The construction is simple and its properties follow directly from it. Every log entry stores, alongside its own content, a hash of the entry that preceded it. When a new entry is appended, its hash is computed over its own contents plus that previous hash. The first entry chains from a fixed genesis value so there is no ambiguity at the start.
The useful consequence is that each entry's hash transitively depends on every entry before it. Editing an old entry changes its content hash. The following entry stored the old value, so the link no longer matches, and the mismatch propagates forward through every subsequent entry. Deleting an entry removes a link the next one expects. Reordering breaks the sequence in the same way. In all three cases, verification fails, and because the chain is walked in order, it fails at a specific identifiable point — the verification reports the sequence number where the break occurred, so you learn not just that something changed but where the record stops being reliable.
Now the limits, stated plainly, because the distinction is often blurred in marketing and it should not be.
Tamper-evident is not tamper-proof. The log is a local file. Anyone with write access to it and knowledge of the scheme can rewrite the entire chain from the point of the edit forward, recomputing every subsequent hash, and produce a chain that verifies cleanly. A hash chain that is entirely local, with no external anchor, cannot prevent that. What it does reliably prevent is *casual* and *accidental* alteration going unnoticed: a manual edit in a text editor, a truncation, a partial overwrite, a corrupted write, a deleted line. Those are the realistic failure modes, and they are all caught.
What would be needed for more. Making the chain resistant to deliberate reconstruction requires an anchor outside the file — periodically publishing a hash somewhere the local user cannot rewrite, or signing entries with a key held elsewhere. ContextCleaner does neither, because it makes no network requests at all, and adding either would mean transmitting data off the machine. That is a deliberate trade in favour of the privacy property, and the app is explicit about which side of it landed rather than implying a guarantee it does not provide.
Related handling. Entry details pass through a scrubbing step before being written and hashed, so what the chain protects does not itself contain personal paths. The log rotates at a size threshold, keeping a bounded set of archives, and clearing rotates to an archive rather than destroying — so a clear action does not erase the record it was clearing, and each archive retains its own chain.
