Frequently asked questions

A cryptographic signature is applied to the file at the moment you upload, using your authorship claim and the platform's signing certificate. The signature is embedded inside the file itself, using the C2PA standard. The file's bytes carry an authoritative record that this specific file, in this specific state, was uploaded to ArcVelvet at this specific timestamp under your authorship claim.

A verifier (anyone with a C2PA-conformant tool) can read that record without involving ArcVelvet, and can confirm: who claimed authorship, when the file was signed, whether the file has been modified since signing, and what tool-chain disclosures the creator made at signing time.

The cryptographic record is inside the file, not on a distributed ledger. There is no token. There is no wallet. There is no gas fee. Verification does not require an internet connection to a specific blockchain or a specific service. Anyone with a C2PA reader and a copy of the file can verify the signature offline.

The deeper philosophical difference: blockchain-based provenance proves that a record exists on the ledger. C2PA-based provenance proves the integrity of the file itself, using a signing chain that goes back to a recognized certificate authority. The first is about the existence of a registry entry. The second is about the file. ArcVelvet chose the second because the file is what travels.

Copyright registration is a legal procedure handled by a copyright office (the U.S. Copyright Office, for example) that creates a legal record of your claim. The benefits include the ability to sue for statutory damages and the establishment of an evidentiary baseline.

A C2PA signature is a cryptographic record that creates a verifiable timestamp and an integrity check on the file. The benefits include independent verifiability, no dependence on a registry being online, and detection of modification after signing.

The two are complementary rather than substitutes. A creator can register their work with the Copyright Office and sign the same work on ArcVelvet. The signature gives you something the registration does not (cryptographic proof the file has not been altered) and the registration gives you something the signature does not (a recognized legal record). We recommend both for work where it matters.

Work that has associated sales is preserved with your authorship attribution replaced by "Account Deleted" in the platform's user-facing surfaces. The cryptographic record stays intact. Buyers retain their ability to verify what they purchased.

Work without associated sales is deleted from the platform's surfaces. The signed files you have already published elsewhere remain valid (the signature does not depend on ArcVelvet hosting the file; verifiers work without us).

There is a 30-day grace period between requesting deletion and the actual deletion taking effect. You can cancel during that window. Funds in your wallet at the time of deletion attempt a Stripe payout; if that fails, they go into a 12-month escrow that you can claim by email-verified request. The full deletion policy is at /trust.

Yes. The signed file is the proof. Send the file to anyone with a C2PA reader (Adobe's Content Authenticity inspector is a browser extension; contentcredentials.org is a web tool that accepts file uploads). They can verify the signature, the timestamp, and your authorship claim without any involvement from ArcVelvet.

This is the architectural commitment behind the platform: the file is the artifact of record. The platform is where signing was convenient. The proof travels with the file.

The honest answer is that a signature on a file does not prevent theft. It changes what you can prove afterward.

If someone re-uploads your signed file as their own, the signature still verifies as yours. A buyer, a journalist, or anyone who can run a C2PA verifier on the file can see who signed it and when. The thief is in the position of trying to monetize a file that cryptographically claims someone else as the author.

If someone strips the signature and re-uploads the bare bytes, the act of stripping leaves an absence that is itself meaningful (the file lacks the manifest a signed file would have). You retain the original signed copy on ArcVelvet as the reference.

For active enforcement (takedown requests, copyright claims), the signature is useful supporting evidence but not a substitute for legal process. The DMCA notice-and-takedown process is documented at /dmca with the required notice elements and the counter-notice path. Contact the team through the Contact Support form if you need help responding to a specific incident.

C2PA is the Coalition for Content Provenance and Authenticity, an open standards body operating under the Linux Foundation's Joint Development Foundation. The coalition publishes a specification (currently at version 2.2) that defines how cryptographic provenance records get embedded in digital files, how they get verified, and how they travel between creators, platforms, and viewers.

The membership includes Adobe, Microsoft, Sony, Nikon, Leica, the BBC, the New York Times, Reuters, and many others. ArcVelvet implements the C2PA specification as a practitioner. The standard is open; the implementation is open-source (the c2pa-rs library is the reference implementation). Anyone who wants to read or verify a C2PA signature can do so without paying or asking permission.

Yes. The signature itself does not change based on whether AI tools were involved. What changes is the disclosure inside the signed manifest. Creators can declare which AI models, prompts, source materials, or collaborators were involved in producing the work. The disclosure becomes part of the signed record, verifiable in the same way the signature is verifiable.

The posture is informed by the Thaler v. Perlmutter ruling: under U.S. law, copyright requires human authorship. The C2PA signature records the human's authorship claim and the disclosed tool-chain. It does not adjudicate whether the work is copyrightable. That question lives between the creator and their counsel.

Practically: if you used AI as a tool the way a photographer uses a camera, sign the work and disclose what you used. If you generated something with no meaningful human authorship contribution, the signature still attaches a timestamp and an integrity check but the copyrightability question is for the law to settle, not the platform.

Anyone with a C2PA-conformant verifier. The three readily available options:

Adobe Content Authenticity inspector. A browser extension and a web tool at contentcredentials.org. Reads the embedded C2PA manifest and presents the verification result in plain language.

contentcredentials.org. A web tool that accepts file uploads and returns the verification result. Maintained by the C2PA community.

ArcVelvet's own verifier at /verify. The same verification logic, served from the platform, returning a structured JSON envelope describing the signing status, the certificate, the conformance level, and the credential format.

A verifier does not need permission, an account, or any specific relationship with ArcVelvet to verify a signature. The standard is open.

ArcVelvet uses email magic-link authentication. There is no password. The first time you sign in, you enter your email and the platform sends you a one-time link. Clicking the link signs you in. The same flow works whenever you want to sign in from a new device.

There is no "forgot password" link because there is no password to forget. The email is how you prove who you are. If you lose access to the email account, contact arcvelvet@arcvelvet.com from a different address and we can help you recover access.

Two-factor authentication is available for accounts that want it (SMS or authenticator app), with ten recovery codes generated at enrollment. The MFA option is in your profile settings.

Today, no. The username you chose at signup is the one your account uses. We know this is a real constraint, and a rename flow is on the platform backlog. The honest reason it has not shipped yet is that uniqueness of usernames is not enforced in the data layer today (the share URLs at /@{username} handle the rare collision case by resolving to the oldest matching account), and a rename flow needs a coherent uniqueness migration before it can ship without breaking older share links.

If your username situation is urgent (impersonation risk, life-event name change), contact arcvelvet@arcvelvet.com and we can help case-by-case.

AE is the platform's internal currency for tipping creators, unlocking content, supporting work, and purchasing cosmetics (auras, skins, sky themes). The name is shorthand for "ArcVelvet energy" and is intentionally framed as an interaction medium rather than a speculation vehicle.

You earn AE by participating in the platform: receiving tips on your signed work, completing onboarding milestones, and through periodic platform-promotional credits for early-tier creators. You spend AE by tipping other creators, buying cosmetics, unlocking tier-locked content, or purchasing rights to other creators' work.

There are two kinds of AE in your wallet. Withdrawable AE is the portion you have earned through real economic activity (sales, tips); on deletion, this portion attempts a Stripe payout and falls into 12-month escrow if the payout fails. Non-withdrawable AE is the portion from platform-promotional credits; this portion is for spending on the platform and is forfeit on deletion. Both balances are shown in the deletion preview before you confirm anything.

Email arcvelvet@arcvelvet.com. There is a "Contact Support" link in the desktop footer and inside the deletion-confirmation modal that does the same thing. The team is small and we read every message. For security issues, see /security-policy. For accessibility feedback, see /accessibility. For general questions, the email is the right path.

A Firestore-backed ticket modal is on the roadmap; for now, mailto is the surface. Replies come from a human, usually within a day or two.

The platform uses a small set of third-party services to operate: Firebase (Google) for hosting, authentication, database, and Cloud Functions. Stripe for payments. PostHog for product analytics. Resend for email notifications. The privacy policy at /privacy documents what data each service receives.

We do not sell your data. We do not run advertising on the platform and we do not share your data with advertisers. The PostHog analytics integration is gated by an explicit cookie-consent banner that links to both our privacy policy and PostHog's own privacy policy. The platform respects the Do Not Track browser header (when DNT is on, PostHog does not initialize at all).