BitcoinProof

BitcoinProof Privacy Policy

Version 1.0 — Last updated 2026-10-22 — Published at bitcoinproof.io/privacy

The specific third parties this policy relies on — our hosting, email, and payment providers, and the default block explorer the desktop application queries — are named in Annex A, which carries its own revision date. Updating Annex A to reflect a change of provider is not a "material change" to this policy under section 11 and does not change the Version above.

This Privacy Policy explains how BitcoinProof processes personal data. It applies to two distinct contexts, which we describe separately throughout: (i) the bitcoinproof.io website, where you can buy a licence and manage your account; and (ii) the BitcoinProof desktop application, which you install on your own computer. The architectural separation between the two is deliberate and material — the desktop application does not send your wallet data, identity fields, or report contents to us.

1. Who we are (Controller)

The data controller is Wenze van Klink, trading as BitcoinProof, a Dutch sole proprietorship (eenmanszaak) registered with the Dutch Chamber of Commerce (KVK) under number 91404983, with business address Snijbiet 11, 2371DR Roelofarendsveen, NL VAT (BTW) number NL004888591B14.

Contact: privacy@bitcoinproof.io
General support: support@bitcoinproof.io

We have not appointed a Data Protection Officer; one is not required under Article 37 GDPR for the processing operations described below. The Dutch Autoriteit Persoonsgegevens (AP) is our lead supervisory authority.

2. The two contexts at a glance

Website (bitcoinproof.io) Desktop application
What it is Marketing site, account portal, purchase flow, licence-key delivery Local Bitcoin verification engine installed on your computer
Personal data we receive Email, purchase metadata, IP address (both for security logging and, at checkout, as EU VAT location evidence), browser user agent None about you as a person — no wallet data, no descriptors, no UTXO data, no identity fields, no reports
Outbound calls from your computer Standard HTTPS while you browse (a) script hashes to the public Bitcoin block explorer you select (the shipped default is named in Annex A and shown in the application before any scan); (b) HTTPS GET to bitcoinproof.io/licenses.json for licence validation; (c) HTTPS GET to bitcoinproof.io/version.json for update check
Where data is stored Our hosted infrastructure (EU region; the hosting provider is named in Annex A) Your local machine only

The two flows are disjoint. The desktop application does not communicate with us about you. Your email is never sent to the desktop application; the desktop application never sends anything to us tagged with your identity.

3. The website (bitcoinproof.io)

3.1 What we collect, why, and the lawful basis

# Data Purpose Lawful basis (Art. 6 GDPR) Retention
W1 Email address Account authentication, licence-key delivery, receipts, operational notices Art. 6(1)(b) contract Active account + 2 years; invoice records for 7 years (Art. 6(1)(c) Dutch Tax Code Art. 52)
W2 Purchase metadata — including EUR amount, payment method, payment-processor reference (the processor is named in Annex A), status timestamps, Quaderno invoice IDs, and (for Business-tier purchases) is_b2b flag, VAT number, VIES consultation number, company name, company address Provide the service, issue the invoice, satisfy tax and VAT-compliance record-keeping Art. 6(1)(b) contract + Art. 6(1)(c) tax law (Dutch Tax Code Art. 52, BTW Art. 35a, CJEU Luxury Trust) 7 years from end of fiscal year — uniformly across all fields in this row including B2B sub-fields. Never auto-pruned; manual review at year 8.
W3 Magic-link authentication tokens Authenticate you when you click the magic link Art. 6(1)(b) contract 24 hours from issuance (typical actual retention is much shorter — used tokens are deleted on use, unused tokens within ~1 hour of their 10-minute expiry)
W4 Server access logs (IP address, user agent, request path, timestamp) Operational security, abuse and DDoS detection, availability monitoring Art. 6(1)(f) legitimate interests 30 days, then deleted; IP truncated on ingestion where operationally feasible
W5 Referral and partner records None. We do not operate a referral programme (Terms of Service clause 11) and do not create referral or partner records. Not applicable Partner records created automatically before 21 October 2026 have no further use and are deleted.
W6 Renewal reminders Remind you before a licence year ceiling is reached ePrivacy Directive Art. 13(2) "soft opt-in" (existing customer, similar product, opt-out in every message) Until you opt out
W7 IP address of the device used at checkout, captured at the moment an order is created and stored on the order record Evidence of your location for EU VAT purposes. EU law requires a supplier of digital services to hold evidence of the customer's country, and to retain that evidence; your IP address is one of the items the law names for this purpose Art. 6(1)(c) legal obligation (Council Implementing Regulation (EU) 282/2011, Articles 24b and 24f; Union OSS record-keeping under Article 63c) 10 years from the end of the year in which the supply was made — the retention period the OSS record-keeping rules require, which is longer than the 7 years in W2. Never auto-pruned; manual review at year 11

Country-code derivation. Where we record a country code — Order.country_code, collected at checkout for VAT compliance — it is determined from the billing details you provide at checkout and our VAT provider's assessment at that moment. We do not operate a GeoIP database, we do not derive country from raw IP addresses in our application code, and we do not use any content-delivery-network geo-header for this purpose. Raw IP addresses appear in two places, for two different purposes: W4 server access logs, kept 30 days for security and truncated where operationally feasible; and, from 2026, the IP address of the device used at checkout, kept with the order under W7 as EU VAT location evidence. The second is not used to determine your country — that still comes from the billing details you provide — but the law requires us to hold and retain it alongside them.

Legitimate interests (W4): for the legitimate-interests flows we maintain documented Legitimate Interests Assessments (LIAs) covering purpose, necessity, and balancing. We can summarise them on request.

3.2 Cookies

The website uses only strictly necessary cookies that are exempt from consent under Article 11.7a(3) of the Dutch Telecommunications Act (implementing Article 5(3) of the ePrivacy Directive 2002/58/EC):

We do not use analytics cookies, advertising cookies, or any third-party tracking. No cookie banner is shown because none is required for strictly necessary cookies.

3.3 Recipients (third parties we share data with on the website side)

We use a small number of third parties to operate the website, in the categories below. The specific provider engaged in each category — its identity, role, jurisdiction, regulator, and the transfer basis where it sits outside the EEA — is listed in Annex A, which is kept current and separately dated. Each provider has its own privacy policy.

We do not sell, rent, or trade your personal data.

3.4 International transfers

The hosting region is the EU. Where transactional email is processed by a US provider, transfers occur under the EU Standard Contractual Clauses (SCCs) and supplementary measures as appropriate. Our Bitcoin Payment Processor is established in Serbia, which has no EU adequacy decision. We do not transfer your personal data to it: the payment request we send carries an order reference and an amount, not your name, email address or IP address. When you choose to pay in Bitcoin, your browser connects directly to the Processor's hosted checkout page, and that connection — including the IP address and browser information any web server receives — is collected by the Processor from you under its own privacy policy, not transmitted by us. The Processor states that it does not store the payer's IP address as part of the payment record.

3.5 Data subject rights (website)

You have the right to:

Exercise any of these rights by emailing privacy@bitcoinproof.io. We respond within one month (Art. 12(3)).

Data export. To receive your portability export, email privacy@bitcoinproof.io — the "Your data" panel at bitcoinproof.io/account links there. We send your account record, orders, licence keys, downloads and email-log references in a structured, machine-readable format within one month (Art. 12(3)). Some additional data we hold about you is governed by legal obligations (e.g. tax records) and is available through an Article 15 access request rather than the portability export.

When you ask for erasure: we delete your account email and marketing preferences immediately; we move your invoice records to restricted-processing under Article 18 for the remainder of the 7-year tax-retention period (Article 17(3)(b) legal-obligation exception); we purge any server access logs associated with your IPs within the next 30-day rolling deletion cycle; and we delete any partner record linked to your account (see "Partner records" below).

The IP address held with your order under W7 is not a server access log and is not covered by that cycle. It is part of the invoice record, and like the rest of that record it is retained for the statutory period and moved to restricted processing (Article 18) rather than deleted, for the same reason set out above.

Erasure is implemented as a tombstone procedure. Your account row is not hard-deleted — instead, it is marked erased, your email and account-level personal data are scrubbed, and the invoice and licence-key records that we are legally required to keep for tax purposes remain linked to the tombstoned record. This is the only way to satisfy GDPR Article 17 and Article 17(3)(b) tax-retention simultaneously without breaking the integrity of the invoice audit trail. The erased account cannot be re-used or recovered.

Partner records. We no longer create partner records, and those created automatically before 21 October 2026 are deleted. If you ask for erasure while such a record still exists, it is deleted as part of the erasure; where a record has to be kept, your email address is removed from it.

4. The desktop application (BitcoinProof software)

4.1 What stays on your computer (and never leaves)

The application is local-first. The following data is stored only on your computer and is never transmitted to us or to any third party:

When you uninstall the application, all of this data is deleted from your computer with it. This is your primary erasure mechanism for application data.

4.2 The three outbound calls the application does make

Although the application is local-first, three categories of outbound HTTPS request occur in the course of normal operation. We disclose all three precisely.

4.2.1 Block-explorer queries (Bitcoin script hashes)

When you scan a wallet, the application contacts a Bitcoin block-explorer service to retrieve transaction history. The application ships with a default endpoint, which is identified in the application before any scan and named in Annex A. You can change it to any Esplora-compatible endpoint in the application Settings — a different public block explorer or your own self-hosted node.

What is sent: Bitcoin script hashes derived from your wallet descriptor (used by the Esplora protocol to look up transaction history without revealing addresses directly), plus your IP address and user agent visible to the HTTPS counterparty.

What is not sent: wallet descriptors in plaintext, extended public keys, raw addresses, identity fields, or report contents.

Lawful basis (where GDPR applies to you): Article 6(1)(b) — performance of the service you requested. The scan only happens when you click "scan."

Recipient role: the block-explorer operator is an independent controller for the data it receives. We do not have, and could not appropriately have, an Article 28 processor agreement with a public block explorer.

International transfer: the endpoint the application queries is the one you have selected. Where you leave the shipped default in place, its operator, corporate seat, and the Article 45 GDPR adequacy basis for that transfer are stated in Annex A. Where you select a different public endpoint, the choice of counterparty — and therefore the destination of the transfer — is yours. A self-hosted endpoint involves no transfer to a third party at all.

Notice on script-hash personal-data classification: under the Breyer (C-582/14) line of CJEU case law, reaffirmed in EDPS v SRB (C-413/23 P, September 2025), the combination of your IP and a Bitcoin script hash may constitute personal data because chain-analysis and exchange-KYC correlation are not "disproportionately difficult" means of re-identification. We treat this transfer as personal-data processing, which is why it is disclosed to you here in detail.

4.2.2 Licence validation pings

The application periodically retrieves https://bitcoinproof.io/licenses.json to validate licence keys.

What is sent (intentionally): the request itself — no licence key, no email, no wallet data is transmitted in the request body.

What is auto-logged on our server: your IP address, user agent, and timestamp.

Lawful basis: Article 6(1)(f) legitimate interests — operational security, abuse prevention, availability monitoring. Breyer establishes that server-side IP logging for security is a permitted legitimate interest and Recital 49 GDPR expressly recognises this.

Retention: 30 days, then deleted (see W4 in section 3.1 above).

Note: the desktop application supports a 30-day offline grace period, so brief network outages or extended offline use do not invalidate your activated licence keys.

4.2.3 Version checks

The application periodically retrieves https://bitcoinproof.io/version.json to check for updates.

The disclosure mirrors 4.2.2: nothing identifying about you is sent intentionally; our server auto-logs IP, user agent, and timestamp; the lawful basis is Article 6(1)(f) legitimate interests for operability of the update endpoint; retention is 30 days.

4.3 No telemetry, no analytics, no crash reporting

The application does not contain any telemetry, analytics, or crash-reporting components. We do not know which features you use, how long you use the application for, or how many entities or descriptors you have. We do not collect crash reports.

4.4 Erasure for the desktop application

Because all application data is local, you erase it by uninstalling the application and deleting any reports or exports you generated. The three outbound calls described in section 4.2 leave server-side access-log traces that are subject to the 30-day rolling deletion. To purge server logs for your IPs sooner, email privacy@bitcoinproof.io.

5. Tor and proxy support

The application's block-explorer client supports an optional SOCKS5 proxy URL, allowing you to route block-explorer queries through Tor or another proxy of your choice if you wish to obscure your IP from the block-explorer operator. This is a privacy enhancement we make available; we do not collect, log, or process any data about whether you use it.

6. Children

The website and the application are not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@bitcoinproof.io and we will delete it.

7. Norway (EEA)

Norway implements GDPR via the Personopplysningsloven; no separate Norwegian privacy notice is required. The supervisory authority is Datatilsynet (datatilsynet.no). You have the same rights described in section 3.5 and may complain to Datatilsynet directly.

8. Switzerland

Switzerland is not in the EEA, but the new Swiss Federal Act on Data Protection (revFADP / nFADP, in force 1 September 2023) is GDPR-aligned. The Swiss supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC) (edoeb.admin.ch). Swiss-resident data subjects have rights substantially equivalent to those in section 3.5. Cross-border transfers from Switzerland to the EU are recognised under Swiss adequacy lists. You may complain to the FDPIC directly.

9. Australia

The Australian Privacy Act 1988 (Cth) jurisdictionally reaches us where we sell to Australian users. We rely on the small business operator exemption in section 6C of the Privacy Act (annual turnover ≤ AUD 3 million; this exemption was not repealed by the Privacy and Other Legislation Amendment Act 2024 and remains in force as at the date this policy was last updated). The exemption is preserved by two design choices: (a) we monitor and remain below the AUD 3M turnover threshold; and (b) we do not sell, rent or trade personal information, which keeps us outside the "trade in personal information" disqualification under section 6D.

If we ever exceed the AUD 3M threshold, or if the exemption is repealed by future amendment, this policy will be updated to add a full Australian Privacy Principles (APPs) section in advance of the change.

Even where the small business operator exemption applies, the statutory tort for serious invasions of privacy (in force 10 June 2025) and Australian anti-doxxing offences continue to apply. Australian users may contact us at privacy@bitcoinproof.io with concerns; the Office of the Australian Information Commissioner (OAIC) is the relevant authority.

10. Security

We apply technical and organisational measures appropriate to the risk, including: HTTPS for all website traffic; magic-link authentication (no passwords stored); encrypted database storage at the hosting layer; access controls on production systems; minimum-data architecture (we do not collect what we do not need); 30-day rolling deletion of server access logs; and the local-first architecture of the desktop application, which keeps wallet data off our infrastructure entirely.

We notify the Dutch AP and affected data subjects of any personal data breach within the timelines required by Articles 33 and 34 GDPR.

11. Changes to this policy

We may update this policy. This policy applies from the moment it is published here — the "Last updated" date at the top of the document changes whenever we amend it, and previous versions are available on request from privacy@bitcoinproof.io. Material changes are notified to registered account holders by email at least 30 days before they take effect.

12. Complaints

If you believe we have processed your personal data unlawfully or you are dissatisfied with our response to a rights request, you may complain to:

You may also bring a complaint to a court of competent jurisdiction.

Annex A — Named third parties and transfer bases

Annex revision: 2026-09-16. The body of this Privacy Policy is Version 1.0; this annex is dated and revised independently of it.

This annex is the single home for the identity of the specific third parties that the rest of this policy — and the EULA (clause 5.1(a)) and the Terms of Service (clauses 1.4, 1.5, and section 6) — refer to by category. Because those documents name providers only by category and rely on this annex for the specific party, updating this annex to reflect a change of provider does not alter the operative text of the Privacy Policy, the EULA, or the ToS, is not a "material change" under section 11, and does not require you to re-accept the EULA or ToS. Each named provider has its own privacy policy.

A.1 Website — processors and payment providers

Category Currently engaged Role Jurisdiction Transfer / regulator basis
Hosting and managed database Railway Processor EU (deployment region) No transfer — EU region
Transactional email Postmark (Wildbit, LLC) Processor US EU Standard Contractual Clauses + supplementary measures
VAT calculation and invoicing Quaderno (Recrea Systems, S.L.) Processor Spain (EU) No transfer — EU. Receives your billing country and, from 2026, your checkout IP address as VAT location evidence (W7)
EUR payment (Business tier) Mollie B.V. Independent controller (payment leg) Netherlands (EU) No transfer — EU; regulator De Nederlandsche Bank (DNB)
Bitcoin payment Coinsnap (Onlineshop24 DOO, Serbian register no. 21579041) Independent controller for its merchant relationship with us; processor for any customer data we submit, which is none Serbia (non-EU; no adequacy decision) No transfer by us — the payment request carries an order reference and an amount only. Your browser reaches its checkout page directly and its privacy policy governs that visit. By its own terms it is not a payment institution or a MiCAR-authorised Crypto-Asset Service Provider, has no financial regulator, and applies no identity verification to payers

The Bitcoin Payment Processor was engaged on 2026-08-26. Because it is a self-custodial software provider rather than a regulated financial institution, the fields this row was designed to record on engagement — home regulator, MiCAR authorisation, KYC threshold — do not apply to it; the row records what it is instead. Its sub-processors are not published; under its Data Processing Addendum it discloses them to a merchant on request.

A.2 Desktop application — default block explorer

Item Value
Shipped default endpoint Blockstream.info
Operator Blockstream Corporation
Corporate seat Canada
Transfer basis Article 45 GDPR adequacy decision (Canada)
Purpose Retrieving Bitcoin transaction history via Esplora script-hash queries

You may change this endpoint at any time in the application Settings. If you do, the transfer analysis in section 4.2.1 follows your selection rather than the default above, and a self-hosted endpoint involves no transfer to a third party.

End of Privacy Policy.