About anonymous COA submissions.

What happens to your submission.

You drop a PNG, JPG, or PDF. We sniff the magic bytes (so a renamed .exe can't slip through), dedup against everything we already have, and queue it. A worker strips EXIF, XMP, and PDF author/producer metadata before storage; the same worker runs the file through ClamAV before any pixel is OCR'd.

Gemini Flash handles the OCR. Our pipeline then cross-checks the parsed purity claim against the raw OCR transcript to catch tampering and prompt-injection attempts — a vendor who watermarks "ignore previous instructions" into the margin doesn't get a free pass. An automated PII redactor scrubs any names, addresses, or order numbers before storage. As of 2026-05-10, anything that survives the safety filters auto-publishes; only forgery and prompt-injection are hard-blocked.

Most submissions move from "queued" to "published" in about 90 seconds — there is no human moderation step. User-submitted COAs land in our corpus at the community trust tier — the same weight we give Telegram channel and forum-attachment evidence (15% of the vendor score). Real lab COAs from Janoshik and Finnrick always outweigh user submissions in the math.

Why we don't ask who you are.

A Certificate of Analysis is its own evidence. We don't need to know who submitted it — the document either says what we can OCR, or it doesn't. The trust signal is the file, not the submitter. So we don't ask for an account, an email, or anything else. We never want a "real-name database" of people who happen to know what's in their vials.

For abuse prevention we hash your IP weekly with a rotating salt and store only the hash. The plaintext IP never lands on disk; the salt rotates so the hash itself can't be used to follow a submitter across weeks. There is no third-party captcha — your browser solves a small SHA-256 puzzle locally so we don't have to send your traffic through Cloudflare's edge to filter it.

The things we won't do with your file.

• No resale of your file, the OCR text, or any derivative product to third parties — ever.
• No use of your submissions to train external ML models or feed partner pipelines.
• No attempt to de-anonymize you — that's the entire point of the design.
• Raw files are deleted after 90 days. The redacted OCR transcript stays in the public corpus.
• Takedown requests at abuse@titratelab.com are honored within 7 days. Reference your submission_id; we'll redact the corpus row and remove the raw file.