Support

Write to support@titoprivacyai.com. Say which device and which version of iOS you are on, and what you expected to happen.

Questions that come up

What exactly leaves my device?

What your browsing asks for, which goes to the sites you navigate to and is the activity itself. And the digest of the session's root, to the timestamp authority — only the digest. Nothing else, unless you turn on the approximate address, which sends the coordinates to Apple. That switch is off until you turn it on.

How does someone else verify the folder I send them?

By running the commands printed in the certificate. The files are checked with shasum -a 256 against the manifest, the tree is rebuilt from those digests, the timestamp tokens with openssl ts -verify against the authority's certificates that travel in the folder, and the signature with openssl dgst -verify. All of it runs offline, on a Mac with nothing installed beyond Apple's own command line tools, without this app and without trusting us.

Why an embedded browser instead of a screen recording?

Because the browser can say what the recording cannot: the effective address, the redirects, the status code, the response headers and the server's certificate chain. A recording of the phone's screen shows the page; it does not show that the page was delivered by a server holding the key for that name.

A site refuses to open in the app.

It happens, and it is worth knowing before you are in the middle of the work. Some sites refuse embedded browsers outright, and signing in to accounts with the large providers is often blocked by their policy. For public content, which is most of this work, it works.

Is a session still good without a timestamp?

Yes, and it says so. The session is recorded, hashed, chained and signed all the same, its certificate is issued announcing that it is provisional, and it declares a lower level of temporal confidence. The app keeps trying in the background, and when the token arrives the definitive certificate is issued. If the automatic issue fails — the device was locked, the app was killed — the session offers a button to issue it by hand.

Why two digests for every file?

SHA-256 is the algorithm of the tree and what shasum -a 256 produces. SHA3-512, of a different constructive family, is a second witness to the same file. It does not enter the tree and it is not a parallel path of verification; it is there for the day the first one is doubted.

Does the recording capture my notifications?

It can. The recording captures the device's screen, through the system's broadcast extension, which is what makes the audio the page plays recordable at all. A notification arriving mid-session enters the image, and so does anything else on screen if you leave the app. The app tells you to set a Focus before starting; it advises and does not impose, because it does not touch your device's settings.

What does the free plan limit?

Only taking a session out of the app, and it allows that once: one export, not one a month. It is counted per session, so exporting that same session again — including handing it over once more after the definitive certificate replaced the provisional one — costs nothing, and a share sheet you cancel spends nothing. Everything else is free and unlimited.

My subscription lapsed in the middle of the work.

You go on capturing exactly as before. The limit is at the exit and never at the capture: a lapse drops you to the free plan and takes nothing away from the sessions you already have, which stay readable and verifiable, and which can still leave the app again if they already left once.

I deleted a session by mistake.

It cannot be recovered, and the deletion is recorded in the audit panel with its instant and the identifier of what was removed — because what a series proves depends on knowing that one of its items was taken out of it.