The Open Verification Manifesto: What We Log and What We Purge

Transparency Beats Marketing

Many online services use terms like "100% Secure" or "Bank-Grade Encryption" as promotional slogans without disclosing their underlying technical architecture. When scrutinized, their databases are often filled with permanent customer uploads, third-party analytics trackers, and persistent tracking pixels.

At SHHHH, we believe trust is earned through **verifiable architectural transparency**. Below is the exact technical audit of what our application stores, what it refuses to touch, and how customer data is permanently expunged.

1. The Exact Database Schema: What We Store

Our database schema is publicly documented. We use PostgreSQL via Prisma ORM. Below is the entirety of our `Order` and `Session` data models:

model Order {
  id              Int         @id @default(autoincrement())
  token           String      @unique @default(uuid())
  slotId          Int?
  product         ProductType
  finish          String?     @default("GLOSS")
  quantity        Int
  pricePaise      Int
  customerName    String
  customerEmail   String
  customerPhone   String
  shippingAddress String
  paymentStatus   PaymentStatus @default(PENDING)
  status          OrderStatus   @default(CREATED)
  trackingNumber  String?
  cashfreeOrderId String?
  epsonJobId      String?
  createdAt       DateTime    @default(now())
  updatedAt       DateTime    @updatedAt

model Session { id Int @id @default(autoincrement()) token String @unique @default(uuid()) orderId Int @unique expiresAt DateTime printTriggeredAt DateTime? } ```

**Notice what is missing from this schema**: - There is no `imageUrl`, no `fileKey`, no `s3Bucket`, and no binary blob column. - There are no customer metadata fields for photo GPS coordinates, EXIF tags, camera serial numbers, or file timestamps. - The image data exists exclusively inside volatile client RAM and the printer's hardware cache during the 15-minute window.

2. Zero Third-Party Analytics or Ad Tracking

• **No Google Analytics, Meta Pixels, or Segment**: We do not load third-party marketing tags, tracking scripts, or ad trackers.
• **No Canvas Fingerprinting**: We do not fingerprint customer hardware, screen dimensions, or fonts.
• **No Marketing Retargeting**: We do not retarget customers across Instagram, Facebook, or Google with advertisements featuring the items they printed.

3. One-Click Customer Record Deletion

Even though photo files are never stored, customer logistics information (name and shipping address) must be retained temporarily to facilitate courier transit (delivered across India in 5 to 6 working days).

Once delivery confirmation is verified: - Customers can email `support@shhhh.in` with their order token. - An automated API invocation sanitizes the shipping address, phone number, and name, replacing them with randomized hashes. - Order token entropy relies on cryptographically generated **UUIDv4** (122 bits of system entropy), making URL guessing computationally impossible.