Trust Center
Written for the person looking for the problem.
Mechanisms, not adjectives. How verification actually works, where money sits, who else touches your data, how long evidence lives, and what has gone wrong so far.
Verification
Two locks decide. The third only advises.
| Lock | How it is decided | Can it release money? |
|---|---|---|
| Place | GPS at capture against the requested geofence. Deterministic arithmetic. | Yes — it gates payment. |
| Time | Capture timestamp against the requested window. Deterministic arithmetic. | Yes — it gates payment. |
| Content | A vision model against the Recipe checklist. | Never. It is advisory only. |
The sentence that matters most on this page: no model moves money. A content verdict can withhold auto-approval, never grant payment on its own — and no verdict at all is not treated as a pass. It routes to a human. If the model is unavailable, confused, or talked into something by text inside a photograph, the worst outcome is that a person reviews the Tag.
Money
This is not escrow, and we do not say it is.
The customer is charged when the Tag is thrown. The Partner is paid when the locks pass. We are not a licensed escrow agent and we do not hold funds as a neutral stakeholder — describing it that way would be a regulatory claim we are not entitled to make.
Every movement is an append-only ledger entry. Entries are never edited or deleted; a correction is a new entry that references the old one, so the history of any Tag can be reconstructed exactly.
Every endpoint that moves money requires an idempotency key. Retrying a request returns the original result rather than charging twice — including when the first response was lost in transit.
A refused request is never a charged request. A spending limit, a policy block, a held mission awaiting human approval, a failed lock: in all of them the card is untouched.
Subprocessors
Everyone else who touches it.
| Who | What for | What they see |
|---|---|---|
| Stripe | Card payments and Partner payouts | Payment details, amounts. We never see or store a card number. |
| Supabase | Database, authentication and evidence storage | All platform data, including proof photographs. |
| Vercel | Application hosting | Request metadata and logs. No evidence is stored here. |
| Cloudflare | Content verification (Lock 3) and the scheduler | Proof photographs at the moment of verification. |
Our verification provider was chosen on one criterion before price: it does not train on customer content. Proof photographs are pictures of people’s homes and businesses, and a free tier that improves a model with them is not free.
Retention
How long things live.
| What | How long | Why |
|---|---|---|
| Proof photographs | While the Tag is live, then per your account settings | They are your evidence, not ours. |
| Evidence hashes and the ledger | Indefinitely | An append-only financial record that cannot be rewritten later. |
| Partner location fixes | With the Tag they belong to | They exist to prove somebody was where they said. |
| Signed evidence links | 15 minutes | Long enough to read, short enough not to leak. |
The people doing the work
What we will not send anyone to do.
- Enter private property, open anything, or cross a barrier or posted sign.
- Confront, follow, question or surveil a person.
- Present themselves as an inspector, official, or employee of anyone.
- Perform regulated professional work — medical, legal, structural or financial assessment.
- Handle dangerous materials, or anything requiring a licence.
These are enforced, not encouraged. An unsafe request is refused with 422 before anything is charged, and safety is not a field an agent can override at any price. A Partner who stops early because a location felt unsafe has done the right thing, and the platform is built to say so rather than to penalise them.
A Partner’s real identity and contact details are never exposed to a customer. A Corner sees a stable pseudonymous id and a reliability score.
Incident history
Empty, and here is exactly why.
There are no incidents to report because this platform has not yet processed a live customer Tag. An empty list here is not a track record, and we would rather say so than let the blank space imply one.
When there is something to report, this is where it will appear, and it will include:
- What happened, in plain language, and when we learned of it.
- Who was affected and how we know the boundary of that set.
- What we did, what we changed, and what we have not fixed yet.
We will not quantify fraud rates, uptime or accuracy until there is enough real activity for those numbers to mean something. A percentage derived from a handful of events is a number a buyer would act on, and it would be worth nothing.