Bearing Privacy Policy

Nothing about you. Bearing has no account, login, analytics SDK, advertising SDK or third-party SDK, and no information about you or your device is sent to the developer. The one thing Bearing ever stores on the developer’s website is an encrypted check link, and only when you share one. The developer cannot read it (see Check links below).

Camera. To take still photographs. Bearing does not use the microphone.

Location, while you use the app. To record where each photograph was taken: latitude, longitude, accuracy, altitude, speed and course. Bearing reads a short stream of positions around each shutter press to choose the most accurate one. It does not use background location and does not track your movement. Trails are drawn only from photos you took.

Motion & Fitness, only if you turn on Barometric altitude. To read the barometer for a steadier altitude. Bearing also reads the compass and motion sensors, which need no permission, to record which way the lens pointed.

Photos, add-only. To add the stamped copy (or a clean muted capture) to your library when Save to Photos is on. Add-only access cannot read or change your library. If you choose rounded or hidden coordinates for the stamp, Bearing does not attach a location to the Photos copy.

Photos and Files, when you import or verify. Through Apple’s system pickers, which give Bearing only the item you choose. When you open a PDF or .bearing file in Bearing from another app, Bearing checks it on your iPhone and then deletes its copy.

On your iPhone, inside Bearing’s own storage: originals, stamped copies, later renders, metadata, signatures and timestamp tokens. Muted zones are stored with file protection. Nothing is uploaded or backed up to any Bearing server. Deleting the app deletes everything Bearing stored; copies you saved to Photos or shared stay where you put them.

• Apple Maps snapshots for the stamp map. Your approximate location is sent to Apple.
• Apple reverse geocoding for city, state, country and street address. Coordinates are sent to Apple. When you are offline, Bearing uses its built-in place list instead and looks up the address later.
• Trusted timestamps, only if you turn them on. Bearing sends a SHA-256 fingerprint of a record (a 64-character code that reveals nothing about the photo or place) to the freetsa.org timestamp authority over HTTPS and stores the signed reply once its signature checks out. No photo, location or personal data is sent.

The browser verifier at critstudios.com checks files inside your browser, including locked Capture Records and their record code. Neither the file nor the code is uploaded.

Bearing creates a signing key in your iPhone’s Secure Enclave. It cannot be extracted, is not linked to your identity and is never transmitted. The public half is printed on Capture Records so others can check a signature.

The seal is local tamper evidence. It shows that files and metadata have not changed since they were sealed on that iPhone. It is not a C2PA credential, does not establish identity and cannot prove that the phone’s sensors or clock were not manipulated.

Bearing is a work and travel tool and is not directed at children. It collects no personal information from anyone.

Changes will be published here with a new date and noted in release notes.

support@critstudios.com

Evidence packages, CSV, KML and KMZ are created locally and shared only through the system share sheet when you choose to share them. These exports can contain full-precision locations and field notes even when the visible stamp was muted, rounded or hidden. Evidence packages include untouched originals, stamps, canonical metadata, public signing keys, signatures and any included timestamp replies; private signing keys remain on the device. Custom fields and later field additions are stored locally. The package verifier processes the selected package locally without uploading it.

A Capture Record PDF now carries the record it describes: the untouched original photo, every stamp, the full-precision metadata (including the exact location, even when the stamp was rounded, hidden or muted), signatures and any timestamp reply. It is created on your iPhone and leaves only when you share it. You can lock it with the record code printed on the photo’s stamp. The lock keeps the PDF closed to anyone without the photo or the code; it is 128-bit PDF encryption with a 12-character code, so treat it as a lock against casual viewing rather than strong encryption.

Bearing shows occasional tips based on what you have done in the app, such as your first capture. The counts that decide this are stored on your iPhone only, are never sent anywhere, and are reset from Capture options › Show tips again.

When you share a photo with a check link, the link opens the details you chose to reveal (for example the time, the accuracy and the town), a small preview of the photo, and the seal that proves them. Details you hide are not included; only salted fingerprints of them are, and these cannot be reversed.

So that the link is short enough for any messaging app, Bearing encrypts these details on your iPhone with a new random key and stores only the encrypted copy on critstudios.com (Cloudflare). The key is part of the link, after the “#”, which browsers never send to a website. CRIT Studio therefore cannot read what is stored. Alongside it the website keeps a random link ID, a fingerprint of the delete code and the date. It keeps no IP address, device or account. Making a link needs an internet connection; checking one sends only the link ID to critstudios.com.

Anyone you send the link to, or who it is forwarded to, can read what it reveals. You can delete the links you shared for a photo at any time: Share › Delete the shared link. After that the link no longer opens. Links you don’t delete are kept until you delete them.