Your symmetric record of what you signed up for.

Yes. You don't need to re-prove the charge was yours — whoever is billing you (your bank, PayPal, Apple, Google Play, or another payment processor) already knows that. The dispute or refund form ties your identity to the transaction.

What the ColdStamp bundle proves is something they can't see on their own: what the merchant's checkout page actually showed at the moment you clicked. That is the part you have always lacked in a dispute. With the bundle, you have a structured, timestamped, tamper-evident record of pre-ticked boxes, buried renewal terms, and the real payment request the page sent.

To help you recognise which bundle corresponds to which account, each bundle includes a partial hint of the email you used (e.g. an…@gmail.com) without exposing the full address.

Three reasons. First, if a bundle file ever leaks — forwarded email, a breached inbox, an exposed forum post — you don't want your full card number sitting in plain text inside it. Second, storing card numbers in user-facing files would put ColdStamp under PCI rules; redaction keeps the tool firmly outside payment-handling regulation. Third, the merchant and whoever processes your payments already have the card — re-storing it on your side adds risk without adding evidence.

Open the extension popup, find the bundle for the disputed merchant, click Export to download the JSON file. Attach it to whichever dispute or refund form you're filling out. In the claim text, point to the specific findings — for example: "Recurring add-ons were pre-ticked and never interacted with (see controlState entries where defaultChecked: true and userInteracted: false). The recurring price was buried in 11px grey text, while the headline displayed $0 today."

Card-issuing banks weigh disclosure quality at the point of sale under Mastercard and Visa dispute rules. App stores and payment processors apply their own subscription and refund policies, but the underlying question — did the user understand what they were agreeing to? — is the same. A structured DOM snapshot is stronger evidence than a pixel screenshot, because it captures the actual page state and the real payment request the page sent.

Many subscriptions you sign up for in a browser are actually processed by Apple, Google Play, Amazon, or a similar intermediary rather than charged directly to your card. ColdStamp captures the web-checkout step the same way regardless of who ultimately processes the payment.

The dispute path is different — instead of contacting your bank, you request a refund through the store (Apple: Report a Problem; Google Play: Order history → Report an issue). Attach the exported bundle and quote the specific finding (pre-ticked recurring opt-in, buried renewal price, mismatched total) in your reason for the refund. App stores explicitly accept structured evidence about unclear or deceptive checkout flows in their refund decisions.

No. ColdStamp never talks to your bank, your card provider, your Apple or Google account, or any merchant's account system. It reads the page in your browser, on your device, only when that page looks like a checkout. There is no ColdStamp server.

Bundles are stored only on your device. If you uninstall the extension, clear your browser data, or switch computers, the existing bundles will not follow. We recommend exporting any bundle you might want for a dispute and saving the JSON somewhere durable (e.g. a personal cloud drive) — those exports are entirely under your control.

A future version may offer encrypted cloud backup as an opt-in, where the encryption key never leaves your device — so even we could not read the backup. That is on the roadmap, not in the current release.

The content script runs on any page you visit, but exits immediately if the page doesn't look like a checkout. It does not read other tabs, your browsing history, or any data outside the active checkout page. The full source code is open for audit at github.com/antonefremov/coldstamp.