Trust by construction
What gets shared.
What never does.
Every TiltView-powered deployment ships with the same trust commitments by default. This page explains what they are in plain English — the kind of explanation a collector should be able to read in two minutes and feel safer.
When a collector shares
The recipient sees the artifact. Not your account.
Every share moment produces a server-rendered image and a signed URL. The artifact is the thing — nothing else leaks.
Card art and rarity
Signed share tokens
Deterministic content
Server-side rendering
Handle attribution
Watermark, built in
What stands behind each one →
The card itself
The card you pulled is the focus. Its art, its tier color, its set name, your handle if you chose to include it. That's the whole payload.
Signed share tokens
Every link is signed and tamper-proof. Recipients hit it anonymously — no login required to view. The token is unguessable; sharing it is a deliberate act.
Deterministic content
The artifact the recipient sees in six months still renders correctly when our engine has moved on. Content is derived from the catalog, not from a snapshot that goes stale.
Server-side rendering
The image generation happens on our servers, not in the recipient's browser. No third-party scripts run. No fingerprinting.
Handle attribution
If you choose to include your handle, the server attaches it — your browser can't impersonate someone else's identity into a share.
Watermark, built in
Every share image carries a faint diagonal handle watermark, so reposts keep attribution and full-quality art never travels unmarked. Partners can tune it per surface.
What never leaves the chassis
A short list of things you'll never find in a share artifact.
Some data simply doesn't ride along — built so it never enters the pipeline in the first place.
The full card video file
Marketplace prices
The raw catalog
Your collection unless you choose to show it
Bulk lookups
Cross-site tracking
Why each one stays out →
The motion file
A card with a motion treatment shares as its still poster. The underlying video stays gated behind ownership and a login — recipients see the frame, owners see it move.
Marketplace prices
When the marketplace shows activity on an unowned card, the chassis surfaces counts only — never dollar amounts. The signal is discovery, not pressure.
The raw catalog
The card library isn't crawlable or enumerable through the share URLs. A recipient with a share link sees that specific share; they can't fish for everything else.
The rest of your collection
A pull-share shows the pull. A profile share shows what you pinned to your showcase wall. Anything beyond that stays private until you decide otherwise.
Bulk lookups
The marketplace contract returns activity for one card per request — not a feed of every card across the catalog. Bulk-harvest bots get rejected; legitimate unfurl scrapers from Discord, Slack, X, iMessage, LinkedIn are allowlisted.
Cross-site tracking
The shared artifact doesn't embed third-party trackers. Hitting a TiltView share URL doesn't deposit you into someone's ad-targeting graph.
When a recipient lands on a share URL
No login. No paywall. No surprise.
Anyone you send a share link to lands on it anonymously. They see what you intended.
No auth wall
No tracking pixels
Re-renders correctly later
How that lands in practice →
No auth wall
The recipient doesn't need an account to view what you shared. No sign-up modal, no email-gated content. They tap the link, they see the artifact.
No tracking pixels
The unfurl on Discord, X, or iMessage doesn't deposit a tracker on the recipient's device. Server renders the image, image loads, that's the transaction.
No link rot
The link sitting in a months-old group chat still resolves, and the artifact it opens looks the way it did the day you sent it. Old shares don't decay into broken images.
Partner trust controls
The deployment owner gets the dial.
Defaults always favor the collector. Partners can dial individual settings — through a written agreement.
Watermark on shares
Marketplace activity
Profile visibility
Synthetic personas
Telemetry
What each dial controls →
Watermark on shares
On by default, on every shared image. Partners can adjust per surface (pulls, profiles, milestones).
Marketplace activity
Off by default unless a marketplace integration is connected. When on, counts only, never prices.
Profile visibility
Off by default. Each collector opts into making their profile public. Partner deployments can choose whether to expose the opt-in at all.
Synthetic personas
Used for demos and stakeholder reviews. Real collector identities never appear in synthetic-persona surfaces.
Telemetry
Usage signals stay in the partner's deployment — Nexus Game Theory never receives them in identifiable form.
For the people who own the art
Full-quality assets never reach non-owners.
Collectors get the promises above. The studio or artist whose work rides on the cards gets these five — built into the platform before any deal term asks for them.
Silhouettes until ownership
A collector browsing cards they don't own sees a silhouette and a deliberately degraded thumbnail. The full-quality asset renders for owners only. The gap between the teaser and the real thing is the whole reason to chase it.
Watermarking you don't have to ask for
Shared images leave the platform already marked — the dial above defaults to on, and loosening it takes a written agreement. A screenshot that escapes a group chat still carries the handle of the collector who shared it.
Share links that can't be forged
Every share URL is signed, so it can't be tampered with or fabricated. Nobody can mint a working link to art that was never shared, and editing one to point somewhere else just breaks it.
Rate-limited image endpoints
The endpoints that serve card images watch their own traffic. A scraper trying to harvest a set hits a wall long before it assembles a library, while collectors browsing at human speed never feel it.
Marketplaces get a card ID, nothing else
When a deployment wires in a marketplace integration, the only thing that crosses the boundary is a card identifier. The marketplace never holds image masters or collector identities — it can reference your art without ever touching it.
The convention
Every TiltView footer links here.
Every deployment on TiltView links to this page from the footer of every screen.
Why the convention is enforced →
A collector shouldn’t need to remember which app they’re standing in to find the rules. Wherever they are in the family — a publisher’s branded deployment, our own apps — the trust contract is one tap away, whether that’s this page or the partner’s own equivalent.
If a partner deployment somehow forgets to include the link, the platform adds it automatically, so the convention can’t be quietly dropped during integration.
Question about how this applies to your IP?
Trust is the part of a deal we’d rather over-discuss than under-discuss. Reach out and we’ll walk through your specific concerns.