Digital evidence
What the page said,
on the day it
said it — and checkable.
Tito Digital Evidence is an iPhone and iPad app that browses inside itself, captures what a site displayed, and closes the session between two instants certified by an authority that has nothing to do with us. What comes out is a folder that a third party can verify without this app and without believing anybody.
Browsing, capturing, recording, hashing, timestamping and the certificate are always free.
The certificate prints these lines. They run on any Mac with nothing installed, offline, on the folder alone.
A screenshot cannot say where it came from
Anyone can produce an image of a page that never existed. The weak point of a screen capture was never the clock: it is the provenance of what is on the screen. This app answers that by never letting the screen be the only witness.
The browser is the instrument
You navigate inside the app, in a data store created for that session — no cookies carried over, no autofill, no extensions, and the effective user agent printed in the certificate.
The connection is recorded
For each navigation the app keeps the effective URL, the redirects it went through, the status code, the response headers, the server's certificate chain with issuer and validity, the address it connected to, and the transport version negotiated.
Two certified instants
A token from an RFC 3161 authority is obtained before the first navigation, and another over the session's root when it closes. The whole session lies between two instants that an outside party certified.
A tree, not a pile
Every artifact gets two digests; the digests build a Merkle tree; the root is what gets timestamped, and the session's record is signed by a key generated inside the Secure Enclave, which cannot be taken out of the device.
The session is the unit
Not the file. A session carries the addresses you asked for and the ones that were reached, the visible-region images, the whole page as a paginated document, the rendered source of each page, the screen recording with the audio the page played, the network context of every navigation, and the timeline of what happened and when. One folder, numbered in a single unbroken run, with a plain-text manifest tying every file to its two digests, its size and the instant it was written.
It always captures
No network, a wrong clock, an authority that does not answer — it captures just the same. What changes is the level of temporal confidence the record declares, never whether the work can be done.
Offline, the instant is anchored to a token obtained earlier and to the device's monotonic clock, which is what makes a clock moved by hand detectable. The definitive timestamp arrives on its own when the network returns, and the certificate is reissued. No loss is silent: every degradation of quality, of metadata or of confidence is stated on the screen and written into the record.
The original is never touched
No editing, no cropping, no filters, no colour correction, no recompression. The app does not alter the rendering of the page either, which rules out reader mode, ad blocking, translation, imposed themes and font adjustment. Nothing is imported from outside: an artifact is born inside the app, in real time, or it does not exist.
A certificate anyone can check
Each session produces a PDF/A-2b certificate with the identification, the procedure, the timeline, the addresses, the network context of each navigation, both digests of every file, the root of the tree, the state of each timestamp and — printed in full — the commands that verify all of it. The package carries the timestamp authority's own certificates, so verification runs disconnected and goes on running if the service is ever switched off. A certificate travelling inside the package it validates confirms the chain and not the trust in it, and the document says so in as many words.
What it refuses to promise
This paragraph is reproduced without variation on the first page of every certificate, in the language of the record:
This document is not an electronic authentication of the captured content and does not attest to its truthfulness. It is the technical record of a capture. It describes what was displayed on the device, when, and under which network circumstances, and it allows anyone to verify, independently of this application, that the resulting files remain exactly as they were produced. It further supports that this content was delivered to this device by a server presenting a valid certificate for the address navigated to, within the interval between two instants certified by a third party, in the navigations where the server chain could be collected, which this document states one by one. If the evidence is challenged, the elements printed here are intended to assist expert examination. Whether the displayed content corresponds to the reality it purports to show, including the possibility of staging, editing, fabrication or a forged page, is beyond what any capture can establish.
No legal provision of any jurisdiction is cited, in the app or in the certificate. The document describes technical facts and declares its own limits; the legal weight of those facts belongs to whoever invokes them.
Procedures, identification and an audit trail
Sessions can be filed under a procedure. The organisation, the unit, the person responsible and their registration are written once and frozen by value inside each session, so changing them later does not touch what was already produced. An audit panel gathers the deletions and every timestamp attempt, with its instant, its result and its raw diagnosis — because deletion allowed without a record is deletion without a trace.
The price
Browsing, capturing, recording, hashing, timestamping, issuing the certificate and reading everything inside the app are free and unlimited. The free plan limits one thing only: taking the session folder out of the app, which it allows once — one export, not one a month. That one is there to be verified end to end before anybody decides anything, and exporting that same session again, including handing it over once more after the definitive certificate replaced the provisional one, costs nothing. Pro, monthly or yearly, lifts that limit. There is no advertising and no third-party SDK.
Privacy you can check
No analytics. No telemetry. No third-party crash reporting. No tracking. No account, and no server of ours anywhere. What travels is what your browsing asks for, and a digest to the timestamp authority — which is not data about anybody and cannot be turned back into a file. The full policy is here.