Privacy Policy
The following notice is reproduced from Haawke Verify. Its connector, Verify and Hash sections apply to the services named in them. Badge uses a separate read-only website lookup; the connector-specific statements do not describe this site's response display.
Haawke Badge — this website
When you select Check registry, this site sends the supplied SHA-256 fingerprint to its server, which makes a read-only request to the Haawke registry. The returned registration metadata and raw registry response are displayed in your browser. This site does not hash or upload your files, register artifacts, or modify records. The local application does not store lookup requests in a database or use analytics or cookies. Any future hosting provider's processing will depend on the deployment configuration.
For privacy questions, contact craig@haawke.com.
Haawke Provenance for ChatGPT — verification-only connector
This section applies exclusively to verification requests made through the Haawke Provenance connector for ChatGPT. It covers the information processed, purposes, recipients, retention and user controls for those requests. The general website, account and other-product disclosures below do not extend marketing, advertising, profiling or model-improvement practices to connector requests. Visiting a Haawke website or using a separate product is a separate interaction covered by its applicable section.
What the tool receives and returns. The tool accepts one 64-character hexadecimal SHA-256 fingerprint; it does not accept file contents, titles, user names, or other metadata. Haawke's MCP service also processes the request's protocol data and the network address it receives. The tool returns the normalized fingerprint, whether a registry record matches, registry status, any available registration date, model and media-type fields, certificate-validity status, registry-reported OpenTimestamps status, a verification URL when available, and explanatory assessments. Some result fields may be null, omitted, or unavailable. The response does not include the original artifact.
Purposes and data flow. Haawke uses the fingerprint to retrieve the corresponding existing public registry record and uses the connecting network address as a rate-limit key to help prevent abuse and maintain availability. The MCP service sends the fingerprint to the registry service in a read-only lookup URL. It does not forward the incoming request's authorization header, conversation context, or connecting address to the registry. The registry returns an existing public record, which may include declared attribution, file metadata and a thumbnail; the MCP service discards those additional fields and returns only the verification fields listed above to ChatGPT. A lookup does not register or modify a record. Haawke does not sell connector request or result data or use it for marketing, advertising, profiling, or model training.
Recipients. Cloudflare provides hosting and network services for the MCP endpoint and registry and may process request, network, operational, and security data to provide those services. The address seen by Haawke may be an OpenAI infrastructure address rather than the end user's address. OpenAI processes the user's ChatGPT conversation and the tool request and response under OpenAI's own terms and privacy practices. Haawke does not receive the user's full ChatGPT conversation through this tool.
Retention. Haawke's application handles the lookup in request memory and does not write individual verification requests or results to an application database. Production Workers Logs and Traces are disabled for the MCP and registry services, and no observability export destinations are configured. The MCP rate limiter has a 60-second enforcement window; this is not a promise that its underlying counter or related provider data is deleted after 60 seconds. Cloudflare's Workers metrics documentation states that aggregate Worker metrics can be inspected for up to three months. This queryable period is not a verified deletion deadline for all underlying data. Cloudflare's Rate Limiting API documentation describes locally cached counts and background synchronization but does not specify the underlying counter's deletion deadline. For provider-managed infrastructure and security information, Cloudflare's privacy policy describes purpose-based retention and legal obligations, without a single fixed period for these categories. We have not confirmed a service-specific maximum retention or deletion deadline for that data and cannot promise zero provider retention or deletion after 60 seconds. OpenAI's handling and retention of ChatGPT conversations are governed by OpenAI's policies.
Choices and requests. No Haawke account is required. You can choose not to submit a fingerprint or stop using the connector. For privacy questions or requests concerning data associated with a lookup, contact craig@haawke.com; we will assess the request under applicable law and the controls available to us. We have no verified control to locate or delete an individual request from provider-managed rate-limit, metrics, infrastructure, or security data. A lookup does not authorize deletion of an existing public provenance record or an external Bitcoin commitment.
Haawke Verify — public verification website
This section identifies visits to verify.haawke.com, separately from requests through the ChatGPT connector. For website technical and usage data, see Websites, accounts and other products. Public provenance records are separate from lookup requests: viewing a record does not register a new artifact or authorize deletion of the existing record or an external Bitcoin commitment.
Using the ChatGPT connector instead? Read the verification-only connector notice above.
Haawke Hash — hashing and provenance registration
This section identifies use of hash.haawke.com. Hashing and registration are separate from the verification-only ChatGPT connector. The connector's digest-only input and request-handling disclosures are not a description of registration or file-processing features. For website and account information, see Websites, accounts and other products.
A verification lookup does not create or modify a public registration. Previously registered public records and external Bitcoin commitments have a separate lifecycle from lookup requests.