Burn GPS, Time and Notes into a Photo | Prooflens

The short answer

Prooflens is an iOS camera that writes the capture context into the pixels of the photo at the moment of the shot — date, time to the millisecond, GPS coordinates, altitude, and a free-text line for a case number or note. The watermark block's position and each field's on/off state are configurable, and five presets ship (two free, three in Pro). Nothing is added afterwards: the watermark is rendered into the frame before the JPEG is encoded, so there is no clean original sitting anywhere.

What that buys you is legibility, not trust. The cryptographic half of Prooflens — the SHA-256 hash, the RFC 3161 timestamp, the Bitcoin anchor — is what proves the file did not change; the watermark is what tells an inspector, a client or a court clerk what they are looking at without installing anything. Both are in the same photo, and they answer different questions.

If you would rather try it than read about it, Prooflens is on the App Store and the product page has the short version.

Why people search for "burn GPS into a photo"

The obvious way to attach a place to a photo is EXIF metadata: invisible, free in pixels, and written by every phone. People search for a burner instead because EXIF does not survive where evidence actually travels:

• Messaging apps rewrite images. Most re-encode what they receive, and the metadata goes with it.
• Screenshots lose it. The pixel survives; the sidecar does not.
• A coordinate alone is not self-evidencing. A string of digits in a metadata table can be edited without touching the picture. A coordinate rendered into the picture cannot be changed without changing the picture.

The other half of the query is about the third party: search-and-rescue teams, surveyors and adjusters read coordinates differently, and 31.2304°N · 121.4737°E means nothing to someone who works in MGRS. Prooflens addresses both halves — a legible block on the image, and a choice of coordinate format in settings.

The order of operations, which is the whole point

Knowing when the watermark is applied is more important than knowing that it is. In Prooflens's capture path the sequence is fixed:

1. Press the shutter; if a timer is set, a countdown runs first and the shot happens when it reaches zero.
2. The raw frame is cropped to the viewfinder's aspect ratio (4:3 or 1:1) first.
3. The watermark is rendered onto the cropped image, using the live GPS fix.
4. The composited image is encoded as JPEG at the chosen quality — High (0.95) or Maximum (1.0). There is deliberately no lower rung.
5. The SHA-256 is computed over those exact JPEG bytes — the watermarked ones.
6. The record and the image are saved locally, then signing runs asynchronously.

Two consequences follow. The crop-before-watermark order means the watermark is never half cut off by the frame. And because the hash is taken over the composited file, the burned-in text is inside the thing being proven — a later edit that touches a single pixel of the date line breaks the hash. The manifest also gets its own SHA-256, so the metadata cannot be swapped out from under the picture.

What the watermark actually looks like

The block is deliberately plain so it reads on any background: a 58%-opaque black rectangle, a 3pt green bar on its leading edge, white text at 90% opacity in a monospaced medium face (or the system sans, per template), inset 16pt from the frame — no shadow, contrast from the block itself. Fields render only when they have a value to render, which is where most surprises live:

• Date — yyyy·MM·dd, UTC.
• Time — HH:mm:ss.SSS, UTC, milliseconds included.
• GPS — four decimal places, and only when both latitude and longitude are present. A lone latitude is dropped rather than printed on its own.
• Altitude — one decimal place in metres, and only when the device reports one.
• Custom text — rendered only if non-empty; this is where a case number goes.

Two things worth knowing up front. First, the time is UTC, not your local zone: a shot taken at 09:00 in Shanghai burns as 01:00. The manifest carries the capture instant, so the record — not the pixels — is the authoritative time, but anyone reading the photo cold will not know that. Second, the rendered line drops the sign and appends a fixed hemisphere suffix, so a southern or western coordinate is labelled N/E on the burned line. The viewfinder preview and the manifest keep the true signed value; verify your first capture against the preview.

The active project name appears in the viewfinder overlay and is recorded in the manifest, but it only lands in the photo's pixels if you put it in the custom text field.

The five templates, and where the free line sits

A template is a preset set of fields, position and font. Five ship:

• Forensic (default, free) — every field, monospaced, bottom-left. The template the product's name promises.
• Minimal (free) — date only, system sans, bottom-right.
• Compact (Pro) — date and time, no GPS. Sized for indoor evidence where a coordinate is noise.
• Job Site (Pro) — every field, monospaced, top-right, out of the way of people and equipment.
• Insurance (Pro) — date and GPS, no time, system sans. Sized for claim documentation.

Free covers Forensic and Minimal plus unlimited captures and 30 RFC 3161 timestamps a day. Pro adds unlimited timestamps, Bitcoin anchoring, the other three templates, and the .zip and PDF export — at $14.99/year in the US base territory with a 7-day free trial, or a one-time $49.99 lifetime purchase (territory pricing varies). Two of five templates is enough to see whether the idea fits your workflow before paying for it. Selecting a gated template presents the paywall and leaves the current selection untouched, so a locked template never half-applies.

GPS format: offered in settings, fixed on the image

Account settings expose a GPS format picker with three options and worked samples: Decimal (31.2304°N · 121.4737°E), DMS (31°13'49"N · 121°28'25"E) and MGRS (51S TU 91123 47834). The selection is persisted and defaults to Decimal.

The honest limit: the burned-in line is rendered in decimal degrees at four decimal places regardless of that setting. The renderer receives the watermark's position, fields, text, font, size and opacity — not the format preference. For a general-audience photo that is the right default. For a search-and-rescue or survey workflow that needs MGRS burned into the pixels, this page should not be read as saying Prooflens does it.

Where the watermark stops

The watermark is a rendering on top of the pixels, so it can be cropped away or edited out by anyone with an image editor. It is not tamper-evident, and no one claiming otherwise is being honest. That is what the hash, timestamp and anchor are for. Keeping both means the evidence is verifiable and comprehensible — the receiving party usually needs the second one more.

Other edges worth knowing:

• GPS is whatever CoreLocation last reported. Nothing gates the shot on accuracy, so on a fresh fix or indoors you may burn a stale coordinate. The settings sheet is candid about this: it reads "Waiting for fix" until it has one, then shows the live accuracy as ±N metres. Waiting for the reading to settle before pressing the shutter is the practical habit.
• Altitude is relative to the WGS-84 ellipsoid, per CoreLocation. Standard, but not "above sea level" as a building contractor means it.
• Offline, there is no timestamp authority. Capture, watermark and hash all work with no network; the RFC 3161 layer queues and completes on reconnect, and until then the only time backing the record is the device clock. The viewfinder says which: "TSA server" or "Device clock".
• Photos only. Capture modes are 4:3 and 1:1 stills; there is no video or burst mode, so this does not apply to a video clip.
• Custom text is permanent. Because it is inside the hashed pixels, an edit to it later breaks the proof. Use it for stable facts — a case number — not for scratch notes.

What Prooflens does differently, honestly

Against the obvious alternative — a timestamp-camera app that stamps a corner and stops — three things stand out. The evidence context is on the image, so it is readable without the app or an account. Privacy is architectural: photos are captured, watermarked and hashed on-device and never uploaded; only the hash is transmitted, and it cannot be reversed into the image. And the template gallery renders the actual output on a sample photo rather than showing a mockup.

The limits are just as real, and all four are stated above: the burned coordinate line is fixed to decimal degrees with a sign-blind hemisphere suffix, only stills are supported, blockchain anchoring is Pro, and only two of the five templates are free.

The decision

If your evidence has to be read by a person who will never install an app, Prooflens is the straightforward choice and the free tier is enough to judge it. If your workflow needs MGRS burned into the pixels, video, or a coordinate line that carries its hemisphere, this is not the tool — and you now know to check for that before your first job site rather than after.

Download Prooflens on the App Store or read the Prooflens product page for the proof-chain side.