Privacy Policy

Last updated: 18 October 2026 · Lymark app, version 1.4.0

Ky dokument ekziston në portugalisht, anglisht dhe spanjisht. Në këtë faqe shfaqet në anglisht.

This policy describes how Lymark (com.lycosteam.lymark) and this site handle personal data. It is written for the data-protection and consumer regimes of the rule-of-law jurisdictions where the service is offered — including Brazil’s LGPD, the GDPR (EEA), UK GDPR, US state laws (including California’s CCPA/CPRA), PIPEDA (Canada), the Privacy Acts (Australia and New Zealand), APPI (Japan), PDPA (Singapore), POPIA (South Africa), Mexico’s LFPDPPP, Argentina’s Ley 25.326 and equivalent Latin-American laws, plus Brazil’s consumer code and EU/UK consumer rules. Where the mandatory law of your country of residence grants stronger rights, that law prevails. This text does not claim to exhaust every national code, nor worldwide compliance.

01In one sentence

Lymark stamps photos and videos and issues a seal recording that it saw that file, on that account, at that moment. Photos and videos never leave your device. There is an account, required to use the app: the server keeps your email, the account identifier, the plan, the export count and the ledger of the last 80 photo issuances, with the fingerprint (hash) of each sealed file — never the image.

Besides the account, what leaves the device is: (a) on each export, to the Lymark API, the hash and the perceptual hash of the file and the stamp code and, for each exported photo, also the device clocks, the device and chip-key data (item 04) and, if you allowed location, the GPS coordinate, which the server uses to compute the capture facts and discards without storing (item 05); (b) the coordinate and the typed address, through the operating system, to become an address and a map pin (item 05); (c) the file hash, for a third-party timestamp (item 18); (d) payment data, handled by the payment processor (item 18); (e) in the Android app, the account identifier and technical device data, for the subscription intermediary for Google Play (item 18). None of these flows sends the image. If you ask to delete the account, a single encrypted record may be kept for up to five years (item 21).

02Who this policy applies to

It applies to anyone who uses the app or this site, in jurisdictions where Lymark is lawful. Brazil: LGPD and ANPD. EEA and United Kingdom: GDPR and UK GDPR. California and other US states with a consumer privacy law: the equivalent rights in item 19. In other countries with a data-protection statute, we honour equivalent rights (access, correction, deletion, objection, portability) through the same channel: privacy@lymark.app. We may refuse or limit the service where offering it would be unlawful or subject to sanctions.

03Who the controller is

The controller of the personal data — controlador, in the terminology of the LGPD — is 29.015.357 AMAD ALI HAMMOUD, microempreendedor individual (MEI), CNPJ 29.015.357/0001-25 (a Brazilian individual microentrepreneur), with an address at R. Antídio Fialho Dutra, 561 - Jardim Virginia, Guarujá - SP, 11442-197, Brasil.

The person in charge of personal data processing, for the purposes of Article 41 of the LGPD, is Amad Ali Hammoud, who can be contacted at privacy@lymark.app. Given the volume and the nature of the processing — which involves neither sensitive data at scale nor systematic monitoring — there is no obligation to appoint a Data Protection Officer under Article 37 of the GDPR.

04What information the app handles

There are three places. On the device: photos, videos, the history with the capture signals, the queue and preferences — none of this is uploaded as it is. On the Lymark server and its processors: the account, the sessions, the issuance ledger and technical access data; the coordinate and the clocks pass through the server and are not kept (item 05). In the exported file: the stamp, the verification strip and the seal. Nothing in the file lets the recipient identify who exported it; the printed code is pseudonymised data that only Lymark links to the account (“Photo code”, below).

Photographs

The image you choose from the gallery or capture with the camera, and the file exported with the watermark. A photograph may contain third parties’ personal data — see item 11.

Location

Latitude, longitude and accuracy, read from the GPS in the foreground when you tap locate, with the system permission. They serve two purposes: filling in the address and checking the capture. The raw coordinate stays in the device history; it goes to the Lymark API with each exported photo (videos do not carry it), which uses it to compute the distance to the stamped address and discards it; and it goes to the system map provider to become an address (item 05).

Date, time and weekday

Read from the device clock at the moment of capture, and editable by you on the stamp. The instants the device records at capture — the GPS fix, when you located and the export — go to the Lymark API, which checks whether the clock was within five minutes of the server and discards them.

Photo code

A sequence of fourteen hexadecimal characters printed on the stamp. When reserved by the server, the code is encrypted with a key only Lymark holds and, once decrypted, points to the pseudonym of the account that issued it; offline, the device draws the code at random. Whoever receives the photo cannot identify anyone from the code; Lymark can. That makes it pseudonymised personal data (LGPD, Articles 5, I, and 12; GDPR, Article 4(5)). It derives from no device identifier and enables no tracking across apps.

History

One entry per export, with no limit on how many and nothing dropped automatically: the file path on the device, the stamped data and the capture signals — the raw GPS coordinate, accuracy, altitude, speed, whether the location was mocked, the three clocks, platform, brand, manufacturer, model and OS version, app version and the full address in the field — and the random salt that opens the seal’s commitments. On the phone they stay in the app’s private storage, encrypted with AES-256-GCM under a key created on the device itself and kept in the system vault (Keychain on iPhone, Keystore on Android), so that only you can open them and show the signals to an expert. If the system vault does not keep that key, the same encryption continues with a key created on the device and stored separately in the app’s private storage: whoever has that folder has the key and the envelope, and the protection is weaker than the vault. The app does not write a new cleartext index in that case.

Offline queue

When the seal cannot be issued — no network, no session, server down or no quota left —, the photo does not go out without it: the original, with whatever EXIF metadata it has (which may include GPS), waits in the app’s private storage, up to two hundred photos, until the seal is issued or you remove it from the queue.

Device

On Android and iPhone, brand, manufacturer, model and OS version; on both, the app build number (for videos, the version). They go to the Lymark API with each exported photo to compute the facts and commitments of the seal, and are discarded, with one exception: the device model label, only manufacturer and model (such as “Samsung Galaxy S23” or “iPhone 15”), goes in the file’s seal, signed by the server, and whoever receives the photo sees it in the report. It is the model as the device reports it, the same on every device of that model: no serial number, OS version, build or the name you gave the device. On the web and the desktop desk these fields go as “unknown”. Where the device has a hardware key, the app creates in the chip a key that never leaves it. Every exported photo carries that key’s id (the SHA-256 fingerprint of the public part, the same for as long as the key exists) and its signature. The first one also carries the key’s verification chain: on Android, the system’s X.509 chain (with the OS version, patch level and verified boot state); on iPhone, the App Attest response, an Apple service the system contacts to create the key. The server checks the chain and returns a ticket, which stays on the device and goes with later exported photos in its place: it contains the raw public part of the key and, on Android, the serial numbers of the links in the X.509 chain. The chain, the id and the ticket identify the device, so they are treated as personal data: the server checks them and does not keep them. The app does not read IMEI, the device serial number, MAC, Android ID or advertising ID, and the chip key never goes into the file.

Preferences

Visible fields, position, size and the other watermark options.

Account

Email, account identifier, profile name (if it comes from signing in with Google, Facebook or TikTok, or if the person types it on the account screen), plan, quota and export count, at the authentication processor. It also keeps the profile picture, if it comes from signing in with Google, Facebook or TikTok or if the person chooses one on the account screen, and, with Google, Facebook or TikTok sign-in, the external account identifier. For each session, it records the IP address and the city and country inferred from it, the device type and the browser, to manage sessions and protect the account. The account’s private metadata holds the account pseudonym (eight hexadecimal characters, created at the first code reservation), the issuance ledger — the last 80 photo issuances, each with the file hash, the issuance instant and the code reservation number — and short keyed fingerprints (4-byte HMAC) of the code and hash of each charged seal, so the same photo is not charged twice.

Payment

The billing processor handles card data. Lymark does not store the card number; it keeps only subscription state (how long Pro lasts) and billing identifiers needed to cancel or invoice. On the website, the country inferred from your IP address sets the price and currency; that country is recorded on the subscription, at the billing processor, and compared with the card’s country, only to measure how much country pricing is circumvented. A mismatch blocks nothing.

Seal hash

The fingerprint (SHA-256) of the exported file and the perceptual hash of the image, sent to issue the seal and the strip and, when available, a timestamp. The photo itself is not uploaded. Neither of them can rebuild the image.

Verification strip

Painted on the edge of the exported image: the code, the issuance instant, the perceptual hash, a server tag and capture facts in bands (verdict, distance band, platform, position in the series). The seal goes in the file with the commitments of the signals and the device model label (item 04, “Device”), never with the coordinate. Nothing in the file lets the recipient identify who exported it: name, email, phone number, device identifiers and readable account identifier never go in; the printed code is pseudonymised data that only Lymark links to the account (“Photo code”).

Technical access data

IP address, date and time, and the resource requested (the method, the domain, the address without parameters and the response code), in the access logs of the site and the APIs. We keep these logs for six months, the period in Article 15 of the Brazilian Internet Civil Framework (Law 12,965/2014), confidentially and in a controlled environment with restricted access, to answer court requests and for the security of the service, and delete them afterwards. These logs do not contain the request bodies: neither the coordinate nor the clocks. The host also keeps, for a few days, the APIs’ runtime logs, with error and operation messages — without the coordinate or the clocks — that may include the country of the price and that of the card (“Payment”).

The app does not collect on-device, for the developer: identity documents, advertising identifiers, contacts, calendar, browsing history, usage metrics, crash reports. There is no analytics, advertising, attribution or tracking SDK in the app; what the site measures is in item 14. E-mail exists because there is an account; it is not read from the address book and not used for ads.

05What leaves the device, and where it goes

For each exported photo, the app sends to the Lymark API: the hash and the perceptual hash of the file; the stamp code and the photo’s position in the series; the device clocks; if you allowed location, the GPS coordinate, the accuracy, the pin of the stamped address and its source, the chosen context and whether the location was mocked; the device’s brand, manufacturer, model and OS version and the app build number; where the device has a hardware key, that key’s id and signature and, at the first capture, its verification chain, at later ones the ticket (item 04, “Device”); and, in the seal request, a random 16-byte salt. The desktop desk and the web send the same, with the device data as “unknown”. For each exported video, only the hash and the perceptual hash of the file, the code, the video’s dimensions, the platform and the app version are sent: no coordinate, clocks, device data or chip key.

With this the server computes the distance between the GPS and the stamped address, the consistency verdict, whether the clock was within five minutes of its own, and two commitments (SHA-256 of the salt with the signals). Only the result and the device model label (item 04) go into the seal and back in the file. The coordinate, the clocks, the rest of the device data, the verification chain, the key’s id and ticket and the salt are processed in memory, for the duration of the request, and are neither stored nor logged. The server does not receive the photo, the video, the address as text or the stamp fields.

To fill in the address, the app asks the operating system to turn the coordinate into an address; to place the pin of the stamped address, to turn the address into a coordinate. The system does this through its map provider — Google on Android and Apple on iPhone —, which receives the coordinate or the address text. The call starts from Lymark, which is why it is in this policy; processing by those providers follows their own policies. On the desktop desk and the web, the same lookup is done by Nominatim, Photon or BigDataCloud, which receive the position and, as with any request over the internet, the IP address of whoever asks. There, the position comes from the browser’s location service on the web and from the system’s on the desktop desk for Windows; on the desktop desk for Linux, whose system has no such service, it comes from Google’s geolocation service, which receives the Wi-Fi networks within reach of the computer and the IP address and returns the approximate position.

No photograph leaves the device through any action of the app. If you use the Share button, the image is transmitted by the destination app you choose in the system share sheet — messenger, email, cloud storage — under that app’s privacy policy.

06Permissions requested, and why

Camera

To take the photo or record the video that will receive the watermark. Requested when you capture.

Photos and media

To choose a photo or a video and to write the exported file to the gallery. The choice is made in the system picker: the app receives only the photos and videos you choose, and neither browses nor reads the gallery. The write permission is used only for writing.

Location while in use

To fill in the address and check the capture (item 05). Requested in the foreground, only while in use, and never in the background.

Microphone

When recording video with sound and when you dictate the address on this screen. It is not left on in the background.

Speech recognition

To turn the address you dictate into text, only while you hold the microphone on this screen. Transcription happens on the device. The audio is neither recorded nor sent.

All permissions are optional and can be revoked at any time in the device settings. Refusing or revoking location keeps the app working: you type the address yourself, and the seal is still issued, without the GPS facts — without the distance to the address and without the consistency verdict between GPS and address. Revoking does not erase coordinates already kept in the history; for that, delete the photos in the Gallery tab. Refusing gallery access only prevents automatic saving, and the photo can still be shared.

07Legal bases and purposes

Location is processed on the basis of your consent (LGPD, Article 7, I; GDPR, Article 6(1)(a)), given in the system permission, for the two uses in item 05: filling in the address and checking the capture. You can withdraw consent at any time by denying the permission in the device settings, without affecting the lawfulness of processing carried out before; what stops working is described in item 06.

The hash and perceptual hash of the file and the code are processed for the performance of the contract and of the feature you requested (LGPD, Article 7, V; GDPR, Article 6(1)(b)): without them there is no seal. On the same basis, the device model and OS serve to compute the facts and commitments of the seal you requested, and the model label goes in the seal so that whoever receives the photo knows which device it says it came from. The chip key, its verification chain, id and ticket are processed on the basis of legitimate interest (LGPD, Articles 7, IX, and 10; GDPR, Article 6(1)(f)), for the purpose of security and fraud prevention in the seal: without them the seal is issued the same, only without the mark that it came from a device with a hardware key. The server checks them and neither keeps them nor uses them for any other purpose; the balancing test is on record. You may object at privacy@lymark.app.

Account, session, plan, issuance ledger and payment data rely on the performance of the contract (LGPD, Article 7, V; GDPR, Article 6(1)(b)); the session records at the authentication processor also serve the security of the account, on the basis of legitimate interest (LGPD, Article 7, IX; GDPR, Article 6(1)(f)). We keep access logs for six months, the period in Article 15 of the Brazilian Internet Civil Framework, confidentially and in a controlled environment, to answer court requests and for security (LGPD, Article 7, VI and IX; GDPR, Article 6(1)(f)). Also on the basis of legitimate interest, we produce aggregate subscription statistics: the subscription intermediary’s subscription reports (item 18), an internal dashboard with the week’s counts (accounts created, first export, quota used up, checkouts opened and paid, subscribers) and the comparison between the price country and the card country (item 04, “Payment”). None of them decides anything about a person. The site measures the performance of three public pages and counts the visits to them, also on the basis of legitimate interest (LGPD, Article 7, IX; GDPR, Article 6(1)(f)), for the purpose of keeping them fast and of knowing how many visits they receive and where they come from (item 14). There is no processing for advertising, profiling or behavioural analysis, nor processing of sensitive data by the developer.

After the account is deleted, the encrypted record in item 21 is kept for the regular exercise of rights in judicial, administrative or arbitral proceedings (LGPD, Article 7, VI, with retention under Article 16) and, under the GDPR, for the establishment, exercise or defence of legal claims (Article 17(3)(e)), on the basis of legitimate interest (Article 6(1)(f)). When a deletion request is not completed and the account still exists (item 21), the record created when the request was made is kept on the basis of legitimate interest (LGPD, Article 7, IX; GDPR, Article 6(1)(f)), so that another deletion of the same account, made at the same time, does not finish without it, and it is erased at your request (item 12).

08International transfer

Account, session and payment data, the issuance ledger, the encrypted record in item 21, seal issuance requests (with the coordinate, processed in memory) and the technical data the Android app sends to the subscription intermediary are processed by processors based in the United States — Clerk, Vercel, Stripe and RevenueCat — and may be processed outside Brazil. These transfers rely on the mechanisms of Article 33 of the LGPD, such as specific contractual clauses and standard contractual clauses; under the GDPR, on the European Commission’s standard contractual clauses (Article 46(2)(c)) or, where the processor has joined it, on the Data Privacy Framework (Article 45); under the UK GDPR, on the UK addendum to those clauses (Article 46(2)(d)) or, where the processor has joined it, on the UK extension to the Data Privacy Framework. You may ask for a copy of the clauses at privacy@lymark.app. Other recipients outside Brazil are not our processors and have no contract with us. The system map provider (Google or Apple), on the desktop desk and the web Nominatim, Photon and BigDataCloud, and on the desktop desk for Linux Google’s geolocation service receive the coordinate, the address or the Wi-Fi networks within reach (item 05); since location is processed on the basis of consent (item 07), this transfer relies on your specific and prominent consent, given after being told that the map service is outside Brazil (LGPD, Article 33, VIII; GDPR, Article 49(1)(a)): in the app, this comes before the request, in the location notice (Android) and in the permission request text (iPhone); on the web, the location request is the browser’s, and on the desktop desk it is the locate button, and on both this information is only in this policy; denying or revoking the permission, or not tapping locate, stops it. The timestamping authority receives only the hash (item 18); this transfer is necessary for the service you request and relies on Article 33, IX, with Article 7, V, of the LGPD and on Article 49(1)(b) of the GDPR. The App Attest check, on iPhone, is an exchange between the device’s system and Apple, under Apple’s policy; Lymark sends nothing to Apple in that step.

This site is hosted by Vercel Inc., under items 14 and 18.

09Sharing with third parties

The developer does not sell, rent or hand over personal data for advertising or data brokerage. Contracted processors are listed in item 18. If you sign in with Google, Facebook or TikTok, those providers handle the sign-in under their own policies; the developer receives the email, the identifier and, when the provider sends them, the profile name and picture. For each session, the authentication processor records the IP address, the city and country inferred from it, the device type and the browser (item 04, “Account”). Photos and videos do not pass through any processor, because they do not leave the device; the coordinate passes through the Lymark API, hosted on Vercel, in memory only (item 05).

10Storage, retention and security

Device data stays in the app’s private storage, protected by the operating system’s isolation between apps and by the screen lock. On the phone, the history — with the raw coordinate and the salt, which let you, and only you, open the seal’s commitments to an expert — is encrypted with AES-256-GCM, with the key in the system vault (Keychain on iPhone, Keystore on Android); if the vault does not keep the key, the same encryption continues with a key stored separately in the app’s private storage, weaker than the vault, and the app does not write a new cleartext index. On Android, the system’s automatic backup is disabled, and history, queue and preferences do not go to the Google account; but direct device-to-device transfer (by cable, Wi-Fi or a manufacturer tool), from Android 12 on, still copies the app’s data to the new device: with the key in the vault, the history arrives without it and does not open; with the key in the app’s private storage, the transfer carries the key with the envelope. The exported photos arrive readable. On iPhone, what the app keeps, including the history key, is included in the device backup (iCloud or computer), under your Apple account, like the data of other apps.

On the device, retention is yours: records stay until you delete them in the app; the history never drops anything on its own; the queue keeps the original until the seal is issued or you remove it. Uninstalling the app deletes what it kept in its private storage, with two caveats on iPhone: the account session and the history key stay in the system Keychain and may survive uninstalling, and a device backup already made (iCloud or computer) remains until you delete it. Photos already saved to the device gallery belong to the gallery — it is up to you to remove them.

No system is infallible. Account data stays with the authentication processor, and the identifier also with the subscription intermediary of the Android app, under their security measures. Photos, addresses and the coordinate are not kept on any Lymark server, so they cannot leak from there. In the event of a security incident that may cause relevant risk or harm to data subjects, the developer will notify the ANPD and the data subjects under Article 48 of the LGPD and Articles 33 and 34 of the GDPR. The relevant risk to your photos and to the coordinate kept in the history remains access to the unlocked device. To report a security flaw, write to security@lymark.app.

On the server, account data is kept while the account exists and goes with its deletion (item 21). Access logs are kept for six months (item 04). Payment records from the website stay with the payment processor for the period set by Brazilian tax law, as a rule five years (National Tax Code, Articles 173, 174 and 195, sole paragraph), and we delete the customer record there by hand in the yearly review after the period ends; those from the Android app stay with Google Play, under its rules.

11When you photograph other people

When you photograph identifiable people in the course of your professional activity, you become the controller of that data in relation to the data subjects portrayed, and it is up to you to provide the legal basis, the information and the response to their rights. The developer takes no part in that processing and has no access to the images.

12Your rights

Article 18 of the LGPD and Articles 15 to 22 of the GDPR guarantee you the rights of confirmation and access, correction, deletion, anonymisation, blocking, portability, restriction of processing, objection, withdrawal of consent and information about sharing.

Photos, addresses, the history, the queue and preferences reside only on your device, and these rights are exercised directly in the app: view and delete records in the Gallery tab, remove photos from the queue, correct any field before exporting, revoke the location permission in the system settings and delete everything by deleting the account in the app or uninstalling it (on iPhone, with the caveats in item 10) — the developer cannot access, export or delete this data for you, because it does not have it. As for account data, you can view part of it on the account page, and the rest through privacy@lymark.app, and you can delete the account yourself, without asking anyone: with the button under Account, in the app, or at lymark.app/conta/excluir, which works without installing the app. What deletion erases, and what stays, is in item 21. Correction and export remain available through the contact email in this Policy.

Requests: privacy@lymark.app. You may complain to your country’s authority — in Brazil, the ANPD; in the EEA, your Member State’s supervisory authority; in the UK, the ICO; in California, the CPPA; elsewhere, the equivalent body. Item 19 lists the rights we honour outside the LGPD/GDPR pair.

The encrypted record in item 21 is also covered by these rights. Since it only opens with a key that is not on our servers, a request for confirmation or access is handled by us, off the server, after we verify that it comes from the account holder, by a reply from the email address the account uses or used, within the time limits of Article 19 of the LGPD (fifteen days) and Article 12 of the GDPR (one month). Early erasure and objection (GDPR, Article 21) can be requested through the same channel and will receive a reasoned answer; since the record exists for the exercise of rights in legal proceedings, it may be kept until the end of the period (LGPD, Article 16; GDPR, Articles 17(3)(e) and 21(1)). If the account still exists, the record of a deletion request that was not completed (item 21) is erased at your request, with the same identity verification and within the same time limits, after we also confirm that no other deletion of the account is in progress.

13Automated decisions

There is no automated decision, profiling or processing that produces legal effects concerning you, under Article 20 of the LGPD and Article 22 of the GDPR.

14About this website

This site shows no advertising, embeds no social-network buttons and does no behavioural analysis. Apart from the access logs (below), its only measurements of visitors are the performance and the visit count of three public pages, described in this item. It keeps in your browser only what is strictly necessary: the session cookies of your account, set by the authentication processor when you sign in; the NEXT_LOCALE cookie, which remembers the language you chose; and, in local storage, the light or dark theme. In the studio at lymark.app/web, the browser also keeps the stamp kit, the logos (in IndexedDB), the acceptance of the declaration and the language. None of this leaves the browser. No tracking or advertising cookies. Fonts are served from the site’s own domain. Your browser makes requests to third parties on the sign-in, account and payment screens — to the authentication processor and the anti-bot challenge it uses, to the sign-in provider you choose (Google, Facebook or TikTok) and, when you subscribe, to the billing processor — and, in the studio at lymark.app/web, to Nominatim, Photon and BigDataCloud, which receive the position to turn it into an address (item 05). Sharing is covered in item 09, and processors in item 18.

The site is hosted by Vercel Inc., which as a processor logs technical access data — IP address, date, time and resource requested. We keep these logs for six months, the period in Article 15 of the Brazilian Internet Civil Framework, confidentially and in a controlled environment, to answer court requests and for security (LGPD, Article 7, VI and IX; GDPR, Article 6(1)(f)).

On the home page (in any language), the Privacy Policy and the Terms, the site measures performance with Vercel Speed Insights, a service of Vercel Inc. (processor, item 18). A script served from the site’s own domain, with no request to any other domain, records load and response times and the visual stability of the page (the Web Vitals metrics) and, when you leave the page, switch tabs or move to another page, sends to Vercel, through that same domain: the address of the page, without parameters or fragment; the connection type the browser reports (for example, 4g); the measurements; the page element each one refers to (a CSS selector, without the page’s text) and, for interactions, the event type; and, per measurement, an identifier (the device time, in milliseconds, and a random number) and the script version. Among the data Vercel states it stores for each measurement are also the browser, the device type and system, the country and the time the submission arrived. Vercel states that the record is anonymous and that it does not collect or store information that would let it reconstruct browsing across pages or identify a visitor. The script sets no cookies or local storage and keeps no identifier across pages or visits. Like any request to the site, the submission may appear in the technical access logs in this item. There is no measurement on /verificar, on the /v decoder, or on the sign-in, sign-up and account screens (including subscription and account deletion); once you have passed through one of them, sending stops until the page is reloaded. The basis is the legitimate interest in keeping the site fast (LGPD, Article 7, IX; GDPR, Article 6(1)(f)). You may object at privacy@lymark.app and, because the measurement carries no identifier, the way not to be measured is to block the script in your browser.

On the same three pages, the site counts visits with Vercel Web Analytics, another service of Vercel Inc. (processor, item 18). A script served from the site’s own domain, with no request to any other domain, sends to Vercel, through that same domain, each time you open one of them: the address of the page, without parameters or fragment; the date and time; the script version; and, on the first page you open, the address of the page you came from, if you came from another site and your browser reports it (the browser’s referrer policy). Among the data Vercel states it stores for each visit are also the location (its documentation gives country, state and city as an example; the country comes from the IP address), the browser, the operating system and the device type, with versions. Vercel states that Web Analytics uses no cookies and identifies the visitor by a code calculated from the incoming request, valid for one day, so that the same visitor cannot be followed across days or across sites; within the same day, that visitor’s visits to the measured pages can be grouped, which is how Vercel counts visitors. Vercel also states that the record is anonymous, not tied to any individual, customer or IP address, and that it does not collect or store information that would let it reconstruct browsing across applications or websites or identify a visitor. The site sets no cookies or local storage for this and uses neither custom events nor the service’s user identification. Like any request to the site, the submission may appear in the technical access logs in this item. There is no counting on /verificar, on the /v decoder, or on the sign-in, sign-up and account screens (including subscription and account deletion); once you have passed through one of them, sending stops until the page is reloaded. The basis is the legitimate interest in knowing how many visits the pages receive and where they come from (LGPD, Article 7, IX; GDPR, Article 6(1)(f)). You may object at privacy@lymark.app and, because no identifier is stored on your device, the way not to be counted is to block the script in your browser.

15Changes to this policy

Changes will be published on this page, with a new update date. Changes that materially alter the processing of data will also be communicated inside the app before they take effect.

16Children and adolescents

Lymark is a work tool, intended for people aged 18 or over. It is not directed at children or adolescents, and it does not intentionally collect data about that audience.

17Applicable law

Brazilian law governs this policy, without prejudice to the GDPR, UK GDPR, CCPA/CPRA and any mandatory data-protection or consumer law of the data subject’s country of residence. Forum: the data subject’s domicile when consumer law so requires; otherwise Santos, Brazil.

18Processors

Who handles data on the controller’s instructions only (the timestamping authority, at the end of the list, is not a processor):

Clerk, Inc.

Account authentication: email, identifier, profile name and picture and external account identifier (if it comes from social sign-in), the private metadata for plan, quota, pseudonym and issuance ledger and, for each session, the IP address, the city and country inferred from it, the device type and the browser. United States.

Stripe

Pro subscription billing. Lymark never receives the card number. United States, and, where applicable, a Stripe entity in the billing country.

RevenueCat, Inc.

In the Android app, from the moment you sign in, it receives the account identifier and technical data about the device and the access: OS and version, device model and brand, app version, language, currency, Google Play account country, country inferred from the IP address (which it does not keep) and the date of last access. If you sign out, until the app is closed it keeps receiving the technical data under a random identifier, unlinked from the account. If you subscribe through the app, it acts as intermediary for the Pro subscription: it receives the purchase data from Google Play, notifies Lymark when the subscription starts, renews, is cancelled or refunded, and shows Lymark subscription reports. The charge itself is made by Google Play, under its own terms. When the account is deleted, Lymark cancels the Google Play subscription through it and asks it to delete this data; if that request fails, we delete it by hand. It does not receive photos, videos or the device location. United States.

Vercel Inc.

Hosting of the site and the APIs, including the one that issues the seal and processes the coordinate in memory; technical access logs (item 14); the performance measurement and visit counting of three public pages of the site (Vercel Speed Insights and Vercel Web Analytics, item 14); and the private storage of the access logs kept for six months (item 04) and of the encrypted record in item 21, in which only the encrypted envelope, the pseudonym, the dates of the deletion request and of the end of the period and the identifier of the encryption key are readable. A United States company; data may be processed outside Brazil.

Timestamp authority

Not our processor: a third party, with no contract with us, that timestamps the hash under its own rules. When the seal asks for a third-party time, only the file hash is sent, not the photo. The current provider is a public RFC 3161 service, outside Brazil; it may be replaced by a contracted authority, including ICP-Brasil, without changing this purpose.

Google, Facebook and TikTok appear as sign-in providers, if you choose to sign in with them; Google (on Android) and Apple (on iPhone) appear as the operating system’s map providers, called by the app to turn a coordinate into an address and an address into a coordinate, and Google also as the geolocation service of the desktop desk for Linux (item 05). All of them act under their own policies and never receive the photo.

19Rights outside Brazil and the EEA

On request at privacy@lymark.app we honour access, correction, deletion, portability, restriction and objection, to the extent the data exist outside the device (account, sessions, plan, count, hash, technical logs and what the Android app’s subscription intermediary keeps). What lives only on the device, you delete in the app or by uninstalling it (on iPhone, with the caveats in item 10).

California and US states with a consumer privacy law: we do not sell personal information and we do not “share” it for cross-context advertising (there are no ads). You may ask to know, delete, and opt out of sale/sharing — we already do not sell. We do not use data for automated decisions with legal effect (item 13).

Canada (PIPEDA), Australia and New Zealand (Privacy Act), Japan (APPI), Singapore (PDPA), South Africa (POPIA), India (DPDP), Switzerland (nFADP), Mexico, Argentina, Colombia, Chile and other countries with an equivalent statute: the same channel and the same practical rights, limited to what the server actually keeps.

20Scope and limits of this policy

Lymark is offered where that is lawful. We do not operate to evade sanctions, nor in jurisdictions where offering the service would be unlawful. This document is not legal advice and does not claim that every article of every national code has been reproduced. If your mandatory law is more protective, it prevails; write to privacy@lymark.app.

21Account deletion and the record we keep

You delete the account in the app (Account › Delete account) or at lymark.app/conta/excluir; on desktop, the button opens that page. Before erasing, we cancel the subscriptions: the website one, at the payment processor; the Android app one, on Google Play, through the subscription intermediary (when that is not possible, the deletion page tells you to cancel it first on Google Play). If any cancellation fails, nothing is erased, and we ask you to try again.

We then erase, at the authentication processor, the email, the identifier, the profile name, the plan, the quota, the export count and the issuance ledger, and we ask the subscription intermediary to delete its customer record; if that request fails, we delete it by hand. When you delete from the app, the exported photos in the app folder, the history with the signals and the salt, the key that encrypts it, the queue, the chip key with its ticket (on iPhone, the app forgets the key, which the system does not let it delete) and the session are also removed from the device, after the server confirms; preferences and language stay. When you delete from the website, the device is not reached: delete the history in the app or uninstall it (on iPhone, with the caveats in item 10).

For up to five years, a single encrypted record. If the account ever received a pseudonym (as a rule, with the first stamp code it requested), we keep a record linking the pseudonym printed in your photos’ codes to the email, the profile name and the account identifier, with the numbers of the last code reservation and the last issuance and the dates of the deletion request and of the end of the period. Nothing else: no plan, no billing, no photos, no location, no ledger. Without this record, deleting the account would make every photo it ever stamped anonymous forever, even in the face of a legitimate court order. If the account never received a pseudonym, there is no record. If a deletion request is not completed and the account still exists, the record created when that request was made may be kept for the same period and under the rules in the next paragraph; the record created by a new deletion request replaces it, and, while the account exists, you can ask for that record to be erased sooner (item 12).

The record is encrypted with a key whose private part is kept off our servers, offline, and no one on the server opens it. It is only opened to comply with a court order or a request from an authority with legal power to demand it, or to answer your own request as the data subject (item 12) — never at the request of other private parties. The stored pseudonym is never given to another account. The five-year period follows the limitation period for claims for damage caused by a service (Brazilian Consumer Protection Code, Article 27); at its end, a daily sweep deletes the record.

Deletion does not reach the copies you saved to the system gallery or sent to someone. Files already exported keep the seal and the strip, and keep verifying after the account is gone.

See also the Terms of Use.