Proof workloads stay on customer compute.
TinyZKP.com is designed as a static product site. Guard proving, resume, and verification are local processes and do not send workloads, witnesses, checkpoints, scratch files, or proofs to TinyZKP.
Website delivery
Cloudflare Pages delivers this static site and may process ordinary request metadata such as IP address, user agent, requested URL, timestamp, and security signals under its own infrastructure terms. The site contains no custom contact form, no customer account, no password, no hosted proving or verification service, and no advertising or third-party analytics tag. It does operate one TinyZKP database for the free resource estimator, described in full below.
Resource estimator
POST /v1/estimate and POST /v1/keys are free, unauthenticated-by-default endpoints served by this site. They write to a TinyZKP-operated Cloudflare D1 database. The complete machine-readable record of every table and column written is published at privacy-disclosure-v1.json, and an automated check refuses to ship a change that writes anything this notice does not name.
What an estimate request records. The shape of the request and nothing else: the hour it arrived (truncated to the top of the hour, never a precise timestamp), a digest of the request shape, the declared field and extension degree, the trace width and row count as coarse buckets rather than exact values, eight boolean AIR feature flags, whether the configuration is provable today, and any blocking reason codes. Requests that are rejected as malformed record only the hour and the reason code.
What a key request records. A minted key is stored only as a SHA-256 hash, alongside a second, independently-random identifier and the hour it was minted. The email address you submit is checked for shape and then discarded — there is no email column, no separate table, and nothing in this repository persists it. There is no account, password, dashboard, confirmation email, or recovery flow; a key raises your hourly rate ceiling and lets you be counted once as a distinct organisation.
How callers are distinguished. Each row carries either an opaque key identifier or a hash derived from your IP address, never both. That IP hash is not anonymous. It is an HMAC computed with a salt that is a hardcoded constant in this project's public source, and the space of possible IP addresses is small enough to search exhaustively, so anyone with the database could recover the original address. We describe it as a coarse de-duplication token because that is all it is; it is not an anonymising transform and you should not treat it as one. The raw IP address is never itself written.
What is never recorded. Your workload, witness, trace, AIR, checkpoint, scratch data, proof bytes, file paths, raw request body, raw bearer key, or email address.
Why this exists. To evaluate a demand threshold that was committed to in advance, and to bound abuse of a free service. It is not used for advertising, profiling, automated decisions about a person, or contacting callers, and it is not sold or disclosed to third parties.
Retention. Estimate records, rejection records, and rate-limit counters are deleted after 180 days. The demand measurement reads a trailing 90-day window, so this keeps twice what is used and no more. Deletion runs from the site itself, alongside ordinary writes, because this platform has no scheduled task to depend on. Minted keys are the one exception and are not deleted on a timer: removing a key would revoke your access with no notice and no way to restore it, since we hold no email to contact you.
Merchant checkout
When commerce.json states that checkout is enabled, the merchant of record processes purchase identity, billing, tax, payment, receipt, renewal, cancellation, and refund data under the merchant's disclosed privacy terms. TinyZKP must not receive full payment-card data.
License activation
Each exact Guard release contacts Lemon Squeezy once during activation. The request sends the license key and identifies the Guard version in its User-Agent; Lemon Squeezy and ordinary network infrastructure may also observe ordinary request metadata such as IP address and time. It does not send the workload, witness, scratch, checkpoint, or proof. Successful activation is stored locally with owner-only permissions; proving, resume, verification, and status checks for that activated release work offline.
Support
Public GitHub issues and private vulnerability reports are processed through GitHub. Do not submit personal data beyond what is necessary, and never submit proof inputs, witnesses, checkpoints, scratch data, proofs, tokens, environment variables, or license keys.
Customer responsibilities
Customers control their workload, scratch, output, diagnostics, host logs, retention, backups, access controls, and deletion. Scratch may contain sensitive intermediate data and should be protected accordingly.
Notice identity
The production privacy notice must identify the legal controller, contact method, purposes and bases, data categories, processors, transfers, retention, deletion procedures, and applicable rights. Checkout remains disabled until those details are supplied and approved.