Trust
A record is only worth something if you can check it
osmarks exists to hold numbers two parties agreed on. So we keep as little as possible, show how everything is signed, and make it possible to catch us if we ever changed anything.
What we keep, and what we never see
Counts, not contacts
In a shared record each side turns its list into fingerprints on its own computer, with a key only the two of you hold. We receive the fingerprints and the counts. We never receive the names or email addresses of anyone you contacted, and we can't work them out.
Your sign-in email
Your email address, so we can send you sign-in codes. A client who confirms a single project gives their email so we can check it's really them. There are no passwords to leak.
No trackers
No advertising or analytics scripts, no third-party fonts or widgets. Pages load only from osmarks.com. Cookies are used only to keep you signed in.
How anyone can check a record
Signed
Every confirmed month, confirmed project and archived web page is hashed (SHA-256) and signed with our Ed25519 key, published at /key.
Chained
Each entry in the public log includes the fingerprint of the entry before it, so removing or editing one breaks every entry after it.
Copied out
Once a day the whole log is saved to the Internet Archive, which we don't control. If we ever changed an entry, the old copy would show it.
Step by step, with code: check a record yourself and the record format.
Who processes data for us
| Company | What for | What they get |
|---|---|---|
| Cloudflare | Hosting and database | Everything osmarks stores, encrypted at rest |
| Resend | Sending sign-in codes and record emails | The recipient's email address and the message |
| Waffo.com Limited | Payments, as Merchant of Record | What you give at checkout. We never see card details |
| Internet Archive | Independent public copies | Only public pages and the public log, which contain no personal data |
Your data, your call
- Download everything you've recorded at any time, as a file you can verify without us.
- Hide any record from your public page, or unpublish the page.
- Delete your account. Fingerprints already in the public log stay, because removing them would break the chain, but they contain nothing readable about anyone.
- Anyone can write to support@osmarks.com to see, correct or delete their data. We answer within 30 days. See the privacy policy.
Security
- HTTPS only. Every page sends a strict content security policy, and pages that handle records run no scripts but our own.
- Sign-in is by one-time code to your email, with limits on how often codes can be tried.
- The signing key's public half is published, so a forged signature can be spotted by anyone.
- Found a problem? Email support@osmarks.com with "Security" in the subject. Please give us time to fix it before telling others. Machine-readable contact: security.txt.
Who runs osmarks
osmarks started in October 2026 and is run by a very small team. If something goes wrong that affects your data, we will tell you by email and note it on this page.