[ privacy ]
Counts, never contents.
This is the anti-BrowserGate: we read the shape of behavior — plus a few coarse facts your browser already exposes — to estimate likely human activity for that one purpose. We keep a minimal app-scoped proof signal, never a record of what you did, and we never sell it or expose identity. The raw redacted batch is analyzed in bounded request memory and is not persisted. Everything below is the complete list.
[ the_boundary ]
On a page that uses HumanProof, a tiny script watches the natural shape of how you act — pointer cadence, scrolling, focus, the rhythm of typing — recording only redacted shape: lengths, timestamps, whether an event was browser-trusted. It also reads a few coarse facts your browser already exposes — platform, languages, timezone, screen size, hardware — so we can check they agree with the headers your browser sends (a bot that lies in one place gives itself away). Never the characters you type, never where the pointer is, never the content of the page, and never a canvas/audio fingerprint or anything that tracks you across sites.
| datum | derived & sent | never sent |
|---|---|---|
| Pointer & scroll | Movement cadence and scroll ticks — timing only | Coordinates, what you clicked or read |
| Typing | Keypress and paste timing + counts | Key identities, clipboard contents, the words you wrote |
| Browser environment | Declared platform, languages, timezone, screen, hardware — coarse facts, cross-checked against your request headers | A canvas/audio fingerprint, or anything that tracks you across sites |
| Network (server-side) | Datacenter / Tor / proxy class of your IP — a derived flag | Your raw IP address |
Network class is derived server-side from the request — your raw IP is never stored (only a salted hash for rate-limiting). The browser-environment facts are compared against your request headers to catch a bot lying about itself; they are kept as part of the realness signal, never sold, and never exposed as a customer-visible fingerprint or used to join activity across apps.
The raw redacted behavior exists only in memory while the bounded request is validated and its verdict is derived; new batches are not stored. A short cleanup window removes any pre-migration one-shot rows. What we keep is the evidence-free proof signal — a score and bounded derived statistics, never anything that can name what you typed or read. The verdict we return to a site carries no internal feature names and no weights.
What we keep is the conclusion, not the tape: a small, derived likely-human score and the bounded statistics needed for standing and app-scoped reputation. We never sell it or hand a site identity; every token, lookup and retained reputation row is scoped to one customer app and cannot join activity across different apps.
To delete everything attached to you, email dan@ochoa.pro — confirmed within 48 hours.
humanproof.work · If anything here stops being true, that is a bug — report it.