What we hold, and what we deliberately cannot.
Last updated 16 August 2026
This page is written for someone who has to justify a tool to a supervisor, a records officer or a defence attorney. It is short because there is not much to describe, and specific because “we take your privacy seriously” is not a fact anybody can check.
The case tool holds nothing
The tool at /record is a single HTML file that runs entirely inside your browser. Concretely, and you can verify every one of these by reading the file:
- It makes no network request of any kind. There is no
fetch, noXMLHttpRequest, and no beacon. - It loads no external resource — no fonts, no images, no scripts, no stylesheets from anywhere else.
- It contains no analytics, no tag manager, no session recorder and no error reporter.
- It never writes to
localStorage,sessionStorage, IndexedDB or a cookie. Nothing is left behind on a shared machine. - Closing the tab discards everything in it. There is no recovery, which is the point.
Your case file is a JSON file you save to your own disk, in a location you choose, under your agency’s own retention rules. We never see it and could not produce it if we were asked to. The tool also asks you to record third parties by reference rather than by name, because a record that travels through discovery should carry identifiers rather than identities.
The waitlist holds what you type into it
The form on the home page is the only thing on this site that transmits anything. If you submit it, we store the email address you gave, and whichever of the optional fields you filled in: name, agency, role, and your answer about data sources beyond DNA. We also store the time of submission, the page you submitted from, and your browser’s user-agent string, which are used to catch automated abuse.
- We use it only to email you about Truestone.
- We do not sell it, rent it, or share it with a third party for their own purposes.
- We do not run advertising, retargeting or cross-site tracking of any kind.
- Ask us to delete it and we delete it, without asking why.
If the waitlist store is not connected to a given deployment, the form will tell you so and offer to send an email instead. It will not report success for a signup that was not recorded.
This site
No analytics product is installed, no cookie is set, and no third-party script is loaded. The site is served by Vercel, which as a hosting provider processes request logs including IP addresses for operational and security purposes; that is a property of being hosted on the internet rather than a choice we made about you.
What Truestone is not
Truestone is not legal advice and not a compliance certification. It records what you did and flags where what you recorded fails a requirement it knows about. It cannot tell you whether your conduct was lawful. Its legal reference block is dated 16 August 2026 and carries that date on the face of the tool precisely because it will go out of date. Your state’s law and your agency’s counsel outrank everything here.
Contact
Privacy questions and deletion requests: hello@truestone.io. Security reports: security@truestone.io, or see security.txt. If you find anything on this page that is not true of the shipped code, that is a bug and we want it reported before anyone else finds it.