This example shows why “contacted a domain” does not automatically mean “sent location”.
We compare the service outcome and connections after refusal with the state before choice. A non-observation remains a non-observation; it does not become a claim that a service can never appear.
Permission was not granted. transit-cloud.example remained contacted when the manual route was calculated.
Select a state to compare the three sources at the same moment. All states remain available when JavaScript is disabled or the receipt is printed.
The map loaded at city level.
The policy names the mapping provider.
The store label declares optional approximate location.
The phone contacted tiles.maps.example and transit-cloud.example.
connection observedLimit: Traffic to transit-cloud.example remained encrypted and pinned.
The journey could be entered manually.
The policy promises manual entry of points.
The store label declares location as optional.
Permission was not granted. transit-cloud.example remained contacted when the manual route was calculated.
permission and connectionLimit: Continued contact does not establish that device location was transmitted.
The origin was filled from device position.
The policy describes using position for the origin.
The store label declares approximate location.
The connection to transit-cloud.example had a different size, but the payload could not be read.
metadata onlyLimit: A different size does not prove that position was transmitted.
After permission revocation, manual journeys remained available.
The policy says the user can revoke permission in system settings.
The store label does not detail withdrawal.
The app requested permission again only when “my location” was used.
screen and permissionLimit: Server-side journey retention was not tested.
A domain, infrastructure owner and legal recipient are different propositions. Each relationship carries its own provenance state.
tiles.maps.examplethird partyMap-tile requests were observed; no readable personal data.
transit-cloud.exampleunresolved relationshipThe destination was observed; TLS pinning prevented field-level determination.
Claims are stored separately so a response, correction or retest can change one proposition without silently rewriting the rest.
Maximum wording: We cannot say location was transmitted in either state.
The actor, minimum change and verification test remain attached to the original claim.
REP-CAL-201
Publish the route backend’s contractual role and data categories.
Documentary verification; no app change is necessarily required.
bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
A real receipt would link every public claim to a sanitised evidence artefact and retain raw captures in a restricted vault.