X-39 Evidencia for Android

Photos, audio, video or any file, sealed on your phone. Version 0.3.3, published on 8 October 2026, in seven languages. Android 9 or later.

What it does

You take a photo, record audio or video, or pick a file. It is stored encrypted on your phone and never leaves it: only its SHA-256 hash travels.

Every item is signed with ML-DSA-87 (FIPS 204) using a key created on the phone. No account and no cloud copy.

The hash is anchored in Bitcoin through OpenTimestamps. Anyone can verify the receipt with public tools, without this app and without trusting us. It is proof of existence, integrity and date; it does not replace a notary or a qualified electronic signature.

Download

The APK is downloaded from this site, and is also published on GitHub with its SHA-256, the signing-certificate fingerprint, the qualified timestamp and the OpenTimestamps proof. Check the fingerprints before installing.

Download x39-0.3.3-release.apk (6.3 MB) from x39matrix.org

The same version on GitHub, with the verification files

APK SHA-256: 4c5c3a321a97f8bb45a83b5f8c878d27608b23499921df52fa079212ef330f03

Certificado de firma SHA-256: 72f0745f993605b1b3cd30966162b6d98d84fcacbd23e2e07e24c3d15f7d8935

x39-0.3.3-release.apk.sha256x39-0.3.3-release.apk.tsrx39-0.3.3-release.apk.cadena.pemx39-0.3.3-release.apk.otsanf_root.pem

Two clocks on the same APK

Qualified timestamp (RFC 3161, eIDAS) issued by ANF AC on 2026-10-08 at 17:55:20 UTC, verifiable with openssl against the ANF root, published next to the APK.

Bitcoin anchor: block 970517, checked against our own node. Verifiable with the OpenTimestamps client and any Bitcoin node.

Verify the APK

With the release files in the same folder:

sha256sum x39-0.3.3-release.apk
apksigner verify --print-certs x39-0.3.3-release.apk
openssl ts -verify -data x39-0.3.3-release.apk -in x39-0.3.3-release.apk.tsr -CAfile anf_root.pem -untrusted x39-0.3.3-release.apk.cadena.pem
ots verify x39-0.3.3-release.apk.ots

Permissions (7)

INTERNET, ACCESS_NETWORK_STATE, CAMERA, RECORD_AUDIO, FOREGROUND_SERVICE, FOREGROUND_SERVICE_SPECIAL_USE and POST_NOTIFICATIONS.

Internet is used to send hashes to the OpenTimestamps calendars and fetch the proofs (optionally only over Tor, with Orbot) and for the encrypted chat line. Photos, videos and files are never uploaded. No Google and no AndroidX: no Play Services, no Firebase.

Code

The verifier, the web and the API are on GitHub (x39-Evidencia, AGPL-3.0). The app code will be published in its own repository; every version ships with its fingerprints and its two seals.

X-39 Comunicaciones (separate app) →← Back to X-39 Evidencia