Tenon Cam

What does the stamp record?

The overlay is composed before the file is written, so the stamp is part of the image rather than a layer sitting on top of it. There is no version of the photo without it and no switch that removes it after the fact.

Fields are set per project. A demolition record may need coordinates and a street address; a snag list may need only the date and the project name. Whatever is switched on when the shutter fires is what lands in the pixels.

Time is the field most worth being careful about. When a connection is available the app cross-checks the device clock against a network time source and the stamp records that it did. Offline, the stamp says it is device time. It never claims an authority it did not have.

• Time and date, marked with which clock the stamp trusted
• GPS coordinates, and the street address they resolve to
• Project name and a short free-text note
• Your own company logo, positioned and sized from a fixed grid

Timestamp cameras without ads or forced logos

Advertising is the largest single complaint in this category, and not by a small margin. In the Tenon Tools Phase 0 review study, 1,906 critical reviews across 17 apps match the ads hypothesis — 11.8% of the 16,158 critical reviews collected for timestamp and GPS field cameras. No other pre-declared theme in the category clears 1%.

Forced vendor logos are a separate and much smaller theme: 40 critical reviews across 12 apps, 0.25% of that category's critical reviews. Forty is a small number and is printed as one. It is also a specific complaint — the app maker's mark ending up on the customer's photo — and it is the one Tenon Cam answers by stamping your logo and never ours.

One disclosure before the comparison. Tenon Cam has not been released and has no reviews, no ratings and no users. Setting our numbers next to the numbers of apps that have shipped would be dishonest in our favour, so this comparison is on published policy only: what the app charges, whether it serves ads, whose logo goes on the photo, and whether it needs a connection. Those are commitments we can make before launch. Quality is not a claim we have earned yet.

For what it is worth on the other side of the ledger, the study's teardown of the three apps closest to this position — Timemark, Timestamp It and Solocator — found that none of them combined all four properties. Solocator came closest, at a $0.99 list price with zero ad complaints in its 574 reviews, and still drew 9 forced-logo complaints and no PDF-export mentions at all.

• Subscription — none. One payment unlocks the paid tier permanently. There is no monthly plan, no annual plan and no feature that lapses.
• Ads — none, in the free tier or the paid one. The category's top complaint is not a lever we intend to pull later.
• Whose logo — yours, or none. Tenon Tools does not appear on your photo, in either tier, at any price.
• Connection — not required. Capture, stamping, sealing, projects, the PDF binder and the ZIP export all work in airplane mode.

How does the seal work, and what does it not prove?

The mechanism is simple enough to describe in full, which is the point: a verification claim you cannot explain is a verification claim you should not trust.

At capture the stamp is drawn into the image. The app then takes those image bytes, strips every EXIF field from them, and computes a SHA-256 digest — a short fixed-length fingerprint that changes completely if any byte of the image changes. Stripping EXIF first matters: EXIF holds fields that phones and photo apps rewrite for ordinary reasons, and hashing them would make honest files look altered. The digest is written into the file's metadata as a seal, and stored again inside the app's own capture record, which is a second witness that does not travel with the photo.

Checking runs the same operation in reverse. Open the photo in Tenon Cam; it strips EXIF again, re-hashes the image bytes, and compares the result against the embedded seal and against the capture record. If the digests match, the image is byte-for-byte the one the camera wrote. If they differ, something re-encoded or edited the file, whether or not anyone intended to.

Be clear about the size of that claim. It is a statement about the file, not about the world. Tenon Cam is tamper-evident — alteration becomes detectable — and that is the strongest word for it. It is not a legal instrument, it does not make a photo admissible anywhere, and whether any photograph counts for anything in a dispute is decided by the process it is submitted into, never by the app that took it.

The reverse case matters just as much. A photo with no seal is not evidence that anyone tampered with anything. Messaging apps, email clients and social platforms re-encode images and strip metadata as routine behaviour, so a photo that travelled through a chat thread will usually arrive with its seal gone and its bytes changed. That is normal. When the seal is meant to survive, send the original file or the PDF binder rather than a chat copy — and keep the original on the device, because it still verifies against the capture record either way.

• Shows: the image bytes are identical to the ones written at capture.
• Shows: the visible stamp is the one drawn at capture, because it is part of those same bytes.
• Does not show: what was actually in front of the lens.
• Does not show: that the device clock or the GPS fix was correct. The stamp records what the phone reported, and marks whether the time was network-checked.
• Does not create: any legal status. A missing or broken seal is not proof of tampering.

What is the PDF binder?

A binder is one PDF holding a project's captures in the order they were taken, each printed large enough that its stamp is readable. It is the thing you attach to an email or hand to a client at the end of a job. A camera roll is not that, and neither is a chat thread with forty photos in it. The same project can also leave as a ZIP of the original sealed files, for anyone who wants to check them.

Honesty about the evidence here: the corpus does not show demand for this. Export and reporting is only the ninth-ranked emergent theme in the field-camera category, at 88 mentions and 0.54% of its critical reviews, and the binder idea is essentially unmentioned across the three closest apps in the teardown. We build it because a job that ends in one document is more useful than a job that ends in a folder of pictures. That is a judgement, not a finding, and it is labelled as one.

Offline by default, and what actually leaves the phone

Capture, stamping, hashing, verification, projects, the binder and the ZIP all run on the device. There is no account to create, nothing to log into, no sync and no server holding your photos. No photo, project, note or binder is uploaded anywhere by the app.

Two things do touch the network when one is available, and it is more useful to name them than to say nothing ever leaves your device.

Turn either field off and the corresponding request stops being made. Neither one sends a photo.

• Reverse geocoding — turning a GPS fix into a street address asks the operating system for the address, and the OS may ask its own map service in turn. The coordinates themselves come from the device's own satellite receiver and need no connection.
• Network time check — when a connection exists, the app queries a network time source so the stamp can record which clock it trusted. It sends a time query and nothing else: no image, no location, no identifier.

The free tier, and what the one-time unlock buys

The free tier is a working camera, not a trial. One project, unlimited stamped photos at full resolution, the complete overlay including your own logo, a seal on every capture, and no ads anywhere in the app. Nothing expires and nothing is watermarked by us.

The unlock is $6.99, or 6,99 € in the euro zone, paid once. It adds unlimited projects and the PDF binder export. There is no monthly option, no annual option and no consumable to buy. The purchase is handled by the App Store or Google Play, so Tenon Tools never sees a card number, and the standard store restore flow moves it to a new device.