyi. We reply within 21 days.

Changes

If we change this notice in a way that matters, we'll tell designers by email before it takes effect.