How TypVault protects you
TypVault protects you with a set of enforced guarantees. This page lists all of them.
Enforced means each guarantee is backed by the software and its tests. The software carries a test for every entry on this page, and that test fails if the guarantee stops being true.
The guarantees, by category
Section titled “The guarantees, by category”Nine short articles explain what the guarantees mean in practice, one area at a time.
- Anonymity: what the platform knows about you, and what it is built not to know.
- Encryption: how a tip is sealed on your device, and who can open it.
- Operator accountability: the trail that every access to a tip leaves.
- Photos and files: what happens to a photo or file before it is saved.
- The safety check: the check your tip’s wording goes through before you send it.
- Location: why a tip asks for the address of the crime, and how the platform maps it.
- Retention: how long a tip is kept, and what happens to it after that.
- Rewards and demo honesty: how cash rewards are paid, and how a demonstration site is labeled.
- Referrals to other programs: what moves with a tip when it is referred, and what does not.
Every enforced guarantee
Section titled “Every enforced guarantee”Each entry below appears word for word, in the same wording the software is tested against.
Snapshot generated · source commit d3485f4c · 24 entries, enforced-only by construction
anonymity
- No IP, device, or fingerprint stored
anonymity.no-identifying-signal We don't ask your name or contact info, and we don't store your IP address, device, or browser fingerprint. We don't know if you're on an iPhone or an Android, Safari or Chrome — and neither does anyone who might come looking. That blindness is deliberate: the platform never captures that signal in the first place. Your tip code is the only thing that connects you to your tip.
- Your IP isn't logged when you submit
anonymity.no-ip-logging-badge We don't log your IP address when you submit a tip.
- We don't track when you check
anonymity.no-check-tracking We don't record when you check on your tip, or how many times. There is no log of your visits — your tip code lets you in, and that's the only thing the system knows.
- A second lock only you hold
anonymity.passphrase-zero-knowledge Setting a password puts a second lock on your messages that only you can open. If you forget it, you can still confirm your tip was received — but no one, including us, can unlock or recover your messages. Most people don't need a password; your tip code alone lets you check status.
- Guided questions never ask who you are
anonymity.followups-low-self-id The short guided questions ask about the situation, not about you. None of them ask who you are, where you live, or how you are connected to what you describe. The set of questions is fixed in the app's code, and we review each one for anything that could point back to you before it goes in. Wording can change by category, but no category can add a question.
- Your tip is stored in English; the original language isn't kept
anonymity.source-language-not-retained Write in whatever language you're comfortable with. Your tip is translated and stored in English, and the original language you used isn't kept.
encryption
- Encrypted on your device before sending
encryption.client-side-envelope Your words and the location are scrambled on your own device before anything leaves your phone or computer. The location of the crime rides inside that same locked envelope — it is never stored as plain, searchable text.
- Only the agency that can act on it can unlock it
encryption.operator-only-readable Only this program can unlock your tip, using a key that stays on the platform. Even we cannot read it from outside that system. If your tip is referred to another program, that program's investigators can also read it. We keep a permanent record of the referral here, and the receiving program signs a confirmation we keep too.
operator-accountability
- Every access is permanently recorded
operator-accountability.audited-decrypt When your tip is opened, the system permanently records it: who, when, and why. No one can read your tip in secret, and there is no way to bulk-read tips without leaving that trail.
- Audit log is permanent and immutable
operator-accountability.append-only-audit Every time your tip is opened or acted on, it is written to a permanent record that cannot be erased or edited, even by us. This is what lets us prove who accessed your tip.
- Export excludes narrative and identifiers
operator-accountability.constrained-export Operator-scope entry — plain-language prose for this page is authored fresh under the copy gate. Nothing is quoted here until that pass lands.
- Privileged out-of-scope classification
operator-accountability.close-as-noise Operator-scope entry — plain-language prose for this page is authored fresh under the copy gate. Nothing is quoted here until that pass lands.
- Routing note unlogged; reopen reason logged
operator-accountability.workflow-note-handling Operator-scope entry — plain-language prose for this page is authored fresh under the copy gate. Nothing is quoted here until that pass lands.
attachments
- Hidden photo location data removed
attachments.metadata-strip Before a photo or file you attach is saved, we re-create it from scratch so hidden data — like the GPS location your camera records, the device model, and timestamps — does not come along. This happens both on your device and again on our server.
- Attachments locked before storage
attachments.at-rest-encryption Files you attach are locked before they are stored, just like the rest of your tip.
ai-safety-review
- We check your words for self-clues
ai-safety-review.minimal-payload Before your tip is sent, we check your wording for details that could point back to you — like naming a small detail only a few people would know. Only your words and the crime category are checked; your location, your tip code, and anything about your device are never part of that check, and nothing from it is saved.
location
- The crime's address, mapped privately
location.operator-side-geocode We ask for the address of the crime, not your home. That address is locked inside your encrypted tip; only the agency that can act on it sees it, and we look it up on a map from our own servers, so no outside map service ever learns anything about you.
retention
- Can't be deleted; destroyed after retention
retention.no-deletion-crypto-erasure Once you send a tip, it can't be deleted — this protects your tip from being destroyed, including by anyone who might pressure you to take it back. After our retention period your tip is permanently destroyed. You can stop checking on it at any time.
platform
- Cash rewards, collected anonymously
platform.rewards-no-pii If your tip leads to an arrest, you may earn a cash reward. You collect it anonymously — give your tip code to the teller and receive an envelope, or get a prepaid card. No name or ID is ever required.
- Demo environment — don't submit real tips
platform.demo-mode-honesty This is a demonstration environment, not a live tip program. Please do not submit a real tip here.
federation
- Referred tips are re-encrypted for the receiving program
federation.re-encrypted-for-destination Investigators here can refer a tip to the program that serves the right area. Before it travels, the copy is re-encrypted so only the receiving program's investigators can read it. The keys that protect your tip here stay here. The receiving program stores what you wrote without unlocking it. Any files you attached are unlocked once when they arrive, to re-seal them under that program's keys. Every read there, by a person or by automatic triage, is recorded.
- Your tip code and passphrase never travel with a referral
federation.no-tipster-identity-travels A referral carries what you reported, never who you are on this platform. Your tip code, your passphrase, and your messages stay here. The receiving program gets none of them.
- Your tip code works only where you submitted
federation.dialog-stays-home Your tip code and passphrase keep working here, where you submitted, even after a referral. They do not work anywhere else. You check your tip the same way as before.
- A referral takes a decision at both programs
federation.operator-governed-both-ends A referral is never automatic and never public. An investigator here decides to send it, and an investigator at the receiving program agrees to take it before your tip moves. There is no public directory of tips or programs.
Related
Section titled “Related”If your question is not answered on these pages, ask the program that runs your tip line.