Terms of Use
These terms govern your use of the OpenStamps for Furniture website, the free tools, an account, and a paid subscription or metered API access (together, the “Service”). By using the Service you accept these terms. If you do not accept them, do not use the Service.
1. Who we are
The Service is operated by Protosonic OÜ, a private limited company registered in the Republic of Estonia (“we”, “us”, “Protosonic”), trading as OpenStamps. Registry code 16344167 · VAT EE103014252. Cosmic Time Stamp (CSTP) is the underlying technology. Website: protosonic.eu. Commercial enquiries: pilot@openstamps.com.
2. What the Service is
OpenStamps for Furniture is an evidence-layer offering for furniture supply chains, built on Cosmic Time Stamp (CSTP) technology. It is self-serve: you create an account with an e-mail address, choose a plan on the website, pay with a card or Revolut Pay, and use it. There is no order form, no quotation, no statement of work and no minimum term. Nothing on this site is a consulting engagement, legal advice, certification, or a deforestation-risk decision, and none of it is offered. A production SLA, a support plan and telephone support are not offered today.
3. What a stamp is — and is not
A CSTP stamp binds a record’s fingerprint to public time anchors and related commitments. Checking a stamp or a chain returns exactly three outcomes: refuted (a check ran and the evidence contradicts the claim), not-refuted (a check ran and found no contradiction) and not-checked (there was nothing to check with, and the reason is named). A chain shows one of four lights — red, amber, white, or anchored when every floor record is bracketed and its anchors were reached. We do not sell a marketing seal of “genuine,” “certified authentic,” or absolute certainty. A stamp makes misrepresentation harder to hide; it does not by itself prove that a human was honest in the field. You remain responsible for physical binding, supplier controls, and any Due Diligence Statement filed with authorities (including the EU Information System).
4. Free tools, and free checking forever
Checking is free, anonymous and needs no account, permanently. A stamp and a chain are checked from their own bytes on your own device; no server of ours is on that path, and we do not meter it, log it, or require you to identify yourself for it. This is a term of use, not a current price.
The browser stamp, plot and verify tools, the due-diligence desk and the demos are provided “as is”. Your files are hashed locally in your browser and are not uploaded to us for stamping. Desk records live only in your browser's storage on your device; export them yourself, because a cleared browser profile or a private window loses them. Free use does not include compliance advice or an SLA.
Hosted infrastructure (RFC 3161 timestamp relays and the Phone Sync acoustic mailbox) is rate-limited per network. Typical limits per network: 12 sealed stamps per UTC day, 16 acoustic co-presence half-reports per UTC day (a full run posts two per device), 40 hand-off mailbox posts and 30 hand-off requests per UTC day, 8 MB per file, one file at a time. These per-network limits are anti-abuse limits and are separate from the metered allowance in §5. We may tighten them without notice if abuse appears.
The hand-off mailbox. When a buyer's desk creates a request link, we run a mailbox at /api/handoff/<token> for that buyer: a supplier's phone posts a sealed plot record and its stamp there, and only the desk holding the token can collect it. We operate it as the buyer's processor; the buyer is the controller of what is deposited. It is a pipe with a time limit: a request expires 14 days after it was made (the buyer can choose 1–30 days), expiry is applied the next time the token is touched, there is no separate clean-up job, and closing a request deletes it at once. Limits: 256 KB per deposit, 20 deposits per request, 30 requests created, 40 posts and 120 reads per network per UTC day, declared-plot deposits only. Deposits are stored as they are posted; we do not read them, and that is a promise in these terms rather than a lock, until deposits are encrypted to a key carried in the request link. The mailbox cannot alter a sealed record — any alteration is refuted by any reader.
A person stamping at the plot from a buyer's request link is never charged and never blocked. We may change or withdraw free tools at any time; §6 is not affected by any such change.
5. Stamp subscriptions and the meter
For stamp subscriptions, what is metered is the upper edge of the time bracket, and only that. Every stamp carries a lower bound taken from a public randomness beacon, which costs us nothing and is always free. The upper bound comes from our RFC 3161 relay to timestamp authorities, which costs us the relay and the authority relationship. A stamp that has both bounds is a closed stamp; that is the unit you buy.
An unfunded stamp is not blocked. If there is no balance, no plan or no account behind a stamp, the record still seals, still carries its lower bound, still exports and still checks — it is one-sided, open at the later edge, which every reader shows as a gap on that edge and never as an error. A one-sided stamp binds a new envelope to a beacon round. A closed stamp adds a signed timestamp over the commitment. Older content can be included in a new envelope; neither proves its original capture time. Some profile requirements, including the osp/furniture/1 floor, ask for a bracket closed at both ends and are therefore not met by one-sided stamps. That is a property of the profile, not a restriction we apply.
Plans and prices are those published on the pricing page at the time you subscribe. A plan includes a number of closed stamps per monthly period, charged in advance. Stamps included in a period do not roll over: an unused allowance ends with the period, because what a subscription buys is that period's capacity. Top-ups are different: a top-up is a one-off purchase of closed stamps and never expires. An account draws on its included allowance first and on top-ups after that.
Past the included count nothing stops and nothing is invoiced by surprise. The account keeps stamping one-sided until the period rolls over or you buy a top-up. We do not raise an overage invoice, and there is no debt to dispute.
Cancellation takes effect at the end of the paid period. You cancel yourself, in the Stripe billing portal reached from your account page; no notice to us is needed and none is read. You keep the plan and its allowance until the period ends. After it ends the account keeps working, one-sided: you can still sign in, still stamp, still export, still read chains, and still reach everything you had made. We do not delete an account for non-payment. Refunds are covered by the cancellation and refunds page and by mandatory consumer rights where you qualify as a consumer under EU law.
API access. An API key is issued in your account, shown once, and stored by us only as a hash; we cannot show it to you again and cannot recover it. You are responsible for keeping it secret and for everything stamped with it, and you may revoke it at any time. A stamp requested with a key, a session or a buyer's hand-off request draws on that account's balance; a request with none of those returns a one-sided stamp rather than an error.
Payment and tax. Payments are taken by Stripe Payments Europe, Ltd. as our payment processor; we never receive or store your card number or Revolut credentials. Revolut Pay is a method on Stripe's pages; we are not a Revolut merchant. Prices are exclusive of VAT unless stated; VAT is determined and applied by Stripe Tax on the basis of your billing country and any VAT identification number you supply. Invoices, receipts, cards, Revolut Pay, plan changes and cancellations are all in the Stripe billing portal, which is where support for anything commercial begins and usually ends.
6. Records already made stay checkable, forever
Every stamp you have ever made stays checkable by anyone, with no account, no fee and no permission from us, permanently — including after you cancel, after we stop selling, and after we stop existing. This is not a courtesy we may withdraw; it is a term of these terms, and it costs us nothing to keep, because checking never touched a server of ours in the first place. A stamp is checked from the bytes of the record, the sealed envelope, a public randomness round and the timestamp authorities' own signatures, against keys and a specification that are published. If this site disappears, every record already sealed continues to check exactly as it did.
What this promise does not do: it does not oblige us to keep hosting a relay, a mailbox, a backup or this website; it does not make a one-sided stamp closed after the fact; and it does not make a record true. It is a promise about openability, which is the only promise that makes a format worth adopting.
7. Your account
Sign-in is a link sent to your e-mail address; there is no password for us to lose. You are responsible for the security of that mailbox and for anything done under your account. One account is one organisation's; seats where a plan includes them are for that organisation's people. You may close the account at any time, which ends the subscription at the end of the paid period (§5) and deletes what we hold under §6 of the privacy policy — never the records you have already sealed and hold yourself, which are yours and are covered by §6 above.
8. Intellectual property and the published format
The OpenStamps software, the hosted service, the licensed engine (including the Phoenix ephemeris and the sky-scoring layer), our signing keys, the website and the branding are owned by Protosonic OÜ or its licensors, all rights reserved. US provisional patent application 64/125,042 has been filed; no patent has been granted and no exclusivity over EUDR compliance is claimed.
The format is published and may be implemented by anyone. The CSTP v1 specification, the OSFP profile, the OSFP record shapes and the conformance vectors are published under a documented licence: the specification text under CC BY 4.0, the vectors and the display lint under MIT, and the wire format, profile and record shapes implementable royalty-free under the CSTP patent covenant — a unilateral promise not to assert the necessary patent claims against a conformant implementation, which is a draft for counsel until the applicant of record gives it, and which these terms do not claim is in force before then. You may write your own producer, reader or display against the published format, sell it, and never ask us. Sections 8 and 9 therefore apply to Protosonic software, hosted infrastructure, the licensed engine and the brand, and not to your implementation of the published format, profile, shapes or vectors. What stays ours, and what is open, is stated in one place: FORMAT-LICENCE.md in the specification's repository.
9. Acceptable use
You may not use the Service unlawfully, attempt to disrupt it, reverse engineer the Protosonic software or hosted service for competitive purposes, or scrape the Service for AI training or dataset construction. Text-and-data-mining rights are reserved under EU DSM Directive 2019/790 Art. 4 where applicable. Reading the published specification, profile, record shapes and vectors and building to them is not reverse engineering and is not restricted by this section (§8).
You may not use no-code scrapers, headless browsers, bulk clients, or “turn this website into an API” tools to farm timestamp relays, the co-presence mailbox, or any other hosted path. Metered stamping has a documented API (§5); use it with a key rather than driving the pages. Automated access that bypasses published caps, forges a browser origin, shares or resells an API key, or resells our infrastructure is prohibited. We may block user-agents and networks that look like that traffic, and may revoke a key that is being resold.
10. Limitation of liability, and no third-party reliance
To the fullest extent permitted by Estonian and applicable EU law, Protosonic OÜ is not liable for indirect, incidental, consequential or special damages, or for loss of profit, revenue, goodwill or anticipated savings. Our total aggregate liability arising out of or in connection with the Service, on any basis, is limited to the amount you paid us in the twelve months before the event giving rise to the claim, and is nil where you paid us nothing. Nothing in these terms excludes or limits liability that cannot be excluded or limited by law, including liability for death or personal injury caused by negligence, for fraud, or under mandatory consumer law.
No third-party reliance. These terms create rights only between you and us. A buyer, an auditor, an authority, an insurer, a certification body or anyone else who reads a stamp, a chain, an export or a printed pack we did not make for them acquires no contractual right against us and may not rely on us for the decision they take. We owe no duty of care to a person who reads a record because you gave it to them.
11. Reliance on outcomes
Every outcome this Service, its exports and its printed packs show is one of refuted, not-refuted or not-checked with a reason. A not-refuted outcome is not a finding that a record is true, legal or compliant; it means the checks that ran found no contradiction, which is also the ordinary outcome for a competent forgery. A not-checked outcome is a gap in the evidence or in the reader, never a finding against the record. A one-sided time bracket is a not-checked answer about the later edge and nothing more. A reader — a buyer, an auditor, an authority, or anyone else who acts on a light or a row — is responsible for its own reliance, for holding its own roster of trusted keys and its own reader policy, and for the decision it takes. The same notice is being written into the chain export and the sealed envelope's uncommitted metadata so that a person who never read these terms still meets it; until it is there, this section is the notice.
12. Governing law
These terms are governed by the laws of Estonia. Courts of Estonia have jurisdiction, without prejudice to mandatory consumer rights where you qualify as a consumer under EU law.
13. Changes and contact
We may update these terms; the date above will change. A change to prices or to the included counts applies to your next period, never to one you have paid for. §6 is not revocable by an update: a record already sealed keeps its checkability whatever any later version of this page says. Questions: pilot@openstamps.com.