Privacy Policy

Certz is a research proof of concept for a confidential, on-chain certificate authority on Oasis Sapphire testnet. This policy describes how the Certz website and the Certz Verifier browser extension handle information.

We do not sell personal data. We do not run advertising trackers on the Certz website. The extension performs verification locally in your browser when you open it.

When you use certz.app (or a deployed mirror of this site):

• Certificate creation. Your leaf private key is generated in your browser and is not sent to our servers. We receive only the domain name, a certificate digest (hash), and expiry you submit for on-chain issuance.
• DNS-01 verification. Our server checks public DNS TXT records at _certz-challenge.<domain> to confirm domain control before issuing a certificate.
• Blockchain transactions. Issuance requests are submitted to Oasis Sapphire testnet. Transaction data (domain, digests, addresses) is public on-chain by design.
• Server logs. Our hosting provider (for example Vercel) may log standard HTTP metadata such as IP address, request path, and timestamps. We do not use those logs for advertising.

The Certz Verifier Chrome extension checks whether the site in your active tab advertises a valid Certz certificate. It runs only when you open the extension popup.

• Active tab URL. The extension reads the hostname of your current tab to know which site to verify. It does not browse your history or monitor tabs in the background.
• Site requests. From your browser, it fetches /.well-known/certz/certificate.pem and /.well-known/certz/sign on that site's origin. Those requests go directly to the site you are visiting, not through Certz servers.
• On-chain lookup. The extension calls the public Oasis Sapphire testnet RPC endpoint to read the Certz registry contract. Only certificate digests and contract state are queried — no account or wallet data from you is sent.
• No remote code. Verification logic and the pinned CA root are bundled inside the extension. The extension does not load executable code from third-party servers.
• No analytics. The extension does not include analytics SDKs and does not report verification results to Certz.

• Browser history or browsing activity outside the active tab
• Leaf private keys generated during certificate creation
• Payment or billing information (Certz is a free research demo)
• Advertising profiles or cross-site tracking identifiers

• Oasis Sapphire testnet — public blockchain RPC and smart contracts
• Hosting providers — website deployment and CDN (for example Vercel)
• Google Chrome Web Store— if you install the extension from the store, Google's policies apply to that distribution channel

On-chain registry records are permanent and public by design. Website server logs are retained only as long as our hosting provider keeps them. The extension stores no persistent user profile on Certz infrastructure.

Certz is not directed at children under 13. We do not knowingly collect personal information from children.

We may update this policy as the project evolves. The “Last updated” date below will change when we do. Continued use of the website or extension after an update means you accept the revised policy.

Questions about this policy can be raised on the Certz GitHub repository.