FAIR
Receipts, not ratings. Real companies get quoted, dated, checkable receipts and never a grade. People wrote the rules; machines and AI models with stored proofs run the rest; anyone can check the result.

Live from the ledger · real companies only · fictional demo apps never count
Twelve steps. Each colour is who acts: you, a fixed rule, a machine, an AI model, the company, the public.
Anyone pastes a website or an App Store / Google Play link.
Counted once per person per day. Nothing about you is stored.
We read only the privacy or terms link the developer lists on its own store listing, or a link on the company's own homepage (same site).
We do not read anything else. The store listing or homepage is archived as the evidence for the rule.
Policy pages are archived from the company's own site, read from our server in Germany, so we receive the version served there.
Every file is SHA-256 hashed, and the ledger never overwrites it. robots.txt is obeyed.
A second, independent copy must contain the same sentence word for word: the Internet Archive's capture (at most 48 hours old, or one we ask it to take), or Open Terms Archive.
Open Terms Archive is never the only witness, gives at most one copy per draft, and is read only from collections under its open licence (ODC-By 1.0), named on every page that uses it.
Past versions from the Internet Archive are compared sentence by sentence, with both capture dates.
A change happened at some point between two captures; we never claim the exact day.
One visit to the homepage with no tap: we list the outside domains it contacts before any choice, and state the country we looked from.
Only the developer's own homepage, as named on its store listing. robots.txt is respected and a refusal stops us.
Three AI models from three different companies check each finding. Publication needs all three.
A model never judges an app made by its own company: an alternate from another company (DeepSeek) takes its seat.
For real companies, an independent AI legal reviewer (a fourth model, claude-opus-5-5, never one of the jurors) must approve the first finding about each company, every finding about an app where we have a conflict of interest, every finding that places two facts side by side, and the first 200 findings.
Every finding about children and every one of the most serious findings needs a unanimous jury, the AI legal reviewer's approval of that exact version, and 3 independent captures.
Since 2026-11-09 no step waits for a person. People wrote the rules; three AI models from three companies sign off each sentence template, unanimously, against our legal review.
We tell the company when a finding about it publishes (by email, or an open letter when it publishes no address). It has 5 working days to reply; we publish its reply next to the statement and correct any error at once.
One fixed, dated sentence with its evidence. No free text is ever published.
Messages the company sends us about its dossier are published there, with staff names and contact details removed. Anyone can challenge a finding; every error we make is logged in public.
Taxonomy v0.2.0. Neutral public names: each one says what was observed or quoted, never a verdict on it. Tap an area to see its behaviours.
Every receipt cites archived, SHA-256 hashed evidence. No citation, no finding.
The company's own terms and policies, quoted word for word: one whole sentence of at most 400 characters, from a copy we archived and hashed.
What an app or site did while we recorded it: scripted walkthroughs on synthetic test accounts, or one first look at a homepage.
Decisions by regulators and courts, quoted from the official record with its link. For a real company they stay off the page until their sentence template is signed off.
Numbers we measured ourselves: how long a policy is, how long it takes to read, how many outside domains a homepage contacted before any tap.
Not on pages, share cards, embeds or feeds. Labels next to a company describe what was observed or quoted, never a verdict on it.
Why receipts: under an EU law on ratings (Regulation 2024/3005), a grade for a real company would very probably need EU approval, while a dated quote with its source would not, so real companies get receipts, never grades.
What a real company's page can show instead:
For real companies we publish the quoted passage, its SHA-256, the capture date and a link to the Internet Archive; our full archived copies stay private and are provided to the company, a court or a researcher on request.
We built made-up apps to test every step of the method. Only they carry grades, always labelled fictional.
Abouit is run by Yokaizen LLC, which also makes Yokaizen, an AI companion app. Findings about these apps need an outside witness and the AI legal review:
If a site or an API refuses us, the record says so ("could not read") and we never get around it.
On each first look (the homepage opened once in a fresh browser from our server in Germany, with no click, scroll or consent choice) we also record the bytes the page transferred, the other domains it contacted, the bytes that came from domains on two open lists, and whether a video started playing on its own. From the bytes we show a CO2e range for one visit. Always a range with its method, never one number, never a grade or a colour.
Bytes. Every request the page made inside the window, measured by the browser as received (compressed body plus headers). Requests still loading when the window ends are counted but their bytes are not, so the total is a floor ("at least"). Nothing was cached: it is a first visit.
Lists. Abridged copies of EasyList and EasyPrivacy (GNU GPL v3 or CC BY-SA 3.0, credit the EasyList authors), keeping only rules that block a whole domain; the version is in each file under config/lists. We say a domain is on the named list; we do not decide on our own what a domain does.
Video. If a <video> is playing after the page settles, we read the bytes the browser handed to its decoders twice, 3 seconds apart; bytes × 8 ÷ media seconds = kbps. "Not measurable" when the browser does not expose the counter or the video looped.
CO2e range. The open Sustainable Web Design Model, version 4, with the same constants as CO2.js 0.19.0 by the Green Web Foundation (sustainable-web-design-v4). 1 GB = 109 bytes. Grid: 494 g CO2e per kWh, the global average grid intensity used by the model; we do not check where the servers run or whether their power is renewable.
| kWh per GB | Data centre | Network | Device | Sum |
|---|---|---|---|---|
| Use | 0.055 | 0.059 | 0.08 | 0.194 |
| Making the hardware | 0.012 | 0.013 | 0.081 | 0.106 |
Low end = GB × 0.194 kWh × 494 g (the electricity of moving and showing the bytes: about 0.096 g per MB). High end = GB × 0.3 kWh × 494 g (adds the model's share of building the hardware: about 0.148 g per MB). Both ends are rounded outward to two significant figures. The model estimates an average; a real visit varies with the device, the network and the local grid.
Under each app's Planet row, "Their climate claims" quotes any environmental claim we found on the app's own pages, and next to it the support we found, or where we looked and found none. When the company publishes its own climate report, we also show what they said (targets) and what they reported (emissions), year by year, in their own numbers.
Where we read claims. The homepage (opened once, text only, no click, from our server in Germany), the developer's description on the App Store and Google Play listings (never user reviews) and the official help articles we already archive. We look for "carbon neutral", "net zero", "climate positive", "100% renewable", "eco-friendly", carbon "offset", and "green" or "sustainable" only when the same sentence is about the climate or the environment. Each quote is checked word for word against our archived copy, with its date and SHA-256.
Where we look for support. (1) The company's own sustainability, ESG or impact page, only when its own homepage links to it on the same site, and the reports that page links. (2) The Science Based Targets initiative's public companies data, downloaded from its Target dashboard, matched only through the app's confirmed legal entity (exact legal name or LEI, never a brand name). If we find nothing, we say exactly where we looked. A parent group's report or target is shown only once the parent is a confirmed legal entity.
They said / They reported. From the company's own report (a CSRD/ESRS, CDP-style or sustainability report) linked from its own site: each target and each reported emissions figure is quoted word for word with its page, from the text of the archived PDF (pdftotext, pinned version, no OCR). Their numbers only: we do not recompute, compare, grade, colour or call a trend.
Context. EU Directive (EU) 2024/825 (empowering consumers for the green transition) adds to the Unfair Commercial Practices Directive a ban on generic environmental claims without recognised excellent environmental performance, and on claims of neutral or positive climate impact based on offsetting; Member States apply it from 27 September 2026. We cite it as context only: we do not say whether any claim breaks it. A claim with no support found becomes a finding (tactic CLM-05, "generic environmental claim without published support") only after its fixed sentence passes the automatic legal gate, a unanimous jury and the company notice.
"Record your cancel" lets anyone upload a screen recording of cancelling a subscription or deleting an account. Everything below runs on our own server with local tools (ffprobe, ffmpeg, tesseract); no outside service sees the video.
What is not verified. Abouit did not make these recordings. Who uploaded a recording, whether it was their own account, and the app, platform, country and flow they chose are stated by the uploader, never verified. We keep a one-way code of the upload's internet connection: two codes differ when two connections differ, which is not proof of two different people.
Tier: reported. Evidence submitted by users is a credible third-party report, not something we observed. It is shown on the app's page with this method, but it is never published as a receipt about the company and never counts toward a grade. Receipts about cancelling (templates SUB-02a and SUB-02b) rest only on our own recordings with synthetic test accounts.
Accepted files. mp4 or mov, 2 seconds to 10 minutes, up to 100 MB, with a video stream we can decode.
Frame sampling. 4 frames per second for recordings up to 150 seconds, 2 up to 300 seconds, 1 beyond (at most 600 frames). Each frame is cropped (the top 7% with the status bar and clock, and the bottom 5%), shrunk to 32×32 pixels and turned grey.
Distinct screen. Each thumbnail gets a gradient hash: for every pair of neighbouring pixels, across and down, one bit for "clearly brighter" and one for "clearly darker" (a difference over 4 of 255 grey levels). The distance between two frames is the number of differing bits divided by the bits set in either frame (at least 16), from 0 (same) to 1. Two frames show the same screen when the distance is at most 0.3, or when their mean grey difference is at most 1.5 of 255. A screen counts only if it stays for at least 0.7 seconds; shorter runs are transitions or animations and are dropped.
Screen visit vs distinct screen. A screen visit is each time a screen appears in order; going back to a screen already seen is a new visit but not a new distinct screen. Our sentences use distinct screens only; the record of each upload lists both.
Reading the text. We read one still of each of the first 40 distinct screens with tesseract, English only. A word is readable at confidence 60 or more; a still is readable with 5 or more readable words. Retention offers are counted only when at least half the stills are readable, otherwise we say the text was not readable. A screen counts as a retention offer when its readable words match a fixed list of English phrases (such as a percentage off, "discount", "special offer", "before you go", "pause your subscription"). Text in other languages, in images or in small print may be missed, so the offer count is a floor.
Blurring. Before anything is stored, words that look like an email address or a payment card number are pixelated (to 1/16 resolution, with an 8-pixel margin) and the stills are saved 480 pixels wide. OCR can miss words, so we cannot promise every such word is caught. The original video is deleted after processing unless the uploader asks us to keep it.
When recordings agree. One recording alone is shown as "not yet confirmed". Recordings are shown as agreeing only when 2 or more of the same app, flow, platform and country have different connection codes, different upload dates and different files (SHA-256), and distinct-screen counts within 1 of each other. The sentence uses the smallest count among them ("or more"), and is written only for cancelling a subscription with 5 or more distinct screens.
"Watch this app" emails you when a watched app's policy changes, a receipt publishes, an official decision is linked or its first look finishes: at most one email a day, one line per event. Nothing is sent until you press the link in our confirmation email; an unconfirmed request is erased after 7 days.
We store exactly this: your email address, twice (a keyed SHA-256 hash to look it up, and an AES-256-GCM encrypted copy so we can send to it), the language of the page where you subscribed, the ids of the apps you watch, and the time you confirmed each one. Nothing else: no IP address, no browser details, no opens and no clicks. Our emails carry no tracking pixel and every link is a plain link to abouit.online. They are sent through Resend from [email protected].
To erase it: every email has a link to stop one app and a "Stop all" link. "Stop all" deletes your row and every watch with it at once; stopping your last app does the same. Questions: [email protected].
Any AI assistant can read this ledger through our read-only MCP server. It answers only from what these pages publish, cites the URL and date of every item, quotes word for word and never adds grades. It uses no AI itself: it reads our public pages and fills fixed sentences.
{"mcpServers":{"ask-the-ledger":{"type":"http","url":"https://abouit.online/ledger/mcp"}}}
Claude Code: claude mcp add --transport http ask-the-ledger https://abouit.online/ledger/mcp. Plain JSON: /ledger/apps, /fair/apps.json and /fair/<app>.json.
Nothing about a real company is published with a template until it is signed off after a legal review: since 2026-11-09 by our automatic legal gate (three AI models from three companies, unanimous, checking each template against our written legal review; the proof is stored and checked on every load). Sign-off is per template, and any later edit to the file voids it.
signed Signed off for real companies by legal-gate v1 on 2026-11-09: CLM-02a, POLICY-a, RECORD-a.
Detectors read measured values (screen counts, prices, timers). The writer fills one of 43 fixed sentence templates; no free text is ever published. A policy quote is always one whole sentence of at most 400 characters, and a clause the document limits to readers in another region is never drafted.
Each published sentence is filled by software from a fixed template approved by Yokaizen LLC, and checked for publication by AI models from three different companies; all three must agree. Each receipt page says whether a person also reviewed it.
Each day a Merkle root over every ledger record is hash-chained to the previous day and signed.