Privacy Policy

Last updated: October 15, 2026

Reconize ("the App") is developed by Lil Dog Productions, LLC ("we", "us", or "our"). We are committed to protecting your privacy. This Privacy Policy outlines our strict data collection policies and practices.

1. Local-First by Design

We believe your content and identity belong solely to you. Reconize is built to be a local-first application. Your media is processed entirely on your Mac, and the only things that ever leave your device are optional features described in Sections 2 and 3 (name confirmation, the Reconize registry listing, Google Drive delivery and Reconize Links), each off until you turn it on, and each engineered to hold as little as possible. In particular:

2. Network Access

The App makes network requests for these purposes, all optional:

3. Name confirmed (Optional)

Reconize lets you optionally verify your identity, so that files you choose to sign carry a name-confirmed credential from our trusted certificate instead of a self-declared one. You can verify with Sign in with Apple, with Google, or by proving control of your website domain (a DNS or file token you publish). Verification is entirely optional; the App is fully functional without it, and files signed without it are still signed, still carry the hidden mark, and still show if they were changed.

What is sent when you verify. The sign-in happens directly with Apple or Google. The App then sends our verification relay (relay.reconize.me) three things: the provider's signed token proving your address (or, for a domain, the token check happens server-side), a public key your Mac generates for this registration (the private half never leaves your Keychain), and your App Store transaction proof, used once to confirm a genuine copy of the App.

What the relay keeps. The relay's verification record is deliberately minimal: your registration public key; the provider name (Apple, Google, or domain); a salted one-way hash of the confirmed address or domain, from which the address cannot be recovered; the App Store transaction identifier; registration timestamps; revocation status; and daily signing counters used for abuse prevention. The relay does not store your email address in readable form, your media, your file names, or the content of anything you sign. (Your display name is published only if you turn on the optional registry listing described below.)

Signing with a confirmed name. Each sign with a confirmed name sends the file's credential bytes (a cryptographic structure, not your media) to the relay, which signs and returns them. These bytes are processed to produce the signature and are not retained. The relay keeps standard operational logs (request timing, status, device identifier) without file content.

Your email on signed files. By default, your confirmed email is not shown on files you sign; files show your name, handle, and that your name is confirmed. Showing the email is a separate, per-profile opt-in switch in the App, off by default, and it only takes effect on files signed through the trusted route. Apple's Hide My Email addresses are fully supported and count as confirmed.

What stays on your Mac. The confirmed account details shown in the App (the address on your profile, your channels) are stored locally on your creator profile, as with everything else in Section 1. OAuth tokens are used for the verification and are not stored.

The Reconize registry (optional listing). Separately from signing with a confirmed name, you can choose to list a creator profile in the Reconize registry (Profiles → “List me in the Reconize registry”). It is off by default, is included with Reconize Pro, and exists so that a copy of your work can still be traced back to you after a platform strips its Content Credentials. When you turn it on, the App publishes to our relay a minimal public record: your creator display name, which channels you have proved (as bindings), and, only if you also turn on handle publishing, those channels’ handles. While a profile is listed, each file you sign also submits that file’s hidden mark (a short code) and its content fingerprint, together with its media type and signing time. A content fingerprint is a compact summary of what the file looks or sounds like: for a picture, 256 bits plus the positions of up to 768 distinctive points with a 256-bit description of each (so a cropped or rotated copy can still be matched); for audio and video, a few bits for each fraction of a second of the first five minutes, and for video also up to 96 distinctive points from one frame per second of the first 32 seconds (so a cropped, reframed or screen-recorded copy can still be matched). It is computed on your Mac, cannot be turned back into your media, and lets a copy be found even after someone strips the mark. We never receive your media, your file names, or the file’s contents, only the mark and the fingerprint. Anyone verifying a file can then look the mark or the fingerprint up to resolve it to your listed name and signing date; a file that is not in the registry resolves to no one. Turning the listing off (or choosing Disconnect and Delete Data) removes your registry record, its marks and its fingerprints. Signing and verifying never depend on the registry.

Reconize Links (optional, included with Pro). When you send copies with Reconize links turned on, the App asks our relay to create one link for each person at go.reconize.me. For each link the relay stores: the address of that person's Drive copy, the name you gave the send (it is shown on the link page), the expiry date, whether the link is on or turned off, and an identifier tied to your device. It never receives the file. If you turn on Email code, it also stores a salted one-way hash of that person's email address, never the address itself.

What is recorded when a link is opened. The relay records the time, whether the person viewed the link page or opened the file, and a coarse device type (phone, computer, or a link preview such as a chat app fetching the page). It does not record IP addresses or the full browser identifier; our link host removes them from its logs. Only you see these events, in the App's History. Events are deleted after 90 days. A link's record is deleted 90 days after the link expires or you turn it off, and right away if you choose Disconnect and Delete Data.

Email codes. On a link with Email code on, the person types their email address on the link page. If it matches the stored hash, we email them a six-digit code through our email provider, Postmark, which processes the address to deliver the message and keeps the message for 45 days. Open and click tracking are turned off. The relay does not keep the typed address, only a hash of the code, which expires after 10 minutes. After a correct code, the person's browser keeps a cookie on go.reconize.me for that one link for 24 hours, so they are not asked again. If you received a Reconize link and have a question about it, ask the person who sent it, or email legal@reconize.me.

Sharing. We do not sell or share any of this information. Your identity appears inside a file's Content Credentials only when you sign that file.

Disconnecting and deletion. You can disconnect your identity at any time in the App (Profiles → Disconnect), which stops signing with a confirmed name from your device and keeps your verification record so you can reconnect instantly. To permanently delete the record instead, choose Disconnect and Delete Data in the same dialog: your device sends an authenticated deletion request and the relay erases its record entirely (the device key fingerprint, the hashed identity, and the App Store transaction identifier). If you no longer have the Mac, email legal@reconize.me and we will remove it promptly. You can also revoke Reconize's access from your Google Account at myaccount.google.com/permissions or in your Apple ID settings under Sign in with Apple.

YouTube channel connection. If you choose to connect a YouTube channel to prove you control it, Reconize requests the read-only scope https://www.googleapis.com/auth/youtube.readonly and makes a single API call, channels.list with mine=true, to read only your own channel's ID and handle. Reconize does not access your videos, playlists, subscriptions, comments, analytics, or any other account's data. The channel ID and handle are stored only locally on your device (on your creator profile) and are sent to our relay only if you list this profile in the Reconize registry (Section 3). The OAuth access token is used once for this read and is then discarded. You can disconnect the channel in the App at any time (Profiles → the channel's remove control), or revoke access at myaccount.google.com/permissions.

Instagram account connection. If you choose to connect an Instagram professional (Business or Creator) account to prove you control it, Reconize uses the Instagram API with Instagram Login and requests only the instagram_business_basic permission, reading only your account’s username and account ID. Reconize does not access your media, insights, stories, messages, comments, or any other account’s data. The username and account ID are stored only locally on your device (on your creator profile) and are sent to our relay only if you list this profile in the Reconize registry (Section 3). The OAuth access token is used once for this read and is then discarded. You can disconnect the account in the App at any time, or revoke Reconize’s access in your Instagram settings under Apps and Websites. Reconize’s use of Instagram and other Meta Platform Data adheres to the Meta Platform Terms and Developer Policies, including their limited-use requirements, and is never used to develop, train, or improve AI/ML models.

Threads account connection. If you choose to connect a Threads account to prove you control it, Reconize uses the Threads API and requests only the threads_basic permission, reading only your account’s username and user ID. Reconize does not read, publish, delete, or access your Threads posts, replies, mentions, insights, or any other account’s data. The username and user ID are stored only locally on your device (on your creator profile) and are sent to our relay only if you list this profile in the Reconize registry (Section 3). The OAuth access token is used once for this read and is then discarded. You can disconnect the account in the App at any time, or revoke Reconize’s access in your Threads settings under Account → Website Permissions. Reconize’s use of Threads and other Meta Platform Data adheres to the Meta Platform Terms and Developer Policies, including their limited-use requirements, and is never used to develop, train, or improve AI/ML models.

Behance profile connection. Behance does not offer sign-in to new apps, so to prove a Behance profile is yours, Reconize shows you a short code (made from your Behance username and this Mac's device key) to paste into your public Behance profile's About section. When you choose Check, our relay reads your public profile page on behance.net once, looks for the code, and records only that this device proved control of that username, in the same binding as the other accounts above. Reconize does not sign in to Behance or read anything that is not public, and it stores no Behance data other than the username. You can remove the code from your profile once the account is confirmed, and disconnect it in the App at any time.

Google API Limited Use. Reconize's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Reconize does not use Google or YouTube user data, raw, aggregated, anonymized, or derived, to develop, train, or improve any generalized artificial-intelligence or machine-learning models; the only Google data Reconize reads is your own YouTube channel’s ID and handle, used solely to display your confirmed channel, and, if you connect Google Drive, the files Reconize itself uploaded to your Drive (the drive.file permission), used solely to deliver and share the copies you send. YouTube data is additionally governed by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

4. Purchases

Reconize offers Reconize Pro, an optional auto-renewable subscription ($5.99 per month or $49.99 per year), through Apple's App Store. All payment processing, billing, and refunds are handled entirely by Apple under Apple's own privacy policy. We never see or receive your payment details. Your purchase status is delivered to the App on-device by Apple's StoreKit framework. We do not maintain user accounts; the only server-side records we hold are the minimal verification records, and, if you turn it on, the optional registry listing, described in Section 3, which include the App Store transaction identifier (never payment information) when you verify your identity.

5. No Third-Party Trackers or Analytics

The App does not integrate any usage trackers, advertisement SDKs, analytics packages, or silent crash-reporting tools that transmit info about how you use the app or what files you sign.

6. Children's Privacy

The App collects no personal information beyond the optional, minimal verification records described in Section 3, and it is not directed to children. We do not knowingly collect or maintain any information from children under the age of 13.

7. Our Website

This policy governs the App. Our website (reconize.me) is served through a standard web host that may retain basic, non-identifying server logs (such as IP address and request time) for security and reliability. We do not run advertising or analytics trackers on the site.

Checking a file on our website: the check at reconize.me/verify runs in your browser and never uploads your file. When a file has no intact Content Credentials (or when you choose Look it up for a file that has them), your browser computes the file’s content fingerprint (described in Section 3) and sends only that fingerprint to our relay, which answers with the listed name and signing date of a matching registered file, if any. We do not keep the fingerprints you look up; our host may log the request briefly for security, like any web request. For a file with Content Credentials, your browser also sends a one-way hash of the file’s signature (never the file) to check it against our public signing log (Section 2); we do not keep these lookups either.

Free code claims and the update list: if you requested a free unlock code (that offer ended in September 2026) or join the update list on our site, we collect the email address you submit. It is stored with our infrastructure provider (Upstash, a managed data store) and used for exactly two purposes: delivering your code (and showing it to you again if you return), and occasional product-update emails, each of which includes an unsubscribe link. We never sell, rent, or share this list. To have your address deleted, email legal@reconize.me and we will remove it promptly.

8. The Reconize Browser Extension

The Reconize browser extension checks the Content Credentials of images, video and audio you choose to check, inside your browser. The file is read and checked on your device and is never uploaded to us. The extension does not collect, store or sell personal information, and it has no analytics or tracking.

To do its job it makes these requests, none of which carry personal information: it downloads the media you ask it to check from the address where it is published (without your cookies, and never from a private network address); it downloads Reconize's public registry list and our public signing key, at most every few hours, so it can show whether a channel's owner confirmed their name with Reconize (the lookup itself happens on your device, so we never learn which pages you visit); and, when a file carries a Reconize name credential, it downloads our public list of withdrawn credentials to check whether that name is still confirmed; and, the first time you ask it to look for a hidden mark, it downloads the mark reader (a model file of about 67 MB) from our server once, so images and video frames are read for a Reconize mark on your device and never sent to us; and, only when you press Look it up on a picture that has no Content Credentials, it sends a short fingerprint of that picture (numbers describing what it looks like, computed on your device, never the picture itself) to the Reconize registry to ask whether a creator signed a matching file. The page address is not sent, and we do not store the fingerprint or connect a lookup to you; our log records only that a lookup happened and whether it matched. Like any web request, these reach our servers with your IP address, which our host may log briefly for security. The extension stores only a cached copy of that public registry list, the mark reader, and small settings, in your browser's local extension storage.

9. Your Rights in the European Economic Area, United Kingdom, and Switzerland

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and the equivalent UK and Swiss laws give you specific rights over your personal data. Because Reconize is local-first, the only personal data we hold about you is the optional, minimal verification record described in Section 3, the optional Reconize registry listing you choose to publish (Section 3), the records of any Reconize Links you send or receive (Section 3), and, if you opt in on our website, your email address (Section 7). This section explains how those laws apply.

Data controller. The controller responsible for the limited personal data described in this policy is Lil Dog Productions, LLC, Los Angeles, California, United States. You can reach us about any privacy matter at legal@reconize.me.

What personal data we process, and our lawful basis. We rely on the following lawful bases under Article 6 of the GDPR:

Trusted timestamp requests (Section 2) transmit only a cryptographic hash and contain no personal data. We do not subject you to automated decision-making that produces legal or similarly significant effects, and we do not use your personal data to develop, train, or improve any artificial-intelligence or machine-learning models.

Your rights. Subject to the conditions in the applicable law, you have the right to: access the personal data we hold about you; have it rectified if it is inaccurate; have it erased; restrict or object to its processing; receive it in a portable format (data portability); and withdraw consent at any time, without affecting processing already carried out before you did so. Because our verification record stores a salted one-way hash rather than your address, several of these requests are satisfied simply by deleting the record, which you can do yourself at any time.

How to exercise your rights. The fastest route to erasure is built into the App: choose Disconnect and Delete Data in the Profiles dialog, and your device sends an authenticated request that erases the verification record entirely. For the website email list, use the unsubscribe link in any email. For anything else, or if you no longer have the Mac, email legal@reconize.me and we will respond within the timeframe required by law (normally within one month).

International transfers. Our verification relay and email infrastructure are operated in the United States, so the limited data described above is processed there. Where personal data is transferred out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, reinforced by the fact that the data we hold is minimized by design: a salted one-way hash rather than your address, and no media or file content.

Retention. We keep your verification record only for as long as your identity remains connected; when you delete it, in-app or by email, it is erased. Your registry listing, its marks and its fingerprints are kept only while the listing is on; turning it off, or deleting your data, removes them. Link open events are kept for 90 days, and a link's record for 90 days after the link ends. Operational logs are short-lived and truncated. Website email addresses are kept until you unsubscribe.

Right to complain. You have the right to lodge a complaint with your local data protection supervisory authority. In the EEA you can find yours through the European Data Protection Board (edpb.europa.eu); in the UK, the Information Commissioner’s Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch). We would welcome the chance to address your concerns first, so please consider contacting us before you file.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected by the "Last updated" date above; continued use of the App or Site after an update constitutes acceptance of the revised policy.

11. Contact Us

If you have any questions or feedback regarding our privacy practices, please contact us at: legal@reconize.me